diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 11b4b9ef05..cea1326c0c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -125,7 +125,7 @@ jobs:
         libgtk-3-dev
       # The tests build with the optional craft-fonts input (crates/text/build.rs), so the
       # Japanese font tests that skip without it run. Same commit as release.yml.
-      craft-fonts-ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
       # Cargo.toml's dev profile already keeps line tables only.
       dev-debug: ""
       env: |
@@ -156,11 +156,24 @@ jobs:
       # A panic still names its file and line; only backtrace frames lose theirs (Linux keeps
       # line-tables-only, so a backtrace with lines is one OS away).
       CARGO_PROFILE_DEV_DEBUG: "0"
+      # The runner has no Japanese or Simplified Chinese system font, and egui 0.37 panics on a
+      # missing glyph: the localized UI tests need the same craft-fonts input the gate and FreeBSD
+      # build with (crates/text/build.rs). Same commit as the gate above and release.yml.
+      CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
+      CRAFT_FONTS_REQUIRED: "1"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
+      - name: Check out craft-fonts
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: storytold/craft-fonts
+          ref: b076417b5880bd4154bd22f00695b1d28c6bea83
+          path: craft-fonts
+          persist-credentials: false
+
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           components: clippy
@@ -385,7 +398,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@2c76c034f9e32a5d6e2c104dc4df23a22476db04 # nightly
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # nightly
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: crates/${{ matrix.target.crate }}/fuzz
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index dca0dacfbb..e93efc1018 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -31,7 +31,7 @@ jobs:
     name: mdBook build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
       - name: Install mdBook
         run: cargo install mdbook --version 0.4.52 --locked
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index f15ec0e8d8..2b98d8c11d 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -32,7 +32,7 @@ jobs:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
     with:
-      craft-fonts-ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
       cargo-build-extra-args: "--features heif"
       # The VM's software Vulkan driver crashes (SIGSEGV) when several tests set up a device at
       # once, so photocraft-gpu's tests run one at a time, like ui-egui's integration tests.
diff --git a/.github/workflows/perf-nightly.yml b/.github/workflows/perf-nightly.yml
index 4b09278804..64592d9cf0 100644
--- a/.github/workflows/perf-nightly.yml
+++ b/.github/workflows/perf-nightly.yml
@@ -40,7 +40,7 @@ jobs:
     runs-on: macos-15
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -72,7 +72,7 @@ jobs:
 
       - name: Upload results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: perf-results
           path: |
@@ -83,7 +83,7 @@ jobs:
 
       - name: Upload baseline
         if: always() && inputs.update_baseline
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: perf-baseline
           path: perf/baseline.json
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bfdca9e3e9..4b78fac526 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
     with:
       app-name: photocraft
       app-title: PhotoCraft
-      craft-fonts-ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+      craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
       version: ${{ inputs.version }}
     secrets:
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 5b2b1e1470..fdec613767 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -26,6 +26,7 @@ next to them.
 | `crates/ui-egui/src/i18n/tr.tsv` | Turkish UI translations | PhotoCraft contributors | Original translations of PhotoCraft's English labels | MIT OR Apache-2.0, [`LICENSE-translations.txt`](crates/ui-egui/src/i18n/LICENSE-translations.txt) |
 | `crates/ui-egui/src/i18n/sr.tsv` | Serbian (Latin, Ekavian) UI translations | PhotoCraft contributors | Original translations of PhotoCraft's English labels | MIT OR Apache-2.0, [`LICENSE-translations.txt`](crates/ui-egui/src/i18n/LICENSE-translations.txt) |
 | `crates/ui-egui/src/i18n/ru.tsv` | Russian UI translations | PhotoCraft contributors | Original translations of PhotoCraft's English labels | MIT OR Apache-2.0, [`LICENSE-translations.txt`](crates/ui-egui/src/i18n/LICENSE-translations.txt) |
+| `epaint_default_fonts::EGUI_ICONS` (build input; deflated into `OUT_DIR/egui_fonts/egui-icons.ttf.deflate`, registered by `crates/ui-egui/src/egui_fonts.rs`) | egui-icons, five-glyph subset of emoji-icon-font | John Slegers | [egui fork at 6d518fc](https://github.com/storytold/egui/tree/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts), [original](https://github.com/jslegers/emoji-icon-font); egui subset, unmodified here | MIT; Copyright (c) 2014 John Slegers; full upstream notice in [NOTICE](NOTICE) |
 | `assets/fonts/Inter-Regular.ttf`, `Inter-Medium.ttf`, `Inter-SemiBold.ttf` | Inter 4.001 (UI font) | The Inter Project Authors (Rasmus Andersson) | <https://github.com/rsms/inter> | SIL OFL 1.1, [`assets/fonts/OFL-Inter.txt`](assets/fonts/OFL-Inter.txt) |
 | `assets/fonts/JetBrainsMono-Regular.ttf` | JetBrains Mono 2.305 (numeric font) | The JetBrains Mono Project Authors | <https://github.com/JetBrains/JetBrainsMono> | SIL OFL 1.1, [`assets/fonts/OFL-JetBrainsMono.txt`](assets/fonts/OFL-JetBrainsMono.txt) |
 | `assets/icons/*.svg` except `slice-knife.svg`, `slice-select.svg`, `sampler.svg`, `artboard.svg`, `perspective-crop.svg`, `frame-placeholder.svg`, `ellipse-dashed.svg`, `gradient.svg`, `type-mask.svg`, `type-mask-vertical.svg`, `text-warp.svg`, `clip-below.svg`, `clip-release.svg`, `layer-mask.svg`, `adjustment-layer.svg`, `brush-replace.svg`, `quick-selection.svg`, `eraser-background.svg`, `eraser-magic.svg`, `lasso-magnetic.svg`, `direct-select.svg`, `convert-point.svg`, `pen-add-anchor.svg`, `pen-delete-anchor.svg`, `pen-freeform.svg`, `pen-curvature.svg`, `bandage-sparkle.svg`, `painting-symmetry.svg`, `symmetry-*.svg` and `marquee-{row,column}.svg`, `align-edge-*.svg` and `distribute-*.svg` (113 files; `star-filled.svg` is `star.svg` with a solid fill) | Lucide icons | Lucide Icons and Contributors | <https://github.com/lucide-icons/lucide> (`icons/<name>.svg`; `align-*` are now named `text-align-*` upstream) | ISC, [`assets/icons/LICENSE-lucide.txt`](assets/icons/LICENSE-lucide.txt) |
@@ -115,7 +116,7 @@ next to the files:
 
 | Path (fetched) | Title | Author | Source | License |
 |---|---|---|---|---|
-| `corpus/photoshop/` (256 PSDs) | Photoshop oracle corpus: smart filters, layer-style effects, type, adjustments in every mode and depth | PhotoCraft contributors (authored with Adobe Photoshop 2026 by a script) | [https://github.com/storytold/photocraft-corpus](https://github.com/storytold/photocraft-corpus) (`photoshop/`, with its generator and README) | MIT OR Apache-2.0 |
+| `corpus/photoshop/` (258 PSDs) | Photoshop oracle corpus: smart filters, layer-style effects, type, adjustments in every mode and depth | PhotoCraft contributors (authored with Adobe Photoshop 2026 by a script) | [https://github.com/storytold/photocraft-corpus](https://github.com/storytold/photocraft-corpus) (`photoshop/`, with its generator and README) | MIT OR Apache-2.0 |
 | `corpus/gimp/` (28 files, 251 KB) | GIMP XCF oracles: 40×30 procedural layers written by GIMP 3.2.6 through the corpus generator `tools/gimp-xcf/xcf_fixtures.py`, each with GIMP's merged rendering as a PNG | PhotoCraft contributors (authored with GIMP 3.2.6 by a script) | [https://github.com/storytold/photocraft-corpus](https://github.com/storytold/photocraft-corpus) (`gimp/`, with its generator and README) | MIT OR Apache-2.0 |
 | `corpus/psd-tools/` (309 files) | psd-tools test set | Kota Yamaguchi and contributors | [psd-tools `tests/psd_files`](https://github.com/psd-tools/psd-tools/tree/main/tests/psd_files) | MIT, Copyright (c) 2019 Kota Yamaguchi |
 | `corpus/psd/` (170 files) | Small selection of the psd-tools and ag-psd test files | Kota Yamaguchi; Agamnentzar | psd-tools (above) and [ag-psd `test/`](https://github.com/Agamnentzar/ag-psd/tree/master/test) | MIT (both) |
diff --git a/Cargo.lock b/Cargo.lock
index b90e1f5cd5..128d0f35bd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,9 +4,9 @@ version = 4
 
 [[package]]
 name = "accesskit"
-version = "0.24.1"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3b7f7f85a7e5f68090000ed7622545829afd484d210358702ae4cb97dd0c320"
+checksum = "ad442f58ee04714aaa0ba0a2768c1ea1935b29507bb22ddece8cbbc76db02932"
 dependencies = [
  "enumn",
  "serde",
@@ -15,12 +15,12 @@ dependencies = [
 
 [[package]]
 name = "accesskit_atspi_common"
-version = "0.18.1"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e8c61bee90b42a772d39d06a740207dc71a4e780004ace1db8d99fb1baaa954"
+checksum = "52c182f9c282ac9c5638d876d551d15e5f7d397ec263349a0c6a2b61595dd5e4"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.36.0",
+ "accesskit_consumer",
  "atspi-common",
  "phf",
  "serde",
@@ -29,43 +29,37 @@ dependencies = [
 
 [[package]]
 name = "accesskit_consumer"
-version = "0.35.0"
+version = "0.39.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53cf47daed85312e763fbf85ceca136e0d7abc68e0a7e12abe11f48172bc3b10"
+checksum = "8a45e2bb300bea6d5f33a82c3e051c3ddc6f41c209750f68a0acbe991a284344"
 dependencies = [
  "accesskit",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
-name = "accesskit_consumer"
-version = "0.36.0"
+name = "accesskit_ios"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25e0d7e25d06f4dc21d1774d67146e9e80d6789216cbd4d1e88185b0095dba60"
+checksum = "28e539d64b27fd4c14de8f78ada8f7c944c092f52f7e49fb63316507a57f6937"
 dependencies = [
  "accesskit",
- "hashbrown 0.16.1",
-]
-
-[[package]]
-name = "accesskit_consumer"
-version = "0.38.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d10a236f96f87d70732e44520046785431ef01d5bcd6b041317bfadd2f88245"
-dependencies = [
- "accesskit",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
+ "objc2 0.5.2",
+ "objc2-foundation 0.2.2",
+ "objc2-ui-kit 0.2.2",
 ]
 
 [[package]]
 name = "accesskit_macos"
-version = "0.26.3"
+version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce02dc63b43f0c9296af9ac946312a2dc8814427d7a64d2d600971dac55b6076"
+checksum = "5701624bf6a11efb6d4c8e922bf44126ed96250e5faa9a7a0468c979635839a4"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.38.0",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
  "objc2 0.5.2",
  "objc2-app-kit 0.2.2",
  "objc2-foundation 0.2.2",
@@ -73,9 +67,9 @@ dependencies = [
 
 [[package]]
 name = "accesskit_unix"
-version = "0.21.1"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b016ca8db0ea0ea2ceff29a9d6240391492d960716aa471967c00e8cc8cb197c"
+checksum = "202f24df034a7476d07b7f74284de84f6d62aabd858dbe7ee9cad3b7ad6f8f9d"
 dependencies = [
  "accesskit",
  "accesskit_atspi_common",
@@ -91,13 +85,13 @@ dependencies = [
 
 [[package]]
 name = "accesskit_windows"
-version = "0.32.1"
+version = "0.35.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eff7009f1a532e917d66970a1e80c965140c6cfbbabbdde3d64e5431e6c78e21"
+checksum = "ce63f35d6bdcf59f26b76b3379063f738e6412cef46999cc772d46aa3de35adb"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.35.0",
- "hashbrown 0.16.1",
+ "accesskit_consumer",
+ "hashbrown 0.17.1",
  "static_assertions",
  "windows",
  "windows-core",
@@ -105,11 +99,12 @@ dependencies = [
 
 [[package]]
 name = "accesskit_winit"
-version = "0.32.2"
+version = "0.34.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fe9a94394896352cc4660ca2288bd4ef883d83238853c038b44070c8f134313"
+checksum = "ee96dd150375c05912d8a473f98c2fb155fb3234fac88292d396548a2460fa77"
 dependencies = [
  "accesskit",
+ "accesskit_ios",
  "accesskit_macos",
  "accesskit_unix",
  "accesskit_windows",
@@ -179,6 +174,15 @@ dependencies = [
  "alloc-no-stdlib",
 ]
 
+[[package]]
+name = "alloca"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5a7d05ea6aea7e9e64d25b9156ba2fee3fdd659e34e41063cd2fc7cd020d7f4"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
@@ -277,7 +281,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -288,7 +292,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -305,21 +309,21 @@ checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
 
 [[package]]
 name = "arboard"
-version = "3.6.1"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0348a1c054491f4bfe6ab86a7b6ab1e44e45d899005de92f58b3df180b36ddaf"
+checksum = "aeb9553e62312c8756a5979254fc6d7da8bbeb5986a1e17037fab932f7037917"
 dependencies = [
  "clipboard-win",
  "image",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
  "parking_lot",
  "percent-encoding",
- "windows-sys 0.60.2",
+ "windows-sys 0.52.0",
  "wl-clipboard-rs",
  "x11rb",
 ]
@@ -655,15 +659,6 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "bit-set"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
-dependencies = [
- "bit-vec 0.8.0",
-]
-
 [[package]]
 name = "bit-set"
 version = "0.10.0"
@@ -674,10 +669,13 @@ dependencies = [
 ]
 
 [[package]]
-name = "bit-vec"
-version = "0.8.0"
+name = "bit-set"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+checksum = "56d87354e4229f54a44f7bf2435906a4656dba36026ab6eaca629a2c436a691c"
+dependencies = [
+ "bit-vec 0.10.1",
+]
 
 [[package]]
 name = "bit-vec"
@@ -685,6 +683,16 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
 
+[[package]]
+name = "bit-vec"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5727b15fa97d4f4fee0a3b7c3d550ed0269f54329207b86388de918604e31269"
+dependencies = [
+ "borsh",
+ "serde",
+]
+
 [[package]]
 name = "bit_field"
 version = "0.10.3"
@@ -758,7 +766,7 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -774,6 +782,30 @@ dependencies = [
  "piper",
 ]
 
+[[package]]
+name = "borsh"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a"
+dependencies = [
+ "borsh-derive",
+ "bytes",
+ "cfg_aliases",
+]
+
+[[package]]
+name = "borsh-derive"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12cdfe656708a01f89b451a7d36466e6fe6c414de0aa18fc54f864f6f9ca9f56"
+dependencies = [
+ "once_cell",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "brotli-decompressor"
 version = "5.0.3"
@@ -1309,12 +1341,20 @@ dependencies = [
 [[package]]
 name = "craft-docpath"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=82a24b006eefa036b43c09a67fb9a3fbd17ffe63#82a24b006eefa036b43c09a67fb9a3fbd17ffe63"
+source = "git+https://github.com/storytold/craft-libs?rev=495e5971bc024aa96e6ed318cb6e7cd3a0103184#495e5971bc024aa96e6ed318cb6e7cd3a0103184"
+
+[[package]]
+name = "craft-jpeg"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=495e5971bc024aa96e6ed318cb6e7cd3a0103184#495e5971bc024aa96e6ed318cb6e7cd3a0103184"
+dependencies = [
+ "thiserror 2.0.21",
+]
 
 [[package]]
 name = "craft-print"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=3d37da389a3618ab9b76109da11416e9ca4ea719#3d37da389a3618ab9b76109da11416e9ca4ea719"
+source = "git+https://github.com/storytold/craft-libs?rev=495e5971bc024aa96e6ed318cb6e7cd3a0103184#495e5971bc024aa96e6ed318cb6e7cd3a0103184"
 dependencies = [
  "craft-winprint-gdi",
  "miniz_oxide 0.8.9",
@@ -1327,12 +1367,41 @@ dependencies = [
 [[package]]
 name = "craft-ui"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=5c874d51eeb3de70e735c8ce87a59a7dedd47675#5c874d51eeb3de70e735c8ce87a59a7dedd47675"
+source = "git+https://github.com/storytold/craft-libs?rev=495e5971bc024aa96e6ed318cb6e7cd3a0103184#495e5971bc024aa96e6ed318cb6e7cd3a0103184"
 dependencies = [
  "egui",
+ "log",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
+ "objc2-foundation 0.3.2",
  "serde",
 ]
 
+[[package]]
+name = "craft-update"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=495e5971bc024aa96e6ed318cb6e7cd3a0103184#495e5971bc024aa96e6ed318cb6e7cd3a0103184"
+dependencies = [
+ "chrono",
+ "dunce",
+ "egui",
+ "flate2",
+ "getrandom 0.3.4",
+ "log",
+ "plist",
+ "semver",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tar",
+ "tempfile",
+ "ureq",
+ "verifysign",
+ "winreg",
+ "winsafe",
+ "zip",
+]
+
 [[package]]
 name = "craft-winprint-gdi"
 version = "0.1.0"
@@ -1343,32 +1412,31 @@ dependencies = [
 
 [[package]]
 name = "crc32fast"
-version = "1.5.2"
+version = "1.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
+checksum = "0ba106e844045ddc02c20768ac4b0b7cb45f2cc2ecbd833ac9f5dacb183c2055"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "criterion"
-version = "0.5.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2b12d017a929603d80db1831cd3a24082f8137ce19c69e6447f54f5fc8d692f"
+checksum = "950046b2aa2492f9a536f5f4f9a3de7b9e2476e575e05bd6c333371add4d98f3"
 dependencies = [
+ "alloca",
  "anes",
  "cast",
  "ciborium",
  "clap",
  "criterion-plot",
- "is-terminal",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "num-traits",
- "once_cell",
  "oorandom",
+ "page_size",
  "regex",
  "serde",
- "serde_derive",
  "serde_json",
  "tinytemplate",
  "walkdir",
@@ -1376,12 +1444,12 @@ dependencies = [
 
 [[package]]
 name = "criterion-plot"
-version = "0.5.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b50826342786a51a89e2da3a28f1c32b06e387201bc2d19791f622c673706b1"
+checksum = "d8d80a2f4f5b554395e47b5d8305bc3d27813bacb73493eb1001e8f76dae29ea"
 dependencies = [
  "cast",
- "itertools 0.10.5",
+ "itertools 0.13.0",
 ]
 
 [[package]]
@@ -1516,6 +1584,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "deranged"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e9de72ce2ad1f90dc62fa25f0f430ef85eb4b0d8fa0be4f30373bc40a21d28e"
+
 [[package]]
 name = "dify"
 version = "0.8.0"
@@ -1554,7 +1628,7 @@ dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
  "libc",
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -1667,9 +1741,8 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
 [[package]]
 name = "ecolor"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0656a7530b9e2841ee7a5f983965bdd9840c32f4012f759cfd44b912cced6b34"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "emath",
@@ -1678,9 +1751,8 @@ dependencies = [
 
 [[package]]
 name = "eframe"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55ad41fac6e3149abb4866e93df37dbd33baa95db525c3368c944584e95a5dc2"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1694,7 +1766,7 @@ dependencies = [
  "image",
  "js-sys",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "parking_lot",
@@ -1703,6 +1775,7 @@ dependencies = [
  "profiling",
  "raw-window-handle",
  "ron",
+ "send_wrapper",
  "serde",
  "static_assertions",
  "wasm-bindgen",
@@ -1715,9 +1788,8 @@ dependencies = [
 
 [[package]]
 name = "egui"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc938cc27cd911415e1e4d151bc56ff9df063d8db081374e87aeb805ea74b2ba"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "accesskit",
  "ahash",
@@ -1737,9 +1809,8 @@ dependencies = [
 
 [[package]]
 name = "egui-wgpu"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cef1f6d1bba40b09a4d0d62cb822b81030922cfbf65c5373398c3a3caafc5bd"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1757,31 +1828,34 @@ dependencies = [
 
 [[package]]
 name = "egui-winit"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98466000559d66ba4db786a30448b01483946add4188e7f10f522a27b4fb89cc"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "accesskit_winit",
  "arboard",
+ "block2 0.6.2",
  "bytemuck",
  "egui",
+ "image",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "objc2-ui-kit 0.3.2",
+ "parking_lot",
  "profiling",
  "raw-window-handle",
  "serde",
  "smithay-clipboard",
  "web-time",
+ "windows-sys 0.61.2",
  "winit",
 ]
 
 [[package]]
 name = "egui_extras"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05cbdc785020861553f230f23d330ba1fb72613b9d8e0e457f3bdc8ba6db6dcf"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "egui",
@@ -1794,9 +1868,8 @@ dependencies = [
 
 [[package]]
 name = "egui_glow"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "606ed4167daf341e5753d703285c4c1d562324b2c07aa8f405cd7d066fe58f3b"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "egui",
@@ -1808,9 +1881,8 @@ dependencies = [
 
 [[package]]
 name = "egui_kittest"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eb3f3effb2726fee23449293e67acbf6cc6ce35525b1722bd5743bb348114d5"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "dify",
  "eframe",
@@ -1835,9 +1907,8 @@ checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
 
 [[package]]
 name = "emath"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c8d4141cf0f60fb2f7aefaf352d3ffa5171ef0ab09731c64391801e95e48f1"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "bytemuck",
  "serde",
@@ -1865,22 +1936,22 @@ checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
 
 [[package]]
 name = "enum-map"
-version = "2.7.3"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6866f3bfdf8207509a033af1a75a7b08abda06bbaaeae6669323fd5a097df2e9"
+checksum = "d4532960034c15ba2f55e9eee631040ecc473c32e6c4b200828c759840f13a06"
 dependencies = [
  "enum-map-derive",
 ]
 
 [[package]]
 name = "enum-map-derive"
-version = "0.17.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f282cfdfe92516eb26c2af8589c274c7c17681f5ecc03c18255fe741c6aa64eb"
+checksum = "7127272f64b3e098f7d81f350d672081b879bff896d219c42370dc858b1af9ff"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -1917,9 +1988,8 @@ dependencies = [
 
 [[package]]
 name = "epaint"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0ec0308dc23130fc1a7d4623a8534c2ed069c6dc84e258ee4f3de99615aa1a3"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 dependencies = [
  "ahash",
  "bytemuck",
@@ -1936,16 +2006,17 @@ dependencies = [
  "serde",
  "skrifa",
  "smallvec",
+ "unicode-bidi",
  "unicode-general-category",
+ "unicode-properties",
  "unicode-segmentation",
  "vello_cpu",
 ]
 
 [[package]]
 name = "epaint_default_fonts"
-version = "0.36.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773fa9c96dd0dbef887e39d0ed6177f141cce4d68e6041df77570aa3702dfa13"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 
 [[package]]
 name = "equator"
@@ -1980,7 +2051,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2161,7 +2232,7 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "90642cf66dde7f205dc8b42dfe57b47d0f3a29f571b832742883ef512e23fe55"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
 ]
@@ -2225,7 +2296,7 @@ dependencies = [
  "hashbrown 0.17.1",
  "linebender_resource_handle",
  "memmap2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-text",
  "objc2-foundation 0.3.2",
@@ -2526,9 +2597,9 @@ dependencies = [
 
 [[package]]
 name = "glifo"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed4a1bb24121291d27230c1b1b44e07d6a9b28cefdb32fe1581dfb84e14f940a"
+checksum = "282a26c1e23de04bdab3e34a21b6f877a479b96737792516b9b8b8f69b6661be"
 dependencies = [
  "bytemuck",
  "foldhash 0.2.0",
@@ -2572,7 +2643,7 @@ dependencies = [
  "glutin_glx_sys",
  "glutin_wgl_sys",
  "libloading",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
@@ -3099,7 +3170,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "20fd6de4ccfcc187e38bc21cfa543cb5a302cb86a8b114eb7f0bf0dc9f8ac00f"
 dependencies = [
  "io-lifetimes 3.0.1",
- "windows-sys 0.60.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3129,17 +3200,6 @@ dependencies = [
  "once_cell",
 ]
 
-[[package]]
-name = "is-terminal"
-version = "0.4.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
-dependencies = [
- "hermit-abi",
- "libc",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "is-wsl"
 version = "0.4.0"
@@ -3165,6 +3225,15 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -3481,12 +3550,12 @@ checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
 
 [[package]]
 name = "kittest"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ceaa75eb0036a32b6b9833962eb18137449e9817e2e586006471925b727fd5"
+checksum = "0bb81a721ba76aa095b7f45deb180504f786904e56ca4b8e141f66eb89a78b75"
 dependencies = [
  "accesskit",
- "accesskit_consumer 0.35.0",
+ "accesskit_consumer",
 ]
 
 [[package]]
@@ -3532,9 +3601,9 @@ checksum = "7a79a3332a6609480d7d0c9eab957bca6b455b91bb84e66d19f5ff66294b85b8"
 
 [[package]]
 name = "libc"
-version = "0.2.189"
+version = "0.2.191"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
 
 [[package]]
 name = "libfuzzer-sys"
@@ -3792,14 +3861,14 @@ dependencies = [
 
 [[package]]
 name = "muda"
-version = "0.21.1"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a7b000cca0783af26837fe2ebd9ddf1c42279463c085b97622ee1d2f444b89e"
+checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
 dependencies = [
  "crossbeam-channel",
  "dpi",
  "keyboard-types",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
@@ -3888,6 +3957,18 @@ version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "no_std_io2"
 version = "0.9.4"
@@ -3948,6 +4029,12 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
 [[package]]
 name = "num-derive"
 version = "0.4.2"
@@ -4029,9 +4116,9 @@ dependencies = [
 
 [[package]]
 name = "objc2"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
+checksum = "08849bbd4767dfae9457696856ae1c84fe4e0281bbe4a7abff2d0e06fb7981f8"
 dependencies = [
  "objc2-encode",
 ]
@@ -4061,7 +4148,7 @@ dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
  "libc",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-cloud-kit 0.3.2",
  "objc2-core-data 0.3.2",
  "objc2-core-foundation",
@@ -4082,7 +4169,7 @@ dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
  "dispatch2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-avf-audio",
  "objc2-core-audio-types",
  "objc2-core-foundation",
@@ -4101,7 +4188,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13a380031deed8e99db00065c45937da434ca987c034e13b87e4441f9e4090be"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-foundation 0.3.2",
 ]
 
@@ -4125,7 +4212,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73ad74d880bb43877038da939b7427bba67e9dd42004a18b809ba7d87cee241c"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-foundation 0.3.2",
 ]
 
@@ -4147,7 +4234,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1eebcea8b0dbff5f7c8504f3107c68fc061a3eb44932051c8cf8a68d969c3b2"
 dependencies = [
  "dispatch2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-audio-types",
  "objc2-core-foundation",
 ]
@@ -4159,7 +4246,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a89f2ec274a0cf4a32642b2991e8b351a404d290da87bb6a9a9d8632490bd1c"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -4181,7 +4268,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b402a653efbb5e82ce4df10683b6b28027616a2715e90009947d50b8dd298fa"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-foundation 0.3.2",
 ]
 
@@ -4195,7 +4282,7 @@ dependencies = [
  "block2 0.6.2",
  "dispatch2",
  "libc",
- "objc2 0.6.4",
+ "objc2 0.6.5",
 ]
 
 [[package]]
@@ -4208,7 +4295,7 @@ dependencies = [
  "block2 0.6.2",
  "dispatch2",
  "libc",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-io-surface",
  "objc2-metal 0.3.2",
@@ -4232,7 +4319,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5d563b38d2b97209f8e861173de434bd0214cf020e3423a52624cd1d989f006"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-foundation 0.3.2",
 ]
 
@@ -4257,7 +4344,7 @@ dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
  "dispatch2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-audio",
  "objc2-core-audio-types",
  "objc2-core-foundation",
@@ -4271,7 +4358,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
 ]
@@ -4284,7 +4371,7 @@ checksum = "d425caf1df73233f29fd8a5c3e5edbc30d2d4307870f802d18f00d83dc5141a6"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-io-surface",
@@ -4319,7 +4406,7 @@ dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
  "libc",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
 ]
 
@@ -4329,7 +4416,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32b0446e98cf4a784cc7a0177715ff317eeaa8463841c616cfc78aa4f953c4ea"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
 ]
@@ -4341,7 +4428,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
 ]
 
@@ -4363,7 +4450,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "edd9fdde720df3da7046bb9097811000c1e7ab5cd579fa89d96b27d56781fb30"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-audio-types",
  "objc2-core-foundation",
  "objc2-core-media",
@@ -4389,7 +4476,7 @@ checksum = "a0125f776a10d00af4152d74616409f0d4a2053a6f57fa5b7d6aa2854ac04794"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-foundation 0.3.2",
 ]
 
@@ -4413,7 +4500,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
@@ -4458,7 +4545,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
 dependencies = [
  "bitflags 2.13.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
 ]
@@ -4507,9 +4594,9 @@ checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
 
 [[package]]
 name = "open"
-version = "5.4.4"
+version = "5.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa576c76302b7b808eecc68061e67336c47833ef9d22caa74dda10fa9675eebc"
+checksum = "8d8c8b8e725ad26404d6896eb2f064294a0a7b4f1d9120210d85544684c4ca95"
 dependencies = [
  "is-wsl",
  "libc",
@@ -4557,7 +4644,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "page_size"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d5b2194ed13191c1999ae0704b7839fb18384fa22e49b57eeaa97d79ce40da"
+dependencies = [
+ "libc",
+ "winapi",
 ]
 
 [[package]]
@@ -4691,9 +4788,9 @@ dependencies = [
 
 [[package]]
 name = "phf"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+checksum = "010378780309880b08997fae13be7834dba947d36393bd372f2b1556deb2a2f6"
 dependencies = [
  "phf_macros",
  "phf_shared",
@@ -4702,9 +4799,9 @@ dependencies = [
 
 [[package]]
 name = "phf_generator"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+checksum = "aeb62e0959d5a1bebc965f4d15d9e2b7cea002b6b0f5ba8cde6cc26738467100"
 dependencies = [
  "fastrand",
  "phf_shared",
@@ -4712,9 +4809,9 @@ dependencies = [
 
 [[package]]
 name = "phf_macros"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+checksum = "5fa8d0ca26d424d27630da600c6624696e7dec8bf7b3b492b383c5dc49e5e085"
 dependencies = [
  "phf_generator",
  "phf_shared",
@@ -4725,22 +4822,23 @@ dependencies = [
 
 [[package]]
 name = "phf_shared"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+checksum = "c6fd9027e2d9319be6349febd1db4e8d02aa544921200c9b777720ac34a3aa89"
 dependencies = [
  "siphasher",
 ]
 
 [[package]]
 name = "photocraft"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "arboard",
  "async-io",
  "chrono",
  "clap",
  "core-graphics2",
+ "craft-update",
  "dispatch2",
  "eframe",
  "egui",
@@ -4748,7 +4846,7 @@ dependencies = [
  "futures-lite",
  "log",
  "muda",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
  "open",
@@ -4768,10 +4866,10 @@ dependencies = [
  "resvg",
  "rfd",
  "ron",
+ "serde",
  "serde_json",
  "tempfile",
  "thiserror 2.0.21",
- "ureq",
  "winit",
  "winresource",
  "winsafe",
@@ -4783,7 +4881,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-affinity"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "crc32fast",
  "flate2",
@@ -4793,7 +4891,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-algo"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "photocraft-color",
  "photocraft-geom",
@@ -4807,9 +4905,9 @@ dependencies = [
 
 [[package]]
 name = "photocraft-automation"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "cap-std",
  "clap",
  "getrandom 0.3.4",
@@ -4831,7 +4929,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-cli"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "clap",
  "clap_complete",
@@ -4850,7 +4948,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-cms"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "moxcms",
  "rayon",
@@ -4858,8 +4956,9 @@ dependencies = [
 
 [[package]]
 name = "photocraft-codecs"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
+ "craft-jpeg",
  "exr",
  "flate2",
  "half",
@@ -4879,7 +4978,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-color"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "photocraft-cms",
  "serde",
@@ -4887,7 +4986,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-compose"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "criterion",
  "photocraft-cms",
@@ -4903,7 +5002,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-doc"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "photocraft-color",
  "photocraft-geom",
@@ -4914,7 +5013,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-engine"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "blake3",
  "chrono",
@@ -4955,7 +5054,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-format"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "blake3",
  "crc32fast",
@@ -4978,17 +5077,19 @@ dependencies = [
 
 [[package]]
 name = "photocraft-geom"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "photocraft-gpu"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
+ "bytemuck",
  "half",
  "log",
+ "photocraft-algo",
  "photocraft-cms",
  "photocraft-color",
  "photocraft-compose",
@@ -5003,14 +5104,14 @@ dependencies = [
 
 [[package]]
 name = "photocraft-heif"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "heic-rs",
 ]
 
 [[package]]
 name = "photocraft-io"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "blake3",
  "craft-docpath",
@@ -5037,33 +5138,38 @@ dependencies = [
  "roxmltree 0.21.1",
  "serde_json",
  "thiserror 2.0.21",
+ "tiff",
+ "zune-core 0.5.3",
+ "zune-jpegxl",
 ]
 
 [[package]]
 name = "photocraft-ipp"
-version = "0.15.1"
+version = "0.16.0"
 
 [[package]]
 name = "photocraft-ops"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "photocraft-doc",
 ]
 
 [[package]]
 name = "photocraft-paint"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
+ "photocraft-cms",
  "photocraft-color",
  "photocraft-geom",
  "photocraft-raster",
+ "rayon",
  "serde",
  "serde_json",
 ]
 
 [[package]]
 name = "photocraft-plugins"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "photocraft-color",
  "photocraft-geom",
@@ -5079,7 +5185,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-psd"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "flate2",
  "photocraft-psd",
@@ -5090,7 +5196,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-raster"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "photocraft-color",
  "photocraft-geom",
@@ -5101,7 +5207,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-raw"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "flate2",
  "image",
@@ -5116,10 +5222,10 @@ dependencies = [
 
 [[package]]
 name = "photocraft-tablet"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "block2 0.6.2",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
@@ -5128,7 +5234,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-testkit"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "memory-stats",
  "serde_json",
@@ -5136,7 +5242,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-text"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "flate2",
  "parley",
@@ -5151,11 +5257,12 @@ dependencies = [
 
 [[package]]
 name = "photocraft-ui-egui"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "craft-print",
  "craft-ui",
+ "craft-update",
  "eframe",
  "egui",
  "egui_extras",
@@ -5189,12 +5296,13 @@ dependencies = [
  "tempfile",
  "toml",
  "unicode-bidi",
+ "web-time",
  "winsafe",
 ]
 
 [[package]]
 name = "photocraft-vector"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "photocraft-color",
  "photocraft-doc",
@@ -5205,7 +5313,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-web"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "eframe",
  "egui",
@@ -5227,7 +5335,7 @@ dependencies = [
 
 [[package]]
 name = "photocraft-web-boot"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "flate2",
  "js-sys",
@@ -5316,6 +5424,19 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
+[[package]]
+name = "plist"
+version = "1.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "327a4cb2ad49dc48adfdc9da89e22c64d488b508c67a044d71ba729e4521a285"
+dependencies = [
+ "base64 0.23.1",
+ "indexmap",
+ "quick-xml 0.42.0",
+ "serde",
+ "time",
+]
+
 [[package]]
 name = "png"
 version = "0.17.16"
@@ -5403,6 +5524,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "powerfmt"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -5490,16 +5617,17 @@ dependencies = [
 
 [[package]]
 name = "proptest"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
+checksum = "b8530004ccb15eae51c7e40009fbe317f341f804db54dc033eec1c50be28cfa0"
 dependencies = [
- "bit-set 0.8.0",
- "bit-vec 0.8.0",
+ "bit-set 0.11.1",
+ "bit-vec 0.10.1",
  "bitflags 2.13.2",
+ "chacha20",
+ "core_detect",
  "num-traits",
- "rand 0.9.5",
- "rand_chacha",
+ "rand 0.10.3",
  "rand_xorshift",
  "regex-syntax",
  "rusty-fork",
@@ -5566,6 +5694,15 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "quick-xml"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quinn"
 version = "0.11.12"
@@ -5620,7 +5757,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5707,11 +5844,11 @@ dependencies = [
 
 [[package]]
 name = "rand_xorshift"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+checksum = "60aa6af80be32871323012e02e6e65f8a7cc7890931ae421d217ad8fe0df2ccf"
 dependencies = [
- "rand_core 0.9.5",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -5790,7 +5927,7 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40d213455a5f1dc59214213c7330e074ddf8114c9a42411eb890c767357ce135"
 dependencies = [
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
  "objc2-quartz-core 0.3.2",
@@ -5986,7 +6123,7 @@ dependencies = [
  "js-sys",
  "libc",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
@@ -6027,13 +6164,14 @@ dependencies = [
 
 [[package]]
 name = "rmcp"
-version = "3.5.0"
+version = "3.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fae7019994ae0fe4ada40b732f798f3ff26f0f04facb1477f1bf37eb4f18a2d3"
+checksum = "ceb42e9e47443cd83a834dea57b5816d35481417bae72ade5dc5615c59122e26"
 dependencies = [
  "chrono",
  "futures",
  "indexmap",
+ "libc",
  "pastey 0.2.3",
  "pin-project-lite",
  "rmcp-macros",
@@ -6050,9 +6188,9 @@ dependencies = [
 
 [[package]]
 name = "rmcp-macros"
-version = "3.5.0"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e66877136e969d5a2d561ee5841b17717a0619aebd64abb47a2a2f46e34683"
+checksum = "967fa7f7935d7d6217d593df0e8e5c9307bcaf256974a5a9ee64476c97735389"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -6154,7 +6292,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -6223,7 +6361,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -6321,9 +6459,9 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "1.2.2"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
+checksum = "ab508826f74a77ca9d5aba6ff19b522583ee3eaf28a19384ff3d0e5835fadf6e"
 dependencies = [
  "chrono",
  "dyn-clone",
@@ -6335,9 +6473,9 @@ dependencies = [
 
 [[package]]
 name = "schemars_derive"
-version = "1.2.2"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98c67716b46af2f0b8cf752abc930f6f9aecfbf671ecfb531db8a31dbe4e2ba"
+checksum = "e1c3a92094fa7d61aa124645844facb6b554dfc797136d0f5fd1f890e2bffc69"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6391,6 +6529,16 @@ name = "semver"
 version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "send_wrapper"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73"
 
 [[package]]
 name = "serde"
@@ -6435,9 +6583,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
 dependencies = [
  "itoa",
  "memchr",
@@ -7088,10 +7236,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.5",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -7157,6 +7305,36 @@ dependencies = [
  "zune-jpeg 0.5.15",
 ]
 
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
 [[package]]
 name = "tiny-skia"
 version = "0.11.4"
@@ -7233,9 +7411,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.53.1"
+version = "1.54.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
 dependencies = [
  "bytes",
  "libc",
@@ -7471,6 +7649,12 @@ dependencies = [
  "rustc-hash 2.1.3",
 ]
 
+[[package]]
+name = "typed-path"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
+
 [[package]]
 name = "typeid"
 version = "1.0.3"
@@ -7579,6 +7763,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cde93ff05758a36a851a398a772b0b79a82fbe3c186a46f2696baaeaf84c966b"
 dependencies = [
  "base64 0.23.1",
+ "flate2",
  "log",
  "percent-encoding",
  "rustls",
@@ -7586,7 +7771,6 @@ dependencies = [
  "rustls-platform-verifier",
  "ureq-proto",
  "utf8-zero",
- "webpki-roots",
 ]
 
 [[package]]
@@ -7683,9 +7867,9 @@ dependencies = [
 
 [[package]]
 name = "vello_common"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2e9aed918117e8152c9eddfd8362d73c465c23f26c44786aa331707b8a64fa2"
+checksum = "bbb2141a2bca6e6d598e471fd4d1d7eed8e020aad6a28187edda07f091a325dd"
 dependencies = [
  "bytemuck",
  "fearless_simd",
@@ -7698,9 +7882,9 @@ dependencies = [
 
 [[package]]
 name = "vello_cpu"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac7349e1f55f6b801c7c277958df4ea53e7f20f21e8014910ad888b2ecda93ea"
+checksum = "ace506ca414548966fcf3c283be94eb1cad8254de488791ee698bf438b0890a9"
 dependencies = [
  "bytemuck",
  "glifo",
@@ -7708,6 +7892,16 @@ dependencies = [
  "vello_common",
 ]
 
+[[package]]
+name = "verifysign"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6acfcc42a8d44f340d001193d97ef56bf33210b51ad760ae8308c97d5241ca51"
+dependencies = [
+ "core-foundation 0.10.1",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "version-compare"
 version = "0.2.1"
@@ -7821,12 +8015,12 @@ dependencies = [
 
 [[package]]
 name = "wasm-encoder"
-version = "0.261.0"
+version = "0.262.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2608e8bb6d67fd68f5a8d0eb1363d6e7bcbc1f8ded5a0bd3a1e382462b876b22"
+checksum = "4495a6f85dd94c411c749303efcbc5defade0b0cbdbc0541495241ab917a9b5a"
 dependencies = [
  "leb128fmt",
- "wasmparser 0.261.0",
+ "wasmparser 0.262.0",
 ]
 
 [[package]]
@@ -7881,9 +8075,9 @@ dependencies = [
 
 [[package]]
 name = "wasmparser"
-version = "0.261.0"
+version = "0.262.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f20f20e44f7e8aeb6744823ea9d869ede51e51be4fdaedede2852282e54d2d8"
+checksum = "974d643b125b272607e2fff8012ea14a8328acd7621e4bafa7afb32500052b1b"
 dependencies = [
  "bitflags 2.13.2",
  "indexmap",
@@ -7892,9 +8086,9 @@ dependencies = [
 
 [[package]]
 name = "wast"
-version = "261.0.0"
+version = "262.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "776443145731a4062e5b0d392892a2005909b6ab72d9fdc3cad53dd1a714e44a"
+checksum = "30612a0c29249b5f185888a107e8a519d920226b7d07f9d351fd094e9f75eb23"
 dependencies = [
  "bumpalo",
  "leb128fmt",
@@ -7905,9 +8099,9 @@ dependencies = [
 
 [[package]]
 name = "wat"
-version = "1.261.0"
+version = "1.262.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7b4d1a49ea73a8f3326e74e3a05db667001b16bd1035ed3356fc1a0ed05ca7f"
+checksum = "e228027f2b07bbaf946980ebbe2437fca73be6f54c40c2a8d4f42f277075f8d1"
 dependencies = [
  "wast",
 ]
@@ -8031,7 +8225,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
 dependencies = [
  "proc-macro2",
- "quick-xml",
+ "quick-xml 0.41.0",
  "quote",
 ]
 
@@ -8091,15 +8285,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "1.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
-dependencies = [
- "rustls-pki-types",
-]
-
 [[package]]
 name = "weezl"
 version = "0.1.12"
@@ -8234,7 +8419,7 @@ dependencies = [
  "naga",
  "naga-types",
  "ndk-sys",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-foundation 0.3.2",
@@ -8295,15 +8480,37 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
 
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
 [[package]]
 name = "windows"
 version = "0.62.2"
@@ -8422,7 +8629,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 
 [[package]]
@@ -8431,16 +8638,7 @@ version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
+ "windows-targets",
 ]
 
 [[package]]
@@ -8458,31 +8656,14 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
 [[package]]
@@ -8500,101 +8681,52 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winit"
 version = "0.30.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6755fa58a9f8350bd1e472d4c3fcc25f824ec358933bba33306d0b63df5978d"
+source = "git+https://github.com/storytold/winit.git?rev=a517b3846ee8457d84ee4975110bfda6797c44dc#a517b3846ee8457d84ee4975110bfda6797c44dc"
 dependencies = [
  "ahash",
  "android-activity",
@@ -8672,10 +8804,20 @@ dependencies = [
 ]
 
 [[package]]
-name = "winresource"
-version = "0.1.31"
+name = "winreg"
+version = "0.55.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0986a8b1d586b7d3e4fe3d9ea39fb451ae22869dcea4aa109d287a374d866087"
+checksum = "cb5a765337c50e9ec252c2069be9bf91c7df47afb103b642ba3a53bf8101be97"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "winresource"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2bc6d36480b829272a5bdabf08e6dca8004761c1da7e35efef800540c66221b"
 dependencies = [
  "toml",
  "version_check",
@@ -8804,7 +8946,7 @@ dependencies = [
  "image",
  "libwayshot-xcap",
  "log",
- "objc2 0.6.4",
+ "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-av-foundation",
  "objc2-core-foundation",
@@ -8833,7 +8975,7 @@ checksum = "a6c2ad15e0e922856ee89afe862b8992334bbe7953adad56cd1199358cb30566"
 dependencies = [
  "bitflags 2.13.2",
  "libc",
- "quick-xml",
+ "quick-xml 0.41.0",
 ]
 
 [[package]]
@@ -8881,7 +9023,7 @@ checksum = "ec7a2a501ed189703dba8b08142f057e887dfc4b2cc4db2d343ac6376ba3e0b9"
 
 [[package]]
 name = "xtask"
-version = "0.15.1"
+version = "0.16.0"
 dependencies = [
  "chrono",
  "serde",
@@ -9131,6 +9273,23 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "zip"
+version = "9.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2886b00003a72c4ccee3f42cfc34908d33b2508a74d827dc2a4244706475c704"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "getrandom 0.4.3",
+ "indexmap",
+ "memchr",
+ "nix",
+ "typed-path",
+ "windows-sys 0.61.2",
+ "zopfli",
+]
+
 [[package]]
 name = "zlib-rs"
 version = "0.6.8"
@@ -9143,6 +9302,18 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
+[[package]]
+name = "zopfli"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aaf7fc5d30c28483d93805c4a5e12b05bbb52407fa67c5f8bd552374cd01fb11"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
+
 [[package]]
 name = "zune-core"
 version = "0.4.12"
@@ -9231,3 +9402,18 @@ dependencies = [
  "syn 3.0.6",
  "winnow",
 ]
+
+[[patch.unused]]
+name = "egui_demo_lib"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_inspection"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
+[[patch.unused]]
+name = "egui_system_font_provider"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
diff --git a/Cargo.toml b/Cargo.toml
index 0787db33f8..a3b0ca4b36 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,13 +4,13 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/photocraft", "apps/photocraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.15.1"
+version = "0.16.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
 
 [workspace.dependencies]
-craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675", features = ["serde"] }
+craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "495e5971bc024aa96e6ed318cb6e7cd3a0103184", features = ["serde"] }
 # internal
 photocraft-geom = { path = "crates/geom" }
 photocraft-color = { path = "crates/color" }
@@ -39,8 +39,10 @@ photocraft-tablet = { path = "crates/tablet" }
 photocraft-ipp = { path = "crates/ipp" }
 
 # external
-craft-print = { git = "https://github.com/storytold/craft-libs", rev = "3d37da389a3618ab9b76109da11416e9ca4ea719" }
-craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "82a24b006eefa036b43c09a67fb9a3fbd17ffe63" }
+craft-print = { git = "https://github.com/storytold/craft-libs", rev = "495e5971bc024aa96e6ed318cb6e7cd3a0103184" }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "495e5971bc024aa96e6ed318cb6e7cd3a0103184" }
+craft-jpeg = { git = "https://github.com/storytold/craft-libs", rev = "495e5971bc024aa96e6ed318cb6e7cd3a0103184" }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "495e5971bc024aa96e6ed318cb6e7cd3a0103184", features = ["egui"] }
 thiserror = "2"
 serde = { version = "1", features = ["derive", "rc"] }
 serde_json = "1"
@@ -55,18 +57,20 @@ image = { version = "0.25", default-features = false }
 zune-core = "0.5"
 zune-jpeg = "0.5"
 proptest = "1"
-eframe = { version = "0.36", default-features = false }
+eframe = { version = "0.37", default-features = false }
 # Without `default_fonts`, which embeds egui's fonts uncompressed: ui-egui ships them deflated
 # (egui_fonts.rs; the web build's size gate).
-egui = { version = "0.36", default-features = false }
-egui_kittest = "0.36"
+egui = { version = "0.37", default-features = false }
+egui_kittest = "0.37"
 rfd = "0.17"
 log = "0.4"
 # All date/time conversion goes through chrono (no hand-rolled calendar code beyond the 400-year range extension; AGENTS.md).
 chrono = { version = "0.4.45", default-features = false, features = ["std"] }
 rayon = "1"
-criterion = { version = "0.5", default-features = false }
+criterion = { version = "0.8", default-features = false }
 getrandom = "0.3"
+# Monotonic clock on native and wasm (screenshot deadlines: a wall clock can jump).
+web-time = "1"
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
@@ -175,3 +179,20 @@ opt-level = "z"
 [profile.wasm-release.package.photocraft-paint]
 opt-level = 3
 
+# Keep the complete egui family and native event bridge on reviewed fork commits.
+[patch.crates-io]
+ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+emath = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint_default_fonts = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-winit = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-wgpu = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_glow = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_extras = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_kittest = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_system_font_provider = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+eframe = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_demo_lib = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_inspection = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+winit = { git = "https://github.com/storytold/winit.git", rev = "a517b3846ee8457d84ee4975110bfda6797c44dc" }
diff --git a/NOTICE b/NOTICE
index a7302a940c..6250865673 100644
--- a/NOTICE
+++ b/NOTICE
@@ -22,3 +22,20 @@ Builds made with craft-fonts (CRAFT_FONTS_DIR; all official releases) also embed
 https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md (today BIZ UDPGothic, Shippori Mincho and
 BIZ UDMincho; not the web build), under the SIL Open Font License 1.1. Their licence texts
 ship with the package as OFL-<family>.txt.
+
+The egui-icons font subset is embedded from epaint_default_fonts by crates/ui-egui/build.rs
+and registered in the native and web fallback stacks by crates/ui-egui/src/egui_fonts.rs.
+It is a subset of emoji-icon-font by John Slegers; the same upstream MIT license applies.
+Source: https://github.com/storytold/egui/tree/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts
+Original: https://github.com/jslegers/emoji-icon-font
+The following notice is reproduced verbatim from emoji-icon-font-mit-license.txt:
+
+MIT License
+
+Copyright (c) 2014 John Slegers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/README.md b/README.md
index 74a5c78f36..a22f1aee26 100644
--- a/README.md
+++ b/README.md
@@ -185,8 +185,8 @@ Every screenshot here is the real app at work on public-domain art, rendered off
 <table>
   <tr>
     <td width="33%" valign="top">
-      <h4>🧰 67 tools</h4>
-      Move · Artboard · Rectangular and Elliptical Marquee · Single Row Marquee · Single Column Marquee · Lasso · Polygonal Lasso · Magnetic Lasso · Object Selection · Quick Selection · Magic Wand · Crop · Perspective Crop · Slice · Slice Select · Frame · Eyedropper · Color Sampler · Ruler · Note · Count · Remove · Spot Healing Brush · Healing Brush · Patch · Content-Aware Move · Red Eye · Brush · Pencil · Mixer Brush · Color Replacement · Clone Stamp · Pattern Stamp · History Brush · Eraser · Background Eraser · Magic Eraser · Gradient · Paint Bucket · Blur · Sharpen · Smudge · Dodge · Burn · Sponge · Pen · Freeform Pen · Curvature Pen · Add Anchor Point · Delete Anchor Point · Convert Point · Horizontal and Vertical Type · Horizontal and Vertical Type Mask · Path Selection · Direct Selection · Rectangle · Ellipse · Triangle · Polygon · Line · Custom Shape · Hand · Rotate View · Zoom
+      <h4>🧰 68 tools</h4>
+      Move · Artboard · Rectangular and Elliptical Marquee · Single Row Marquee · Single Column Marquee · Lasso · Polygonal Lasso · Magnetic Lasso · Object Selection · Quick Selection · Magic Wand · Crop · Perspective Crop · Slice · Slice Select · Frame · Eyedropper · Color Sampler · Ruler · Note · Count · Remove · Spot Healing Brush · Healing Brush · Patch · Content-Aware Move · Red Eye · Brush · Pencil · Mixer Brush · Color Replacement · Clone Stamp · Pattern Stamp · History Brush · Art History Brush · Eraser · Background Eraser · Magic Eraser · Gradient · Paint Bucket · Blur · Sharpen · Smudge · Dodge · Burn · Sponge · Pen · Freeform Pen · Curvature Pen · Add Anchor Point · Delete Anchor Point · Convert Point · Horizontal and Vertical Type · Horizontal and Vertical Type Mask · Path Selection · Direct Selection · Rectangle · Ellipse · Triangle · Polygon · Line · Custom Shape · Hand · Rotate View · Zoom
     </td>
     <td width="33%" valign="top">
       <h4>🖌️ A real brush engine</h4>
diff --git a/apps/photocraft-cli/tests/it/orientation.rs b/apps/photocraft-cli/tests/it/orientation.rs
index 101195581f..3895df367a 100644
--- a/apps/photocraft-cli/tests/it/orientation.rs
+++ b/apps/photocraft-cli/tests/it/orientation.rs
@@ -125,7 +125,8 @@ fn orientation_6_jpeg_converts_upright_and_rotates_back() {
     let (a, b) = (d.join("a.pcraft"), d.join("b.pcraft"));
     ok(bin().arg("convert").arg(&jpg).arg(&a));
     ok(bin().arg("convert").arg(&a).arg(&b));
-    // Everything but the file's own path and saved document name must match.
+    // Everything but the file's own path and saved document name (which the first snapshot is
+    // named after) must match.
     let info = |p: &Path| {
         let mut v = serde_json::from_str::<Value>(&ok(bin().arg("info").arg(p))).unwrap();
         v.as_object_mut().unwrap().remove("file");
@@ -136,8 +137,12 @@ fn orientation_6_jpeg_converts_upright_and_rotates_back() {
     assert_eq!((ia["width"].as_u64(), ia["height"].as_u64()), (Some(16), Some(32)));
     assert_eq!(ia["name"], "a.pcraft");
     assert_eq!(ib["name"], "b.pcraft");
-    ia.as_object_mut().unwrap().remove("name");
-    ib.as_object_mut().unwrap().remove("name");
+    assert_eq!(ia["snapshots"][0]["name"], "a.pcraft");
+    assert_eq!(ib["snapshots"][0]["name"], "b.pcraft");
+    for v in [&mut ia, &mut ib] {
+        v.as_object_mut().unwrap().remove("name");
+        v["snapshots"][0].as_object_mut().unwrap().remove("name");
+    }
     assert_eq!(ia, ib);
     let (pa, pb) = (d.join("a.png"), d.join("b.png"));
     ok(bin().arg("convert").arg(&a).arg(&pa));
diff --git a/apps/photocraft-web/Cargo.toml b/apps/photocraft-web/Cargo.toml
index 279d13b453..0176e0fe84 100644
--- a/apps/photocraft-web/Cargo.toml
+++ b/apps/photocraft-web/Cargo.toml
@@ -29,7 +29,7 @@ log = { workspace = true }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 # `wgpu` pulls egui-wgpu's defaults: WebGPU plus the WebGL2 fallback.
-eframe = { workspace = true, features = ["wgpu", "accesskit"] }
+eframe = { workspace = true, features = ["wgpu", "accesskit", "clipboard"] }
 rfd = { workspace = true }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
diff --git a/apps/photocraft-web/src/preset_bridge.rs b/apps/photocraft-web/src/preset_bridge.rs
index a7445bbc14..a39fdfb4b4 100644
--- a/apps/photocraft-web/src/preset_bridge.rs
+++ b/apps/photocraft-web/src/preset_bridge.rs
@@ -9,8 +9,8 @@ use photocraft_engine::{
 };
 
 pub type Batch = BTreeMap<String, Option<Arc<[u8]>>>;
-/// Three sampled images per preset (tip, dual tip, texture), plus group/index/action records.
-pub const MAX_RECORDS: usize = MAX_GROUPS + MAX_PRESETS_PER_GROUP * 3 + 2;
+/// Three sampled images per preset (tip, dual tip, texture), plus group/index/action/pattern records.
+pub const MAX_RECORDS: usize = MAX_GROUPS + MAX_PRESETS_PER_GROUP * 3 + 3;
 
 #[derive(Default)]
 struct State {
@@ -45,6 +45,7 @@ pub fn record_limit(name: &str) -> Result<u64, String> {
     match name {
         INDEX_FILE => Ok(MAX_INDEX_BYTES),
         ACTIONS_FILE => Ok(MAX_ACTIONS_BYTES),
+        PATTERNS_FILE => Ok(MAX_PATTERNS_BYTES),
         _ if name.starts_with("tips/") && leaf.ends_with(".pctip") => Ok(MAX_TIP_BYTES),
         _ if !name.contains('/') && name.ends_with(".pcbrushes") => Ok(MAX_GROUP_BYTES),
         _ => Err("unknown preset record type".into()),
diff --git a/apps/photocraft-web/src/web.rs b/apps/photocraft-web/src/web.rs
index 20e64fa046..f82051dbf9 100644
--- a/apps/photocraft-web/src/web.rs
+++ b/apps/photocraft-web/src/web.rs
@@ -4,7 +4,7 @@ use std::cell::Cell;
 use std::collections::{HashMap, HashSet};
 use std::rc::Rc;
 use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Arc, Mutex};
+use std::sync::{Arc, Mutex, PoisonError};
 
 use photocraft_codecs::{ChannelLayout, EncodeOptions, Image};
 use photocraft_doc::Document;
@@ -80,6 +80,7 @@ pub fn start() {
                 canvas,
                 options,
                 Box::new(move |cc| {
+                    PhotocraftApp::install_type_reset_hooks(&cc.egui_ctx);
                     PhotocraftApp::setup_context(&cc.egui_ctx, ThemeKind::Pro);
                     let inbox: Inbox = Arc::default();
                     let place_inbox: Inbox = Arc::default();
@@ -218,7 +219,7 @@ fn load_font_manifest(served: Served, ctx: egui::Context) {
             files.entry(f.family.clone()).or_default().push((f.file.clone(), f.integrity.clone()));
         }
         log::info!("photocraft-web: {} served font families", files.len());
-        served.lock().unwrap_or_else(|e| e.into_inner()).files = files;
+        served.lock().unwrap_or_else(PoisonError::into_inner).files = files;
         // The families for the font menus, and the script fallbacks (the manifest's `scripts`).
         served_fonts::add_fonts(&fonts);
         // Fetch now the fallbacks of the scripts the browser's languages use (an Arabic reader gets
@@ -295,7 +296,7 @@ impl WebShell {
     fn serve_fonts(&mut self, ctx: &egui::Context) {
         let requested = served_fonts::take_requests();
         let (fetch, arrived) = {
-            let mut s = self.served.lock().unwrap_or_else(|e| e.into_inner());
+            let mut s = self.served.lock().unwrap_or_else(PoisonError::into_inner);
             let mut fetch = Vec::new();
             for family in requested {
                 if let Some(files) = s.files.get(&family).cloned()
@@ -312,7 +313,7 @@ impl WebShell {
             wasm_bindgen_futures::spawn_local(async move {
                 match fetch_bytes(&file, integrity.as_deref()).await {
                     Ok(bytes) => {
-                        served.lock().unwrap_or_else(|e| e.into_inner()).arrived.push((family, bytes));
+                        served.lock().unwrap_or_else(PoisonError::into_inner).arrived.push((family, bytes));
                         ctx.request_repaint();
                     }
                     Err(e) => log::error!("couldn't fetch served font {file}: {e}"),
@@ -328,6 +329,10 @@ impl eframe::App for WebShell {
         // A tap reaches eframe as Pointer Events and Touch Events: keep one press per tap, or the
         // twin press closes the menu the first one opened (#2095).
         photocraft_ui_egui::touch_twins::drop_twins(ctx, raw_input);
+        // The browser build has no TCP control server, so `inject_synthetic` finds an empty
+        // queue, but the clipboard key mapping (`Event::PasteImage`), legacy pinch, pen-hold and
+        // titlebar normalization live in the app hook and must run here too.
+        eframe::App::raw_input_hook(&mut self.app, ctx, raw_input);
     }
 
     fn logic(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
@@ -347,7 +352,7 @@ impl eframe::App for WebShell {
                     match f.bytes_async().await {
                         Ok(bytes) => {
                             let queue = if place { &place_inbox } else { &inbox };
-                            queue.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes));
+                            queue.lock().unwrap_or_else(PoisonError::into_inner).push((name, bytes));
                             ctx.request_repaint();
                         }
                         Err(e) => log::error!("couldn't read dropped file {name}: {e}"),
@@ -356,8 +361,9 @@ impl eframe::App for WebShell {
             });
         }
         self.serve_fonts(ctx);
-        self.app.logic(ctx, frame);
+        self.app.logic_frame(ctx, frame);
         self.save_presets(ctx);
+        self.app.finish_type_reset_logic(ctx);
     }
 
     fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
@@ -384,8 +390,9 @@ impl eframe::App for WebShell {
                 });
             });
         }
-        self.app.ui(ui, frame);
+        self.app.ui_frame(ui, frame);
         self.save_presets(ui.ctx());
+        self.app.finish_type_reset_pass(ui.ctx());
     }
 }
 
diff --git a/apps/photocraft/Cargo.toml b/apps/photocraft/Cargo.toml
index d8e7568300..5de916c250 100644
--- a/apps/photocraft/Cargo.toml
+++ b/apps/photocraft/Cargo.toml
@@ -29,8 +29,9 @@ photocraft-automation = { workspace = true }
 photocraft-ui-egui = { workspace = true }
 # Pen tablet pressure/tilt on macOS and X11 (the workspace's one isolated unsafe helper crate).
 photocraft-tablet = { workspace = true }
-eframe = { workspace = true, features = ["wgpu", "accesskit", "wayland", "x11", "persistence"] }
+eframe = { workspace = true, features = ["wgpu", "accesskit", "wayland", "x11", "persistence", "clipboard"] }
 egui = { workspace = true }
+serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 chrono = { workspace = true }
@@ -38,13 +39,13 @@ clap = { workspace = true }
 thiserror = { workspace = true }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+craft-update = { workspace = true }
 rfd = { workspace = true }
-arboard = { version = "3.6", features = ["wayland-data-control"] }
+arboard = { version = "3.7", features = ["wayland-data-control"] }
 open = "5"
 # Reads the saved window layout (eframe persistence) to drop values that would abort startup.
 ron = "0.12"
 # Background release checks; HTTPS with Rust TLS, no async runtime.
-ureq = { version = "3.4", default-features = false, features = ["rustls", "platform-verifier"] }
 
 [target.'cfg(target_os = "macos")'.dependencies]
 # Safe CoreGraphics bindings, compatible with the existing macOS 11 deployment target.
@@ -58,12 +59,12 @@ fmv-macos-events = "=0.1.0"
 # pointer is when files are dropped (cursor.rs; winit 0.30 drops carry no position), and play the
 # system alert sound for Beep When Done (services.rs, NSBeep). Already in
 # Cargo.lock (winit, photocraft-tablet); pinned exactly to the same versions.
-objc2 = "=0.6.4"
+objc2 = "=0.6.5"
 objc2-foundation = { version = "=0.3.2", default-features = false, features = ["std", "NSArray", "NSEnumerator", "NSGeometry"] }
 objc2-app-kit = { version = "=0.3.2", default-features = false, features = ["std", "NSApplication", "NSApplicationScripting", "NSEvent", "NSGraphics", "NSResponder", "NSView", "NSWindow"] }
 # The macOS menu bar (mac_menu.rs): a standalone native menu crate (from the tauri-apps org, but
 # not Tauri: no webview, no JS), AppKit menus behind a safe API (no GTK with default features off). Pinned exactly: review the diff before bumping.
-muda = { version = "=0.21.1", default-features = false }
+muda = { version = "=0.21.2", default-features = false }
 # Quit with `terminate:` from the main queue, outside winit's event handler (mac_window.rs).
 # Already in Cargo.lock (winit, objc2-app-kit); pinned exactly to the same version.
 dispatch2 = { version = "=0.3.1", default-features = false, features = ["std"] }
diff --git a/apps/photocraft/src/main.rs b/apps/photocraft/src/main.rs
index 7fbf765129..a4fe847cda 100644
--- a/apps/photocraft/src/main.rs
+++ b/apps/photocraft/src/main.rs
@@ -92,6 +92,53 @@ fn custom_titlebar(prefs_file: Option<&std::path::Path>) -> bool {
     CUSTOM_TITLEBAR && !prefs.interface.system_title_bar
 }
 
+/// Preferences › Integrations, read before the window opens the way [`custom_titlebar`] is:
+/// whether agents may drive this launch at all, and the port to listen on when no `--control`
+/// was given (0 = only with `--control`). A missing or unreadable file keeps the defaults.
+///
+/// The section is read on its own, and when it doesn't read as a whole each value on its own,
+/// as the app's lenient load reads them (#6611): a wrong-typed value elsewhere in the file, or
+/// in the other field, must not turn Allow Agent Control back on while the dialog shows it off.
+fn integrations(prefs_file: Option<&std::path::Path>) -> photocraft_engine::prefs::Integrations {
+    use serde_json::Value;
+    let mut out = photocraft_engine::prefs::Preferences::default().integrations;
+    let file: Option<Value> = prefs_file.and_then(|p| std::fs::read_to_string(p).ok()).and_then(|t| serde_json::from_str(&t).ok());
+    let Some(section) = file.as_ref().and_then(|v| v.get("integrations")) else {
+        return out;
+    };
+    if let Ok(whole) = serde_json::from_value(section.clone()) {
+        return whole;
+    }
+    if let Some(allow) = section.get("allowAgentControl").and_then(Value::as_bool) {
+        out.allow_agent_control = allow;
+    }
+    if let Some(port) = section.get("controlPort").and_then(Value::as_u64).and_then(|p| u32::try_from(p).ok()) {
+        out.control_port = port;
+    }
+    out
+}
+
+/// The control port this launch listens on, and the warning to print when a request was refused.
+/// `--control` (or `PHOTOCRAFT_CONTROL_PORT`) wins over the preference; Allow Agent Control off
+/// refuses both, and says so rather than ignoring the flag silently. A preferred port outside
+/// 1..=65535 is refused the same way.
+fn control_port_for(cli: Option<u16>, prefs: &photocraft_engine::prefs::Integrations) -> (Option<u16>, Option<String>) {
+    if !prefs.allow_agent_control {
+        let warning = cli.map(|p| format!("photocraft: Preferences › Integrations › Allow Agent Control is off: not listening on port {p}\n"));
+        return (None, warning);
+    }
+    if let Some(port) = cli {
+        return (Some(port), None);
+    }
+    match prefs.control_port {
+        0 => (None, None),
+        p => match u16::try_from(p).ok().filter(|p| *p != 0) {
+            Some(port) => (Some(port), None),
+            None => (None, Some(format!("photocraft: Preferences › Integrations › Control Port {p} is not a usable port: not listening\n"))),
+        },
+    }
+}
+
 /// The main window: 1440 × 900 (shrunk to fit the monitor, and maximized on the first frame
 /// when it still doesn't fit, `work_area::fit_window`), centred on the main monitor. Without
 /// `centered`, Windows cascades each new window from the top-left corner, so it opened at a
@@ -111,6 +158,9 @@ fn native_options(custom_titlebar: bool) -> eframe::NativeOptions {
             .with_titlebar_shown(false)
             .with_title_shown(false),
         centered: true,
+        // PhotoCraft owns its fallback fonts (`cjk_fonts`, craft-fonts): eframe's system-font
+        // provider would compete with it and make glyph choice machine-dependent (#8512).
+        system_font_fallback: false,
         // eframe saves native window geometry and egui panel/window sizes on exit.
         // Keep that state beside preferences, including config overrides and portable mode.
         persistence_path: services::config_dir().map(|dir| dir.join("ui.ron")),
@@ -147,6 +197,15 @@ fn main() -> eframe::Result {
     // First, so the panic hook and every start-up warning are recorded (`logging`).
     let logger = logging::install();
     crash_guard::install_hook();
+    #[cfg(not(target_arch = "wasm32"))]
+    if let Some(done) = craft_update::self_update::finish(&craft_update::suite::PHOTOCRAFT, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
+        if let Err(e) = done {
+            eprintln!("PhotoCraft update helper failed: {e}");
+            std::process::exit(1);
+        }
+        return Ok(());
+    }
+
     // The system font scan can take seconds (minutes on some Macs): run it off the UI thread.
     photocraft_ui_egui::type_tool::warm_fonts();
     // `--help` and `--version` print to standard output and exit 0. A usage error (an unknown
@@ -262,6 +321,10 @@ fn main() -> eframe::Result {
         std::process::exit(1);
     }
 
+    let (control_port, control_pref_warning) = control_port_for(control_port, &integrations(services::prefs_file().as_deref()));
+    if let Some(warning) = &control_pref_warning {
+        eprint!("{warning}");
+    }
     let control = if let Some(port) = control_port {
         let (supplied, token_file) = (auth.control_token, auth.control_token_file);
         let token = match photocraft_automation::security::server_token(supplied.as_deref(), token_file.as_deref()) {
@@ -411,6 +474,7 @@ fn main() -> eframe::Result {
             };
             #[cfg(not(target_os = "linux"))]
             let session = Session::new();
+            PhotocraftApp::install_type_reset_hooks(&cc.egui_ctx);
             let mut app = PhotocraftApp::new(session, services);
             app.min_frame_ms = uncapped.then_some(1000.0 / 240.0);
             app.integrated_titlebar = cfg!(target_os = "macos");
@@ -668,10 +732,101 @@ mod tests {
             egui::Panel::right("dock").default_size(290.0).show(ui, |ui| ui.set_min_width(ui.available_width()));
         });
         output.textures_delta.clear();
-        let panel = egui::containers::panel::PanelState::load(&restored, egui::Id::new("dock")).unwrap();
+        let panel = egui::containers::panel::PanelState::load(&restored, photocraft_ui_egui::panels::panel_state_id(&restored, "dock")).unwrap();
         assert_eq!(panel.size().x, 410.0);
     }
 
+    /// A 0.36 `ui.ron` saved panel widths under `Id::new("dock")`; the first 0.37 launch copies
+    /// them to the parent-scoped key, leaves the old one for a rollback, and a later resize
+    /// survives two more restarts.
+    #[test]
+    fn saved_036_panel_widths_migrate_and_survive_two_restarts() {
+        #[derive(Default)]
+        struct Storage(std::collections::BTreeMap<String, String>);
+        impl eframe::Storage for Storage {
+            fn get_string(&self, key: &str) -> Option<String> {
+                self.0.get(key).cloned()
+            }
+            fn set_string(&mut self, key: &str, value: String) {
+                self.0.insert(key.into(), value);
+            }
+            fn remove_string(&mut self, key: &str) {
+                self.0.remove(key);
+            }
+            fn flush(&mut self) {}
+        }
+        let state = |width: f32| egui::containers::panel::PanelState { outer_rect: egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(width, 600.0)) };
+        let input = || egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1200.0, 800.0))), ..Default::default() };
+        let draw = |ctx: &egui::Context| {
+            let mut output = ctx.run_ui(input(), |ui| {
+                egui::Panel::right("dock").default_size(290.0).show(ui, |ui| ui.set_min_width(ui.available_width()));
+            });
+            output.textures_delta.clear();
+        };
+        let save = |ctx: &egui::Context| {
+            let mut storage = Storage::default();
+            ctx.memory(|memory| eframe::set_value(&mut storage, "egui", memory));
+            storage
+        };
+        let restore = |storage: &Storage| {
+            let ctx = egui::Context::default();
+            ctx.memory_mut(|memory| *memory = eframe::get_value(storage, "egui").expect("the saved memory"));
+            ctx
+        };
+
+        // The real 0.14/0.15 shape: the panel state under the old key inside the egui memory.
+        let ctx = egui::Context::default();
+        ctx.data_mut(|d| d.insert_persisted(egui::Id::unique("dock"), state(410.0)));
+        let storage = save(&ctx);
+
+        let first = restore(&storage);
+        photocraft_ui_egui::panels::migrate_panel_state(&first);
+        draw(&first);
+        let key = photocraft_ui_egui::panels::panel_state_id(&first, "dock");
+        assert_eq!(egui::containers::panel::PanelState::load(&first, key).map(|p| p.size().x), Some(410.0));
+        assert!(egui::containers::panel::PanelState::load(&first, egui::Id::unique("dock")).is_some(), "the 0.36 key is kept");
+        // Resize in 0.37: the new key wins from now on.
+        first.data_mut(|d| d.insert_persisted(key, state(500.0)));
+        let storage = save(&first);
+
+        for restart in 0..2 {
+            let next = restore(&storage);
+            photocraft_ui_egui::panels::migrate_panel_state(&next);
+            draw(&next);
+            let key = photocraft_ui_egui::panels::panel_state_id(&next, "dock");
+            let width = egui::containers::panel::PanelState::load(&next, key).map(|p| p.size().x).unwrap_or_default();
+            assert!((width - 500.0).abs() < 0.5, "restart {restart}: the old 410 key must not win (got {width})");
+        }
+    }
+
+    /// Schema-probe `ui.ron` shapes *reconstructed* from the documented 0.14/0.15/0.37 layouts,
+    /// not recorded machine saves: 0.14 and 0.15 both store the flat window entry, which the
+    /// first 0.37 launch rewrites; a 0.37 file is left alone. Keeping all three probes makes a
+    /// future change to any migration rule fail here first. They do not prove eframe's real
+    /// `Memory`/`PanelState` deserialization.
+    #[test]
+    fn the_ui_ron_schema_probe_fixtures_migrate() {
+        for (name, fixture) in [("0.14", include_str!("../tests/fixtures/ui-0.14.ron")), ("0.15", include_str!("../tests/fixtures/ui-0.15.ron"))] {
+            let text = super::ui_state::migrate_for_test(fixture).unwrap_or_else(|e| panic!("{name}: {e}")).unwrap_or_else(|| panic!("{name}: not rewritten"));
+            assert!(text.contains("normal_geometry"), "{name}: the flat window entry is gone: {text}");
+            assert!(!super::ui_state::saved_position_for_test(fixture), "{name}: a flat entry is not what 0.37 restores");
+        }
+        let old = include_str!("../tests/fixtures/ui-0.14.ron");
+        assert!(super::ui_state::migrate_for_test(old).expect("migratable").expect("rewritten").contains("x:1100.0"), "the 0.14 size is preserved");
+        let current = include_str!("../tests/fixtures/ui-0.15.ron");
+        assert!(
+            super::ui_state::migrate_for_test(current).expect("migratable").expect("rewritten").contains("maximized:true"),
+            "0.15 maximized state survives"
+        );
+        // Already 0.37-shaped: no rewrite, and (with no saved position) the window centres.
+        let current = include_str!("../tests/fixtures/ui-0.37.ron");
+        assert_eq!(super::ui_state::migrate_for_test(current), Ok(None));
+        assert!(!super::ui_state::saved_position_for_test(current));
+        // And a 0.37 file with a restorable outer position is a saved position.
+        let with_position = current.replace("outer_position_pixels:None", "outer_position_pixels:Some((x:2048.0,y:1228.0))");
+        assert!(super::ui_state::saved_position_for_test(&with_position));
+    }
+
     #[test]
     fn the_window_opens_centred_at_its_default_size() {
         let o = super::native_options(super::CUSTOM_TITLEBAR);
@@ -740,6 +895,91 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    #[test]
+    fn integrations_preferences_decide_the_control_port() {
+        use photocraft_engine::prefs::Integrations;
+        let off = Integrations { allow_agent_control: false, control_port: 0 };
+        let on = Integrations { allow_agent_control: true, control_port: 0 };
+        let preferred = Integrations { allow_agent_control: true, control_port: 7878 };
+
+        // Nothing asked for, nothing listening.
+        assert_eq!(super::control_port_for(None, &on), (None, None));
+        // --control wins over the preference.
+        assert_eq!(super::control_port_for(Some(9000), &preferred), (Some(9000), None));
+        // The preference opens the port when --control is absent.
+        assert_eq!(super::control_port_for(None, &preferred), (Some(7878), None));
+
+        // Allow Agent Control off refuses both, and says so when --control asked for one
+        // rather than ignoring the flag.
+        assert_eq!(super::control_port_for(None, &off), (None, None));
+        let (port, warning) = super::control_port_for(Some(9000), &off);
+        assert_eq!(port, None);
+        assert!(warning.is_some_and(|w| w.contains("Allow Agent Control") && w.contains("9000")), "the refusal names the port");
+        let off_with_port = Integrations { allow_agent_control: false, control_port: 7878 };
+        assert_eq!(super::control_port_for(None, &off_with_port), (None, None), "off beats a preferred port");
+
+        // A port a hand-edited file could hold, outside 1..=65535, is refused and named.
+        let huge = Integrations { allow_agent_control: true, control_port: 70_000 };
+        let (port, warning) = super::control_port_for(None, &huge);
+        assert_eq!(port, None);
+        assert!(warning.is_some_and(|w| w.contains("70000")), "the refusal names the value");
+    }
+
+    #[test]
+    fn integrations_fall_back_to_the_defaults_without_a_readable_file() {
+        let dir = std::env::temp_dir().join(format!("pc-integrations-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let file = dir.join("prefs.json");
+        let default = photocraft_engine::prefs::Integrations::default();
+
+        assert_eq!(super::integrations(None), default, "no preferences file");
+        std::fs::write(&file, "not json").unwrap();
+        assert_eq!(super::integrations(Some(&file)), default, "an unreadable file");
+        std::fs::write(&file, r#"{"integrations":{"allowAgentControl":false,"controlPort":7878}}"#).unwrap();
+        let read = super::integrations(Some(&file));
+        assert!(!read.allow_agent_control);
+        assert_eq!(read.control_port, 7878);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// The app loads preferences leniently (#6611): one wrong-typed value resets only itself. So
+    /// a bad value elsewhere, or in the port, must not turn Allow Agent Control back on.
+    #[test]
+    fn a_bad_value_elsewhere_keeps_agent_control_off() {
+        let dir = std::env::temp_dir().join(format!("pc-integrations-lenient-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let file = dir.join("prefs.json");
+        // What the Preferences dialog shows for the same file.
+        let shown = |text: &str| {
+            let mut session = photocraft_engine::Session::new();
+            session.load_prefs_json(text).unwrap();
+            session.prefs().integrations.clone()
+        };
+        let read = |text: &str| {
+            std::fs::write(&file, text).unwrap();
+            let read = super::integrations(Some(&file));
+            assert_eq!(read, shown(text), "{text}");
+            read
+        };
+
+        let r = read(r#"{"interface":{"enableAnimations":"nope"},"integrations":{"allowAgentControl":false,"controlPort":7878}}"#);
+        assert!(!r.allow_agent_control, "a bad value in another section");
+        assert_eq!(r.control_port, 7878);
+        let r = read(r#"{"integrations":{"allowAgentControl":false,"controlPort":"x"}}"#);
+        assert!(!r.allow_agent_control, "a bad port");
+        assert_eq!(r.control_port, 0, "the bad port alone takes its default");
+        // A bad Allow Agent Control alone takes its default.
+        let r = read(r#"{"integrations":{"allowAgentControl":"no","controlPort":7878}}"#);
+        assert_eq!(r, photocraft_engine::prefs::Integrations { allow_agent_control: true, control_port: 7878 });
+        read(r#"{"integrations":{"allowAgentControl":false,"controlPort":-1}}"#);
+        read(r#"{"integrations":{"allowAgentControl":false,"controlPort":4294967296}}"#);
+        read(r#"{"integrations":"off"}"#);
+        // serde reads a struct from a list too; the app does.
+        assert!(!read(r#"{"integrations":[false]}"#).allow_agent_control, "a list");
+        assert_eq!(read(r#"{"integrations":[false,7878]}"#).control_port, 7878);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     /// X11 startup notification and docks match a window to its launcher by `StartupWMClass`,
     /// so it has to be the class the window carries: the app id, on Wayland and X11 alike.
     #[test]
diff --git a/apps/photocraft/src/services.rs b/apps/photocraft/src/services.rs
index 51cf217faf..2966eee8ed 100644
--- a/apps/photocraft/src/services.rs
+++ b/apps/photocraft/src/services.rs
@@ -105,6 +105,7 @@ const SAVE_FILTERS: &[(&str, &[&str])] = &[
     // Game and 3D textures; DDS Options asks for the compression and mipmaps (#1327).
     ("DDS", &["dds"]),
     ("Cineon", &["cin"]),
+    ("Amiga IFF", &["iff"]),
 ];
 
 /// Non-document files the shell saves (Swatches panel exports): offered alone, so the dialog
diff --git a/apps/photocraft/src/ui_state.rs b/apps/photocraft/src/ui_state.rs
index c4de67a994..b356fb26c2 100644
--- a/apps/photocraft/src/ui_state.rs
+++ b/apps/photocraft/src/ui_state.rs
@@ -6,16 +6,32 @@
 //! hand-edited file would then crash every launch. [`sanitize`] runs first and removes a file
 //! holding such values (the window and panels open at their defaults; nothing else is lost).
 //! A file that isn't RON at all is left alone: eframe already ignores it.
+//!
+//! egui 0.37 also replaced the flat `WindowSettings` (`inner_position_pixels`,
+//! `inner_size_points: Option<Vec2>`, …) with `normal_geometry: { outer_position_pixels,
+//! scale_factor, inner_size_points }`. eframe reads the file before any application code, so an
+//! old value cannot be interpreted lazily: [`sanitize`] rewrites it before eframe loads it and
+//! keeps a one-time `ui.ron.pre-0.37` backup. The old panel keys in the egui memory part are
+//! untouched (`panels::panel_state_id` migrates them additively), but this window rewrite is
+//! one-way: after it, a 0.36 build ignores the window entry and opens at its default geometry.
+//! Restoring the backup is the documented rollback.
 
-use std::path::Path;
+use std::{collections::HashMap, path::Path};
 
 /// Window positions, sizes and panel rects beyond this many points or pixels are corrupt.
 const MAX_COORD: f64 = 1.0e6;
 /// egui's zoom factor is the UI scale over the display scale (75% on a 2× display is 0.375,
 /// 300% on a 1× display is 3).
 const ZOOM: std::ops::RangeInclusive<f64> = 0.1..=10.0;
+/// The size [`crate::native_options`] opens a window with when an old save has no usable size.
+const DEFAULT_SIZE: f32 = 1440.0;
+const DEFAULT_HEIGHT: f32 = 900.0;
+/// Kept beside `ui.ron` before the one-way 0.36 → 0.37 window rewrite.
+const BACKUP_SUFFIX: &str = "pre-0.37";
 
-/// Remove `path` if it holds state that would crash startup. Never fails: errors are logged.
+/// Remove `path` if it holds state that would crash startup, and migrate an old window entry to
+/// the 0.37 schema before eframe reads it. Never fails: errors are logged and leave the file
+/// alone (eframe then ignores what it cannot read).
 pub fn sanitize(path: Option<&Path>) {
     let Some(path) = path else { return };
     let Ok(text) = std::fs::read_to_string(path) else { return };
@@ -24,30 +40,72 @@ pub fn sanitize(path: Option<&Path>) {
         if let Err(e) = std::fs::remove_file(path) {
             log::warn!("could not remove {}: {e}", path.display());
         }
+        return;
+    }
+    match migrate_window(text) {
+        Ok(Some(text)) => write_migrated(path, &text),
+        Ok(None) => {}
+        Err(why) => log::warn!("not rewriting the saved window geometry in {}: {why}", path.display()),
     }
 }
 
-/// Whether `path` holds a window position from an earlier session, which eframe restores. Then
-/// `NativeOptions::centered` must be off: eframe applies it after restoring the saved geometry,
+/// Write the migrated file, keeping a one-time backup. A failed backup aborts the rewrite: the
+/// pre-0.37 window geometry is the documented rollback, so never destroy the only copy.
+fn write_migrated(path: &Path, text: &str) {
+    let backup = backup_path(path);
+    if !backup.exists()
+        && let Err(e) = std::fs::copy(path, &backup)
+    {
+        log::warn!("could not back up {} to {}: {e}; leaving it unchanged", path.display(), backup.display());
+        return;
+    }
+    if let Err(e) = std::fs::write(path, text) {
+        log::warn!("could not write the migrated window layout to {}: {e}", path.display());
+    }
+}
+
+fn backup_path(path: &Path) -> std::path::PathBuf {
+    let mut name = path.file_name().map(std::ffi::OsStr::to_os_string).unwrap_or_else(|| "ui.ron".into());
+    name.push(format!(".{BACKUP_SUFFIX}"));
+    path.with_file_name(name)
+}
+
+/// Whether `path` holds a window position that eframe restores, which means
+/// `NativeOptions::centered` must be off: eframe applies `centered` after the restored geometry,
 /// so it moved the window back to the centre of the main monitor on every launch (#4826).
+///
+/// Only the 0.37 `normal_geometry.outer_position_pixels` counts: `egui_winit::WindowGeometry`
+/// sets it and `initialize_viewport_builder` applies it. A 0.36 flat entry is not restored by
+/// 0.37 (`sanitize` rewrites it first), and its macOS `inner_position_pixels` was never an outer
+/// position.
 pub fn has_saved_position(path: Option<&Path>) -> bool {
     let Some(text) = path.and_then(|p| std::fs::read_to_string(p).ok()) else { return false };
     saved_position(&text)
 }
 
 fn saved_position(text: &str) -> bool {
-    let Ok(kv) = ron::from_str::<std::collections::HashMap<String, String>>(text) else { return false };
+    let Ok(kv) = ron::from_str::<HashMap<String, String>>(text) else { return false };
     let Some(window) = kv.get("window").and_then(|w| ron::from_str::<ron::Value>(w).ok()) else { return false };
-    // eframe restores the inner position on macOS and the outer position elsewhere
-    // (`egui_winit::WindowSettings::initialize_viewport_builder`).
-    let key = if cfg!(target_os = "macos") { "inner_position_pixels" } else { "outer_position_pixels" };
-    matches!(field(&window, key), Some(ron::Value::Option(Some(_))))
+    let Some(geometry) = field(&window, "normal_geometry") else { return false };
+    matches!(field(geometry, "outer_position_pixels"), Some(ron::Value::Option(Some(_))))
+}
+
+/// The 0.36 → 0.37 rewrite of one `ui.ron` text, for the recorded 0.14/0.15 fixtures.
+#[cfg(test)]
+pub(crate) fn migrate_for_test(text: &str) -> Result<Option<String>, String> {
+    migrate_window(text.to_owned())
+}
+
+/// [`saved_position`] for the recorded fixtures.
+#[cfg(test)]
+pub(crate) fn saved_position_for_test(text: &str) -> bool {
+    saved_position(text)
 }
 
 /// `Err` names the first value that would crash startup.
 fn check(text: &str) -> Result<(), String> {
     // eframe stores a map of key → RON string; a file that doesn't parse is ignored by eframe.
-    let Ok(kv) = ron::from_str::<std::collections::HashMap<String, String>>(text) else { return Ok(()) };
+    let Ok(kv) = ron::from_str::<HashMap<String, String>>(text) else { return Ok(()) };
     for (key, value) in &kv {
         // eframe also skips an entry that doesn't parse.
         let Ok(v) = ron::from_str::<ron::Value>(value) else { continue };
@@ -60,6 +118,108 @@ fn check(text: &str) -> Result<(), String> {
     Ok(())
 }
 
+/// `Some(new_text)` when `text` is an old-schema file that should be rewritten; `None` when it
+/// is already 0.37-shaped or holds no window entry; `Err` when the old window entry is unusable
+/// and must be left untouched.
+fn migrate_window(text: String) -> Result<Option<String>, String> {
+    let Ok(mut kv) = ron::from_str::<HashMap<String, String>>(&text) else { return Ok(None) };
+    let Some(value) = kv.get("window").cloned() else { return Ok(None) };
+    let Ok(window) = ron::from_str::<ron::Value>(&value) else { return Ok(None) };
+    if field(&window, "normal_geometry").is_some() {
+        return Ok(None);
+    }
+    if field(&window, "inner_size_points").is_none() && field(&window, "inner_position_pixels").is_none() && field(&window, "outer_position_pixels").is_none() {
+        return Ok(None);
+    }
+    let migrated = migrate_window_value(&window)?;
+    kv.insert("window".into(), migrated);
+    ron::to_string(&kv).map(Some).map_err(|e| format!("cannot write the new window entry: {e}"))
+}
+
+/// The RON payload eframe 0.37 deserializes as `egui_winit::WindowSettings`.
+///
+/// The field order and names mirror `WindowGeometry`; the types are local because
+/// `egui_winit::WindowGeometry` keeps its fields private.
+#[derive(serde::Serialize, serde::Deserialize, Debug, Clone, Copy, PartialEq)]
+struct PointV37 {
+    x: f32,
+    y: f32,
+}
+
+impl PointV37 {
+    fn sane(self) -> Option<Self> {
+        let ok = |v: f32| v.is_finite() && (v.abs() as f64) <= MAX_COORD;
+        (ok(self.x) && ok(self.y)).then_some(self)
+    }
+}
+
+#[derive(serde::Serialize, serde::Deserialize, Debug, Clone, Copy, PartialEq)]
+struct GeometryV37 {
+    outer_position_pixels: Option<PointV37>,
+    scale_factor: f32,
+    inner_size_points: PointV37,
+}
+
+#[derive(serde::Serialize, serde::Deserialize, Debug, Clone, Copy, PartialEq)]
+struct WindowV37 {
+    normal_geometry: GeometryV37,
+    fullscreen: bool,
+    maximized: bool,
+}
+
+fn migrate_window_value(window: &ron::Value) -> Result<String, String> {
+    let size = old_size(window)?;
+    // The old macOS entry stored an inner (not outer) position in logical points and Linux saved
+    // no scale factor, so a faithful restore is only possible for the Windows physical outer
+    // position. Everywhere else the window opens centred with its saved size.
+    let position = if cfg!(target_os = "windows") { old_position(window, "outer_position_pixels") } else { None };
+    let window = WindowV37 {
+        normal_geometry: GeometryV37 {
+            outer_position_pixels: position,
+            // Physical pixels of the old Windows position: 0.37 divides by zoom × scale.
+            scale_factor: 1.0,
+            inner_size_points: size,
+        },
+        fullscreen: old_bool(window, "fullscreen"),
+        maximized: old_bool(window, "maximized"),
+    };
+    ron::to_string(&window).map_err(|e| format!("cannot serialize the new window entry: {e}"))
+}
+
+fn old_size(window: &ron::Value) -> Result<PointV37, String> {
+    let value = field(window, "inner_size_points");
+    let Some(ron::Value::Option(Some(size))) = value else {
+        // A missing size is the app's own opening size, not corrupt data.
+        return Ok(PointV37 { x: DEFAULT_SIZE, y: DEFAULT_HEIGHT });
+    };
+    let point = point_value(size).ok_or_else(|| "inner_size_points is not a finite (x, y) point".to_string())?;
+    let point = point.sane().ok_or_else(|| "inner_size_points is not finite or is absurdly large".to_string())?;
+    if point.x < 1.0 || point.y < 1.0 {
+        return Err("inner_size_points has a zero or negative side".into());
+    }
+    Ok(point)
+}
+
+/// One dimension of an old `Option<Pos2>` field, rejecting corrupt values rather than guessing.
+fn old_position(window: &ron::Value, key: &str) -> Option<PointV37> {
+    match field(window, key) {
+        Some(ron::Value::Option(Some(p))) => point_value(p).and_then(PointV37::sane),
+        // `None`, missing, and malformed all mean "no position"; corrupt positions elsewhere are
+        // caught by `check`, which removes a file with non-finite values before this runs.
+        _ => None,
+    }
+}
+
+fn old_bool(window: &ron::Value, key: &str) -> bool {
+    matches!(field(window, key), Some(ron::Value::Bool(true)))
+}
+
+fn point_value(v: &ron::Value) -> Option<PointV37> {
+    let x = field(v, "x").and_then(as_f32)?;
+    let y = field(v, "y").and_then(as_f32)?;
+    Some(PointV37 { x, y })
+}
+
 /// Every float finite and within [`MAX_COORD`]; depth-limited (the file is untrusted).
 fn floats_sane(v: &ron::Value, depth: usize) -> Result<(), String> {
     if depth > 64 {
@@ -86,6 +246,13 @@ fn as_f64(v: &ron::Value) -> Option<f64> {
     }
 }
 
+fn as_f32(v: &ron::Value) -> Option<f32> {
+    as_f64(v).and_then(|f| {
+        let f = f as f32;
+        f.is_finite().then_some(f)
+    })
+}
+
 fn field<'a>(v: &'a ron::Value, name: &str) -> Option<&'a ron::Value> {
     match v {
         ron::Value::Map(m) => m.get(&ron::Value::String(name.into())),
@@ -95,7 +262,8 @@ fn field<'a>(v: &'a ron::Value, name: &str) -> Option<&'a ron::Value> {
 
 #[cfg(test)]
 mod tests {
-    use super::{check, saved_position};
+    use super::{DEFAULT_HEIGHT, DEFAULT_SIZE, WindowV37, backup_path, check, migrate_window, saved_position};
+    use std::{collections::HashMap, path::PathBuf};
 
     fn file(window: &str, zoom: &str) -> String {
         let egui = format!("(options:(zoom_factor:{zoom},max_passes:2),data:([(18446744073709551615,(ron:\"(x:1.0)\"))]))");
@@ -103,6 +271,17 @@ mod tests {
     }
 
     const WINDOW: &str = "(inner_position_pixels:Some((x:616.0,y:430.0)),fullscreen:false,inner_size_points:Some((x:1100.0,y:760.0)))";
+    const WINDOW_WITH_OUTER: &str = "(inner_position_pixels:Some((x:2048.0,y:1265.0)),outer_position_pixels:Some((x:2048.0,y:1228.0)),fullscreen:false,maximized:false,inner_size_points:Some((x:880.0,y:480.0)))";
+
+    /// Read the window payload back as eframe 0.37 would.
+    fn window_of(text: &str) -> WindowV37 {
+        let kv: HashMap<String, String> = ron::from_str(text).expect("the migrated file is a RON map");
+        ron::from_str(kv.get("window").expect("a window entry")).expect("0.37 WindowSettings shape")
+    }
+
+    fn migrated(window: &str) -> String {
+        migrate_window(file(window, "1.0")).expect("migratable").expect("rewritten")
+    }
 
     #[test]
     fn a_saved_layout_is_kept() {
@@ -122,13 +301,83 @@ mod tests {
         }
     }
 
+    #[test]
+    fn an_old_size_and_maximized_state_survive() {
+        let text = migrated(WINDOW_WITH_OUTER);
+        let window = window_of(&text);
+        assert_eq!(window.normal_geometry.inner_size_points.x, 880.0);
+        assert_eq!(window.normal_geometry.inner_size_points.y, 480.0);
+        assert!(!window.fullscreen);
+        assert!(!window.maximized);
+        let maximized = migrated(&WINDOW.replace("fullscreen:false", "fullscreen:true,maximized:true"));
+        assert!(window_of(&maximized).fullscreen && window_of(&maximized).maximized);
+    }
+
+    #[test]
+    fn a_missing_size_uses_the_default_opening_size() {
+        // A window entry with a position but no size migrates and keeps the app's opening size.
+        let window = window_of(&migrated("(inner_position_pixels:Some((x:616.0,y:430.0)),fullscreen:false,maximized:false)"));
+        assert_eq!(window.normal_geometry.inner_size_points.x, DEFAULT_SIZE);
+        assert_eq!(window.normal_geometry.inner_size_points.y, DEFAULT_HEIGHT);
+        // A window entry with no geometry fields at all is left alone: it is not a 0.36 window.
+        assert_eq!(migrate_window(file("(fullscreen:false,maximized:false)", "1.0")), Ok(None));
+        // So is a file with no window-like fields at all.
+        assert_eq!(migrate_window(file("(something:1)", "1.0")), Ok(None));
+    }
+
+    #[test]
+    fn the_old_position_is_kept_only_on_windows() {
+        let text = migrated(WINDOW_WITH_OUTER);
+        let pos = window_of(&text).normal_geometry.outer_position_pixels;
+        if cfg!(target_os = "windows") {
+            let pos = pos.expect("the Windows physical outer position survives");
+            assert_eq!((pos.x, pos.y), (2048.0, 1228.0));
+            assert_eq!(window_of(&text).normal_geometry.scale_factor, 1.0);
+        } else {
+            assert!(pos.is_none(), "an old macOS/Linux position is not a restorable outer position");
+        }
+    }
+
+    #[test]
+    fn a_corrupt_old_size_is_not_rewritten() {
+        let bad = WINDOW.replace("(x:1100.0,y:760.0)", "(x:1100.0,y:0.0)");
+        assert!(migrate_window(file(&bad, "1.0")).is_err());
+        let huge = WINDOW.replace("(x:1100.0,y:760.0)", "(x:1100.0,y:9000000.0)");
+        assert!(migrate_window(file(&huge, "1.0")).is_err());
+    }
+
+    #[test]
+    fn an_already_migrated_file_is_left_alone() {
+        let text = migrated(WINDOW);
+        assert_eq!(migrate_window(text), Ok(None));
+        // A 0.36 build accepts the entry, but its missing flat geometry defaults to None.
+        // It cannot recover position or size from the nested 0.37 geometry.
+        let kv: HashMap<String, String> = ron::from_str(&migrated(WINDOW)).unwrap();
+        let old: OldWindow = ron::from_str(kv.get("window").unwrap()).unwrap();
+        assert!(old.inner_position_pixels.is_none() && old.outer_position_pixels.is_none());
+        assert!(old.inner_size_points.is_none(), "documented rollback loss of saved geometry");
+        // Restoring the original backup restores both the old position and size.
+        let restored: OldWindow = ron::from_str(WINDOW).unwrap();
+        let position = restored.inner_position_pixels.unwrap();
+        let size = restored.inner_size_points.unwrap();
+        assert_eq!((position.x, position.y), (616.0, 430.0));
+        assert_eq!((size.x, size.y), (1100.0, 760.0));
+    }
+
     #[test]
     fn a_saved_window_position_is_detected() {
-        // #4826: the position from the report (Linux Mint, window moved to the third monitor).
-        let window = "(inner_position_pixels:Some((x:2048.0,y:1265.0)),outer_position_pixels:Some((x:2048.0,y:1228.0)),fullscreen:false,maximized:false,inner_size_points:Some((x:880.0,y:480.0)))";
-        assert!(saved_position(&file(window, "1.0")));
-        let no_position = "(inner_position_pixels:None,outer_position_pixels:None,fullscreen:false,maximized:false,inner_size_points:Some((x:880.0,y:480.0)))";
+        // A 0.36 flat entry is not what eframe 0.37 restores (it would open at the OS default);
+        // `sanitize` rewrites it before eframe runs, and the migrated nested value is detected.
+        assert!(!saved_position(&file(WINDOW_WITH_OUTER, "1.0")), "an unmigrated flat entry is not a restorable position");
+        // An old macOS inner position is not an outer position either.
+        assert!(!saved_position(&file(WINDOW, "1.0")));
+        let no_position =
+            "(normal_geometry:(outer_position_pixels:None,scale_factor:1.0,inner_size_points:(x:880.0,y:480.0)),fullscreen:false,maximized:false)";
         assert!(!saved_position(&file(no_position, "1.0")));
+        // The migrated nested geometry is what a 0.37 save holds (on Windows only, from the
+        // migration; a later 0.37 save on macOS/Linux has one too and eframe restores it).
+        let text = migrated(WINDOW_WITH_OUTER);
+        assert_eq!(saved_position(&text), cfg!(target_os = "windows"));
         assert!(!saved_position(&format!("{{\"egui\":{:?}}}", "()")), "no window entry");
         for text in ["", "not ron {{{", "{\"window\":\"(((\"}"] {
             assert!(!saved_position(text), "{text:?}");
@@ -148,7 +397,7 @@ mod tests {
     }
 
     #[test]
-    fn sanitize_removes_only_a_bad_file() {
+    fn sanitize_removes_only_a_bad_file_and_migrates_a_good_one() {
         let dir = std::env::temp_dir().join(format!("photocraft-ui-state-{}", std::process::id()));
         std::fs::create_dir_all(&dir).unwrap();
         let good = dir.join("good.ron");
@@ -159,7 +408,58 @@ mod tests {
         super::sanitize(Some(&bad));
         super::sanitize(Some(&dir.join("missing.ron")));
         super::sanitize(None);
-        assert!(good.exists() && !bad.exists());
+        assert!(!bad.exists());
+        assert!(good.exists());
+        // Migrated in place, with the one-time pre-0.37 backup beside it.
+        let text = std::fs::read_to_string(&good).unwrap();
+        assert!(window_of(&text).normal_geometry.inner_size_points.x == 1100.0);
+        let backup = backup_path(&good);
+        assert!(backup.exists(), "the pre-0.37 layout is kept for rollback");
+        assert_eq!(std::fs::read_to_string(&backup).unwrap(), file(WINDOW, "1.0"));
+        // A second run leaves both untouched.
+        super::sanitize(Some(&good));
+        assert_eq!(std::fs::read_to_string(&good).unwrap(), text);
         let _ = std::fs::remove_dir_all(&dir);
     }
+
+    #[test]
+    fn the_backup_is_not_overwritten_by_a_later_migration() {
+        let dir = std::env::temp_dir().join(format!("photocraft-ui-state-backup-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("ui.ron");
+        std::fs::write(&path, file(WINDOW, "1.0")).unwrap();
+        super::sanitize(Some(&path));
+        let backup = backup_path(&path);
+        let original = std::fs::read_to_string(&backup).unwrap();
+        // Pretend a 0.36 run wrote its old schema again; the backup must stay the first one.
+        std::fs::write(&path, file(&WINDOW.replace("1100.0", "1111.0"), "1.0")).unwrap();
+        super::sanitize(Some(&path));
+        assert_eq!(std::fs::read_to_string(&backup).unwrap(), original);
+        assert!(std::fs::read_to_string(&path).unwrap().contains("1111"));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// The 0.36 flat schema, kept to prove the new nested value is a one-way migration.
+    #[derive(Default, serde::Deserialize)]
+    #[serde(default)]
+    #[allow(dead_code)]
+    struct OldWindow {
+        inner_position_pixels: Option<Point>,
+        outer_position_pixels: Option<Point>,
+        fullscreen: bool,
+        maximized: bool,
+        inner_size_points: Option<Point>,
+    }
+
+    #[derive(serde::Deserialize)]
+    #[allow(dead_code)]
+    struct Point {
+        x: f32,
+        y: f32,
+    }
+
+    #[test]
+    fn the_backup_path_sits_beside_ui_ron() {
+        assert_eq!(backup_path(&PathBuf::from("/tmp/x/ui.ron")), PathBuf::from("/tmp/x/ui.ron.pre-0.37"));
+    }
 }
diff --git a/apps/photocraft/src/updates.rs b/apps/photocraft/src/updates.rs
index bbe4a9f3dc..40ac9ae016 100644
--- a/apps/photocraft/src/updates.rs
+++ b/apps/photocraft/src/updates.rs
@@ -1,10 +1,7 @@
-//! Native HTTPS transport for release checks. Only public release metadata is requested.
+//! Release checks through `craft-update`, the library every Craft App shares. Only public release
+//! metadata is requested.
 
-use photocraft_engine::updates_cmds::{CheckFn, CheckResult, parse_release};
-use std::time::Duration;
-
-const LATEST: &str = "https://api.github.com/repos/storytold/photocraft/releases/latest";
-const MAX_RESPONSE: u64 = 1024 * 1024;
+use photocraft_engine::updates_cmds::{CheckFn, CheckResult, Release};
 
 pub fn service() -> CheckFn {
     Box::new(|| {
@@ -12,7 +9,7 @@ pub fn service() -> CheckFn {
         std::thread::Builder::new()
             .name("update check".into())
             .spawn(move || {
-                let result = fetch(LATEST, Duration::from_secs(15));
+                let result = check();
                 if let Err(e) = &result {
                     log::warn!("Update check: {e}");
                 }
@@ -23,104 +20,8 @@ pub fn service() -> CheckFn {
     })
 }
 
-fn fetch(url: &str, timeout: Duration) -> CheckResult {
-    // Respect the OS trust store (including managed-network certificates), while still
-    // validating the certificate chain and server name.
-    let agent = ureq::Agent::config_builder()
-        .tls_config(ureq::tls::TlsConfig::builder().root_certs(ureq::tls::RootCerts::PlatformVerifier).build())
-        .timeout_global(Some(timeout))
-        .max_redirects(0)
-        .build()
-        .new_agent();
-    let mut response = match agent
-        .get(url)
-        .header("User-Agent", "PhotoCraft-update-check")
-        .header("Accept", "application/vnd.github+json")
-        .header("X-GitHub-Api-Version", "2026-03-10")
-        .call()
-    {
-        Ok(response) => response,
-        // The repository may not have published a stable release yet.
-        Err(ureq::Error::StatusCode(404)) => return Ok(None),
-        Err(ureq::Error::StatusCode(403 | 429)) => return Err("GitHub is limiting update checks. Please try again later.".into()),
-        Err(e) => return Err(format!("Could not contact the release server: {e}")),
-    };
-    if response.status() != 200 {
-        return Err(format!("Unexpected release server status: {}", response.status()));
-    }
-    let bytes = response.body_mut().with_config().limit(MAX_RESPONSE).read_to_vec().map_err(|e| format!("Could not read release response: {e}"))?;
-    parse_release(&bytes, photocraft_engine::build_info::VERSION)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::io::{Read, Write};
-    use std::net::TcpListener;
-
-    fn server(status: &str, body: &str, extra: &str) -> (String, std::thread::JoinHandle<String>) {
-        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-        let url = format!("http://{}/latest", listener.local_addr().unwrap());
-        let response = format!("HTTP/1.1 {status}\r\nContent-Length: {}\r\n{extra}Connection: close\r\n\r\n{body}", body.len());
-        let worker = std::thread::spawn(move || {
-            let (mut stream, _) = listener.accept().unwrap();
-            stream.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
-            let mut request = Vec::new();
-            let mut chunk = [0; 1024];
-            while !request.windows(4).any(|w| w == b"\r\n\r\n") {
-                let n = stream.read(&mut chunk).unwrap();
-                if n == 0 {
-                    break;
-                }
-                request.extend_from_slice(&chunk[..n]);
-            }
-            let _ = stream.write_all(response.as_bytes());
-            String::from_utf8(request).unwrap()
-        });
-        (url, worker)
-    }
-
-    #[test]
-    fn fetches_release_metadata_with_generic_headers() {
-        let (url, worker) = server("200 OK", r#"{"tag_name":"v99.0.0","draft":false,"prerelease":false}"#, "");
-        let result = fetch(&url, Duration::from_secs(5)).unwrap().unwrap();
-        assert_eq!(result.version, "99.0.0");
-        let request = worker.join().unwrap().to_ascii_lowercase();
-        assert!(request.contains("user-agent: photocraft-update-check\r\n"));
-        assert!(request.contains("accept: application/vnd.github+json"));
-        assert!(!request.contains("authorization:") && !request.contains("cookie:"));
-    }
-
-    #[test]
-    fn handles_missing_release_rate_limits_and_bad_responses() {
-        for (status, body, extra, expected_none) in [
-            ("404 Not Found", "", "", true),
-            ("403 Forbidden", "", "", false),
-            ("429 Too Many Requests", "", "", false),
-            ("500 Internal Server Error", "", "", false),
-            ("200 OK", "invalid JSON", "", false),
-            ("302 Found", "", "Location: https://untrusted.example/\r\n", false),
-        ] {
-            let (url, worker) = server(status, body, extra);
-            let result = fetch(&url, Duration::from_secs(5));
-            if expected_none {
-                assert_eq!(result, Ok(None));
-            } else {
-                assert!(result.is_err(), "{status}");
-            }
-            worker.join().unwrap();
-        }
-    }
-
-    #[test]
-    fn caps_response_size_and_times_out() {
-        let (url, worker) = server("200 OK", &" ".repeat(MAX_RESPONSE as usize + 1), "");
-        assert!(fetch(&url, Duration::from_secs(5)).is_err());
-        worker.join().unwrap();
-        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-        let url = format!("http://{}/latest", listener.local_addr().unwrap());
-        let start = std::time::Instant::now();
-        assert!(fetch(&url, Duration::from_millis(100)).is_err());
-        assert!(start.elapsed() < Duration::from_secs(2));
-    }
+fn check() -> CheckResult {
+    let http = craft_update::Http::new("PhotoCraft/Update")?;
+    let found = craft_update::check_for_update(&craft_update::suite::PHOTOCRAFT, &http, photocraft_engine::build_info::VERSION)?;
+    Ok(found.map(|release| Release { version: release.tag.trim_start_matches(['v', 'V']).to_string(), url: release.html_url }))
 }
diff --git a/apps/photocraft/tests/fixtures/README.md b/apps/photocraft/tests/fixtures/README.md
new file mode 100644
index 0000000000..1eb90452f0
--- /dev/null
+++ b/apps/photocraft/tests/fixtures/README.md
@@ -0,0 +1,7 @@
+These files are **schema probes**, not recorded machine saves.
+
+`ui-0.14.ron`, `ui-0.15.ron` and `ui-0.37.ron` are minimal payloads reconstructed from the
+documented eframe/egui layouts. They exercise `apps/photocraft/src/ui_state.rs` (the flat
+window entry versus the nested `normal_geometry` entry) only. They do not prove that eframe
+and egui deserialize a real `Memory` or `PanelState`; a captured 0.14/0.15/0.37 `ui.ron`
+would be needed for that, with the machine-specific data reviewed first.
diff --git a/apps/photocraft/tests/fixtures/ui-0.14.ron b/apps/photocraft/tests/fixtures/ui-0.14.ron
new file mode 100644
index 0000000000..619999cf2b
--- /dev/null
+++ b/apps/photocraft/tests/fixtures/ui-0.14.ron
@@ -0,0 +1 @@
+{"window":"(inner_position_pixels:Some((x:616.0,y:430.0)),outer_position_pixels:None,fullscreen:false,maximized:false,inner_size_points:Some((x:1100.0,y:760.0)))","egui":"()"}
diff --git a/apps/photocraft/tests/fixtures/ui-0.15.ron b/apps/photocraft/tests/fixtures/ui-0.15.ron
new file mode 100644
index 0000000000..7edccd600b
--- /dev/null
+++ b/apps/photocraft/tests/fixtures/ui-0.15.ron
@@ -0,0 +1 @@
+{"window":"(inner_position_pixels:None,outer_position_pixels:Some((x:2048.0,y:1228.0)),fullscreen:false,maximized:true,inner_size_points:Some((x:1440.0,y:900.0)))","egui":"()"}
diff --git a/apps/photocraft/tests/fixtures/ui-0.37.ron b/apps/photocraft/tests/fixtures/ui-0.37.ron
new file mode 100644
index 0000000000..d5973c734f
--- /dev/null
+++ b/apps/photocraft/tests/fixtures/ui-0.37.ron
@@ -0,0 +1 @@
+{"window":"(normal_geometry:(outer_position_pixels:None,scale_factor:2.0,inner_size_points:(x:1440.0,y:900.0)),fullscreen:false,maximized:false)","egui":"()"}
diff --git a/book/src/development/release-security.md b/book/src/development/release-security.md
index 742ab11095..99a95f1f82 100644
--- a/book/src/development/release-security.md
+++ b/book/src/development/release-security.md
@@ -6,6 +6,7 @@ PhotoCraft's release workflow builds platform packages and a draft GitHub Releas
 
 - platform-specific signing/notarization steps exist for macOS and Windows;
 - signing secrets are scoped through the GitHub `release` environment;
+- the Azure Trusted Signing client that Windows signing loads is pinned to a version and SHA-256, and refused on a mismatch;
 - release artifacts include `SHA256SUMS.txt`;
 - the final release job receives `contents: write`, while build jobs use narrower access;
 - artifacts remain in a draft release until a maintainer publishes them.
diff --git a/book/src/formats/raster-formats.md b/book/src/formats/raster-formats.md
index 590260962e..e1a2cc23fa 100644
--- a/book/src/formats/raster-formats.md
+++ b/book/src/formats/raster-formats.md
@@ -4,7 +4,7 @@
 
 ## Layered TIFF
 
-A TIFF saved by Photoshop with its layers carries them in two private tags: 37724 (`ImageSourceData`, the same layer section a PSD has, preceded by the string `Adobe Photoshop Document Data Block`) and 34377 (the PSD image resources). `photocraft-codecs` passes both through as opaque bytes on `Metadata`; `photocraft-io` rebuilds a PSD model from them plus the TIFF's pixels and hands it to the PSD importer, so groups, masks, layer styles, type, shapes, smart objects and adjustment layers open from a TIFF exactly as from a PSD, and are written back the same way. In Intel-order (`II`) files Photoshop stores the whole block structure byte-swapped (reversed keys such as `MIB8` and `ryaL`, little-endian integers and doubles) while pixel samples stay big-endian; `photocraft-psd`'s `tiff` module converts between the two orders field by field, and drops, with a warning, any block whose layout it does not know rather than pass byte-swapped data to other readers. Limits: a TIFF holds one transparency sample, so extra alpha channels are not written; Lab documents are saved flat. Save As asks "Including layers will increase file size" (with "Discard Layers and Save a Copy") while *Ask Before Saving Layered TIFF Files* is on in Preferences › File Handling. Scripted and agent saves write a flat TIFF unless they ask for layers: `--tiff-layers` for `photocraft-cli convert`, `run` and `batch`, and `"tiffLayers": true` in the save, batch and export commands and MCP `doc_save`.
+A TIFF saved by Photoshop with its layers carries them in two private tags: 37724 (`ImageSourceData`, the same layer section a PSD has, preceded by the string `Adobe Photoshop Document Data Block`) and 34377 (the PSD image resources). `photocraft-codecs` passes both through as opaque bytes on `Metadata`; `photocraft-io` rebuilds a PSD model from them plus the TIFF's pixels and hands it to the PSD importer, so groups, masks, layer styles, type, shapes, smart objects and adjustment layers open from a TIFF exactly as from a PSD, and are written back the same way. In Intel-order (`II`) files Photoshop stores the whole block structure byte-swapped (reversed keys such as `MIB8` and `ryaL`, little-endian integers and doubles) while pixel samples stay big-endian; `photocraft-psd`'s `tiff` module converts between the two orders field by field, and drops, with a warning, any block whose layout it does not know rather than pass byte-swapped data to other readers. Limits: up to sixteen extra samples (spot colours and alpha channels, plus a Quick Mask) are written in the IFD and round-trip, with Photoshop image resources for the channel name, ink colour and solidity; Lab documents are saved flat, with their extra samples. Save As asks "Including layers will increase file size" (with "Discard Layers and Save a Copy") while *Ask Before Saving Layered TIFF Files* is on in Preferences › File Handling. Scripted and agent saves write a flat TIFF unless they ask for layers: `--tiff-layers` for `photocraft-cli convert`, `run` and `batch`, and `"tiffLayers": true` in the save, batch and export commands and MCP `doc_save`.
 
 ## WebP
 
diff --git a/contributors/people.toml b/contributors/people.toml
index 242fb5ac80..ac36371f38 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -264,3 +264,21 @@ sync_github_name = false
 
 [people.drunkeninja42]
 real_name = "Kushagra Sharma"
+
+[people.WebWork-rrs]
+display_name = "Ratul Paul"
+
+[people.softwaregames1]
+sync_github_name = true
+
+[people.VoiceLessQ]
+display_name = "VoiceLessQ"
+sync_github_name = false
+
+[people.erenova]
+display_name = "Erenova"
+sync_github_name = false
+
+[people.jasallen]
+real_name = "Jason DeBoever"
+sync_github_name = true
diff --git a/crates/affinity/src/container.rs b/crates/affinity/src/container.rs
index 0250cc4f77..76ffb69f7d 100644
--- a/crates/affinity/src/container.rs
+++ b/crates/affinity/src/container.rs
@@ -17,6 +17,9 @@ const DOCUMENT_KIND: &[u8; 4] = b"nsrP";
 const MAX_TABLES: usize = 4096;
 /// Distinct ids the allocation tables may name; each costs a map slot even when only deleted.
 const MAX_ENTRIES: usize = 1 << 22;
+/// Bytes of entry names the allocation tables may name. A name is retained twice (in the entry
+/// and as its map key), and tables can point many names at the same bytes.
+const MAX_NAME_BYTES: usize = 32 << 20;
 /// zstd window ceiling: real documents use a few MiB; this stops a header from reserving gigabytes.
 const MAX_ZSTD_WINDOW: u64 = 64 << 20;
 
@@ -168,6 +171,7 @@ impl<'a> Archive<'a> {
         // Newest record per id: (table date, table index, record).
         let mut latest: HashMap<u32, (u64, usize, Option<Box<Entry>>)> = HashMap::new();
         let mut names: HashMap<u32, String> = HashMap::new();
+        let mut name_bytes = 0usize;
         let mut seen = HashSet::new();
         let mut next = header.fat_offset;
         let mut tables = 0usize;
@@ -231,8 +235,16 @@ impl<'a> Archive<'a> {
                 }
                 if flag == 0 {
                     let len = usize::from(c.u16()?);
-                    let name = String::from_utf8_lossy(c.take(len)?).into_owned();
-                    names.entry(id).or_insert(name);
+                    let raw = c.take(len)?;
+                    // Only the first name per id is kept: charge and copy just that one.
+                    if let std::collections::hash_map::Entry::Vacant(slot) = names.entry(id) {
+                        let name = String::from_utf8_lossy(raw).into_owned();
+                        name_bytes = name_bytes.saturating_add(name.len());
+                        if name_bytes > MAX_NAME_BYTES {
+                            return Err(Error::Limit("archive entry names too large"));
+                        }
+                        slot.insert(name);
+                    }
                 }
                 // Equal dates: the first table in the chain (the newest) wins, as in afread.
                 let replace = latest.get(&id).is_none_or(|(d, _, _)| date > *d);
@@ -284,6 +296,9 @@ impl<'a> Archive<'a> {
         if total > self.limits.max_total {
             return Err(Error::Limit("document too large"));
         }
+        // Charge before decoding: a corrupt entry that fails its checksum has already cost the
+        // decompression, and an importer that recovers must not get it again for free.
+        self.extracted = total;
         let mut c = Cursor::new(self.bytes, offset(e.offset)?);
         if c.take(4)? != b"#Fil" {
             return Err(Error::Malformed("archive entry has no data block"));
@@ -303,7 +318,6 @@ impl<'a> Archive<'a> {
         if crc32fast::hash(&out) != e.crc {
             return Err(Error::Malformed("archive entry checksum mismatch"));
         }
-        self.extracted = total;
         Ok(out)
     }
 }
diff --git a/crates/affinity/src/geometry.rs b/crates/affinity/src/geometry.rs
index c62c206f58..fa45cf6213 100644
--- a/crates/affinity/src/geometry.rs
+++ b/crates/affinity/src/geometry.rs
@@ -148,7 +148,21 @@ pub(crate) fn curves(r: &mut Reader, crvs: ObjId) -> Option<Path> {
         Value::UInt(n) => usize::try_from(*n).ok()?,
         _ => return None,
     };
-    let corners = s.obj(crvs, b"CnrD").and_then(|c| corner_radii(s.positional(c).collect()));
+    let corners = match s.obj(crvs, b"CnrD") {
+        Some(c) => {
+            let fields: Vec<&Value> = s.positional(c).collect();
+            // The corner arrays are scanned for every occurrence of a shared curve, so charge
+            // them like records before they are walked.
+            if let Some(Value::Array(idx)) = fields.get(1)
+                && let Err(reason) = r.geometry_budget.records(idx.len())
+            {
+                r.warn(reason);
+                return None;
+            }
+            corner_radii(fields)
+        }
+        None => None,
+    };
     let mut path = Path::default();
     let mut seen = 0usize;
     for index in 0..count {
diff --git a/crates/affinity/src/model.rs b/crates/affinity/src/model.rs
index 1d8e5918be..c59afa1cac 100644
--- a/crates/affinity/src/model.rs
+++ b/crates/affinity/src/model.rs
@@ -290,6 +290,10 @@ const MAX_NODES: usize = 500_000;
 const MAX_CHILD_SLOTS: usize = 8_000_000;
 /// Bytes of layer names the model may retain across all occurrences.
 const MAX_NAME_BYTES: usize = 64 << 20;
+/// Page rectangles the model may retain across all spreads (real books have a few hundred).
+const MAX_PAGES: usize = 1 << 18;
+/// Bytes of font names the text runs may retain across the document.
+const MAX_FONT_NAME_BYTES: usize = 16 << 20;
 
 /// Read a document: archive, `doc.dat` and the model.
 pub fn read(bytes: &[u8], limits: Limits) -> Result<Document, Error> {
@@ -307,6 +311,8 @@ pub(crate) struct Reader<'s, 'a, 'b> {
     nodes: usize,
     child_slots: usize,
     name_bytes: usize,
+    pages: usize,
+    font_name_bytes: usize,
     active: HashSet<ObjId>,
     pub(crate) geometry_budget: crate::geometry::Budget,
     /// Decoded pixels still available ([`Limits::max_pixel_bytes`] less what the layers read so
@@ -324,6 +330,8 @@ impl<'s, 'a, 'b> Reader<'s, 'a, 'b> {
             nodes: 0,
             child_slots: 0,
             name_bytes: 0,
+            pages: 0,
+            font_name_bytes: 0,
             active: HashSet::new(),
             geometry_budget: crate::geometry::Budget::default(),
             pixels_left: limits.max_pixel_bytes,
@@ -365,7 +373,7 @@ impl<'s, 'a, 'b> Reader<'s, 'a, 'b> {
                 self.warn("an unknown kind of page");
                 continue;
             }
-            let pages = pages(s, spread);
+            let pages = self.pages(spread)?;
             let default_size = s.floats::<2>(doc, b"DfSz").filter(|[w, h]| *w > 0.0 && *h > 0.0).map(|[w, h]| Rect { x0: 0.0, y0: 0.0, x1: w, y1: h });
             let bounds = s.floats::<4>(spread, b"SprB").map(rect).or_else(|| pages.iter().copied().reduce(union)).or(default_size).unwrap_or(Rect {
                 x0: 0.0,
@@ -421,7 +429,7 @@ impl<'s, 'a, 'b> Reader<'s, 'a, 'b> {
     }
 
     /// Counts raw array slots (null ones included) against [`MAX_CHILD_SLOTS`].
-    fn charge_slots(&mut self, n: usize) -> Result<(), Error> {
+    pub(crate) fn charge_slots(&mut self, n: usize) -> Result<(), Error> {
         self.child_slots = self.child_slots.saturating_add(n);
         if self.child_slots > MAX_CHILD_SLOTS {
             return Err(Error::Limit("too many child slots in the layer tree"));
@@ -553,6 +561,8 @@ impl<'s, 'a, 'b> Reader<'s, 'a, 'b> {
     /// an attached mask layer is a pixel mask. Adjustments attached the same way are reported.
     fn attached_masks(&mut self, id: ObjId, world: Affine) -> Result<(Option<Path>, Option<Image>), Error> {
         let s = self.s;
+        // Every occurrence of a shared layer scans its whole attachment array, null slots included.
+        self.charge_slots(s.array_len(id, b"AdCh").unwrap_or(0))?;
         let attached = s.objs(id, b"AdCh");
         let mut mask: Option<Path> = None;
         let mut pixels: Option<Image> = None;
@@ -601,21 +611,51 @@ impl<'s, 'a, 'b> Reader<'s, 'a, 'b> {
     }
 }
 
-/// Page rectangles: `SpMd.PagR[].rctp` (Publisher 2, Affinity 3) or `SprB` split into `PagC`
-/// equal pages (Publisher 1 facing spreads).
-fn pages(s: &Stream, spread: ObjId) -> Vec<Rect> {
-    if let Some(md) = s.obj(spread, b"SpMd") {
-        let v: Vec<Rect> = s.objs(md, b"PagR").into_iter().filter_map(|p| s.floats::<4>(p, b"rctp").map(rect)).filter(|r| r.x1 > r.x0 && r.y1 > r.y0).collect();
-        if !v.is_empty() {
-            return v;
+impl Reader<'_, '_, '_> {
+    /// Page rectangles: `SpMd.PagR[].rctp` (Publisher 2, Affinity 3) or `SprB` split into `PagC`
+    /// equal pages (Publisher 1 facing spreads). A spread listed several times, or sharing one
+    /// large page array, is expanded into a new vector each time, so the slots scanned and the
+    /// rectangles retained are charged across the document.
+    fn pages(&mut self, spread: ObjId) -> Result<Vec<Rect>, Error> {
+        let s = self.s;
+        if let Some(md) = s.obj(spread, b"SpMd") {
+            self.charge_slots(s.array_len(md, b"PagR").unwrap_or(0))?;
+            let remaining = MAX_PAGES.saturating_sub(self.pages);
+            let v: Vec<Rect> = s
+                .objs(md, b"PagR")
+                .into_iter()
+                .filter_map(|p| s.floats::<4>(p, b"rctp").map(rect))
+                .filter(|r| r.x1 > r.x0 && r.y1 > r.y0)
+                .take(remaining.saturating_add(1))
+                .collect();
+            if !v.is_empty() {
+                self.charge_pages(v.len())?;
+                return Ok(v);
+            }
         }
+        Ok(match (s.floats::<4>(spread, b"SprB").map(rect), s.int(spread, b"PagC")) {
+            (Some(b), Some(n @ 2..=16)) => {
+                self.charge_pages(n as usize)?;
+                let w = (b.x1 - b.x0) / n as f64;
+                (0..n).map(|i| Rect { x0: b.x0 + w * i as f64, x1: b.x0 + w * (i + 1) as f64, ..b }).collect()
+            }
+            _ => Vec::new(),
+        })
     }
-    match (s.floats::<4>(spread, b"SprB").map(rect), s.int(spread, b"PagC")) {
-        (Some(b), Some(n @ 2..=16)) => {
-            let w = (b.x1 - b.x0) / n as f64;
-            (0..n).map(|i| Rect { x0: b.x0 + w * i as f64, x1: b.x0 + w * (i + 1) as f64, ..b }).collect()
+
+    /// Counts retained font-name bytes against [`MAX_FONT_NAME_BYTES`]; false once it is spent.
+    pub(crate) fn charge_font_name(&mut self, n: usize) -> bool {
+        self.font_name_bytes = self.font_name_bytes.saturating_add(n);
+        self.font_name_bytes <= MAX_FONT_NAME_BYTES
+    }
+
+    /// Counts retained page rectangles against [`MAX_PAGES`].
+    fn charge_pages(&mut self, n: usize) -> Result<(), Error> {
+        self.pages = self.pages.saturating_add(n);
+        if self.pages > MAX_PAGES {
+            return Err(Error::Limit("too many pages"));
         }
-        _ => Vec::new(),
+        Ok(())
     }
 }
 
diff --git a/crates/affinity/src/paint.rs b/crates/affinity/src/paint.rs
index 343c276b60..1847fad90f 100644
--- a/crates/affinity/src/paint.rs
+++ b/crates/affinity/src/paint.rs
@@ -232,9 +232,15 @@ pub(crate) fn descriptor(r: &mut Reader, id: ObjId, local: Affine) -> Option<Pai
                 }
             };
             let grad = s.obj(fill, b"Grad")?;
+            // A shared gradient is decoded again for every occurrence: charge the arrays scanned
+            // and copy only as many positions as there are stops to keep.
+            if r.charge_slots(s.array_len(grad, b"Cols").unwrap_or(0).saturating_add(s.array_len(grad, b"Posn").unwrap_or(0))).is_err() {
+                r.warn("gradients beyond the document work budget (left empty)");
+                return Some(Paint::None);
+            }
             let cols = s.objs(grad, b"Cols");
             let posn: Vec<Vec<f64>> = match s.field(grad, b"Posn") {
-                Some(Value::Array(a)) => a.iter().filter_map(floats).collect(),
+                Some(Value::Array(a)) => a.iter().filter_map(floats).take(MAX_STOPS).collect(),
                 _ => Vec::new(),
             };
             let mut stops = Vec::new();
diff --git a/crates/affinity/src/raster.rs b/crates/affinity/src/raster.rs
index f2b99c195e..226c66a459 100644
--- a/crates/affinity/src/raster.rs
+++ b/crates/affinity/src/raster.rs
@@ -193,6 +193,8 @@ fn plane(
     }
     .iter()
     .filter_map(|v| if let Value::Obj(Some(o)) = v { Some(*o) } else { None });
+    // The scan below runs for every occurrence of a shared bitmap, whatever it produces.
+    r.charge_slots(states.len().min(tw.saturating_mul(th)))?;
     let row = (w as usize) * bps;
     let mut out = vec![0u8; row * h as usize];
     let (bx0, bx1) = (x0 as usize * bps, (x0 + w) as usize * bps);
diff --git a/crates/affinity/src/tests.rs b/crates/affinity/src/tests.rs
index c932aac399..ab59c440b4 100644
--- a/crates/affinity/src/tests.rs
+++ b/crates/affinity/src/tests.rs
@@ -258,6 +258,20 @@ mod archive {
         assert!(matches!(a.read("doc.dat"), Err(Error::Limit(_))));
     }
 
+    #[test]
+    fn a_failed_read_still_spends_the_extraction_allowance() {
+        let d = doc();
+        let file = synth::container(&[("doc.dat", &d, Method::Zstd)], None);
+        let mut broken = file.clone();
+        broken[90] ^= 0x55;
+        // Room for exactly one read: the failed attempt must use it up, so a caller that
+        // recovers from the checksum error cannot make the same entry decode again.
+        let mut a = Archive::open(&broken, Limits { max_entry: usize::MAX, max_total: d.len(), ..Limits::default() }).unwrap();
+        assert!(a.read("doc.dat").is_err());
+        assert_eq!(a.extracted(), d.len());
+        assert!(matches!(a.read("doc.dat"), Err(Error::Limit(_))));
+    }
+
     #[test]
     fn a_declared_size_smaller_than_the_data_is_rejected_not_truncated() {
         let big = vec![7u8; 1 << 20];
diff --git a/crates/affinity/src/text.rs b/crates/affinity/src/text.rs
index 3b09c75124..bfad07217f 100644
--- a/crates/affinity/src/text.rs
+++ b/crates/affinity/src/text.rs
@@ -106,6 +106,24 @@ fn int(v: &Value) -> Option<i64> {
     }
 }
 
+/// Longest font name kept; real PostScript and family names are far shorter.
+const MAX_FONT_NAME: usize = 256;
+
+/// A font name for one run. Runs repeat the same shared string, so its copies are charged
+/// against a document-wide byte budget; an overlong name or an exhausted budget leaves it empty.
+fn font_name(r: &mut Reader, font: Option<ObjId>, tag: &[u8; 4]) -> String {
+    let name = font.and_then(|f| r.s.str(f, tag)).unwrap_or_default();
+    if name.len() > MAX_FONT_NAME {
+        r.warn("font names longer than 256 bytes (left empty)");
+        return String::new();
+    }
+    if !r.charge_font_name(name.len()) {
+        r.warn("font names beyond the document metadata budget (left empty)");
+        return String::new();
+    }
+    name.to_string()
+}
+
 fn run_attrs(r: &mut Reader, attrs: ObjId, text: String, world: Affine) -> TextRun {
     let s = r.s;
     let doubles = s.field(attrs, b"Doub");
@@ -125,11 +143,12 @@ fn run_attrs(r: &mut Reader, attrs: ObjId, text: String, world: Affine) -> TextR
         r.warn("horizontally scaled text");
     }
     let font = s.obj(attrs, b"DFnt");
-    let get = |tag: &[u8; 4]| font.and_then(|f| s.str(f, tag)).unwrap_or_default().to_string();
+    let postscript = font_name(r, font, b"Post");
+    let family = font_name(r, font, b"Famy");
     TextRun {
         text,
-        postscript: get(b"Post"),
-        family: get(b"Famy"),
+        postscript,
+        family,
         weight: font.and_then(|f| s.int(f, b"Wegt")).unwrap_or(400),
         italic: font.and_then(|f| s.bool(f, b"Ital")).unwrap_or(false),
         size,
diff --git a/crates/algo/examples/bench_multiband.rs b/crates/algo/examples/bench_multiband.rs
index 9d58b81a54..2e18f9457e 100644
--- a/crates/algo/examples/bench_multiband.rs
+++ b/crates/algo/examples/bench_multiband.rs
@@ -1,42 +1,161 @@
-//! Time and peak memory of the Photomerge multi-band blend: `n` RGB sources of `mp` megapixels
-//! (3:2), each overlapping the next by half its width.
-//! `cargo run --release -p photocraft-algo --example bench_multiband [n] [mp]` (default 4 × 24 MP).
-//! Peak memory is the growth of the process's high-water mark during the blend (Linux only).
+//! Time and peak memory of Photomerge's multi-band blend on overlapping RGB sources.
+//! Backwards compatible: `cargo run --release -p photocraft-algo --example bench_multiband [n] [mp]`.
+//! `cargo xtask perf --bench bench_multiband --quick` also collects repeatable JSON timings.
+//! The peak is the entire process's resident-set high-water mark, not an estimate of allocations
+//! by the blend alone (`photocraft_testkit::perf`: the kernel's mark on Linux, sampled elsewhere).
+use std::path::PathBuf;
 use std::time::Instant;
 
 use photocraft_algo::panorama::{self, RoiImage};
+use photocraft_testkit::perf::{self, RssSampler, Summary};
+use serde_json::json;
 
-/// The process's peak resident set in MiB (`VmHWM`), where `/proc` has it.
-fn peak_mib() -> Option<f64> {
-    let s = std::fs::read_to_string("/proc/self/status").ok()?;
-    let kb: f64 = s.lines().find(|l| l.starts_with("VmHWM:"))?.split_whitespace().nth(1)?.parse().ok()?;
-    Some(kb / 1024.0)
+const ROW: &str = "Photomerge multiband blend";
+
+#[derive(Debug, PartialEq)]
+struct Options {
+    n: usize,
+    mp: f64,
+    reps: usize,
+    json: Option<PathBuf>,
 }
 
-fn main() {
-    let mut args = std::env::args().skip(1);
-    let n: usize = args.next().and_then(|a| a.parse().ok()).unwrap_or(4).max(1);
-    let mp: f64 = args.next().and_then(|a| a.parse().ok()).unwrap_or(24.0);
-    let sh = ((mp * 1e6 / 1.5).sqrt().round() as usize).max(2);
+/// Parses legacy `[n] [mp]` arguments and the perf runner's `--reps`/`--json` flags.
+/// Rejects missing, out-of-range, or non-finite values before allocating images.
+fn options(args: impl IntoIterator<Item = String>) -> Result<Options, String> {
+    let mut out = Options { n: 4, mp: 24.0, reps: 1, json: None };
+    let mut positional = Vec::new();
+    let mut it = args.into_iter();
+    while let Some(arg) = it.next() {
+        match arg.as_str() {
+            "--json" => {
+                let path = it.next().filter(|p| !p.starts_with('-')).ok_or("--json needs a file path")?;
+                out.json = Some(PathBuf::from(path));
+            }
+            "--reps" => {
+                out.reps = it.next().ok_or("--reps needs an integer")?.parse().map_err(|_| "--reps needs an integer")?;
+            }
+            _ if !arg.starts_with('-') => positional.push(arg),
+            _ => return Err(format!("unknown option: {arg}")),
+        }
+    }
+    if positional.len() > 2 {
+        return Err("expected at most [n] [mp]".into());
+    }
+    if let Some(n) = positional.first() {
+        out.n = n.parse().map_err(|_| "n must be an integer")?;
+    }
+    if let Some(mp) = positional.get(1) {
+        out.mp = mp.parse().map_err(|_| "mp must be a number")?;
+    }
+    if !(1..=16).contains(&out.n) || !(1..=25).contains(&out.reps) || !out.mp.is_finite() || !(0.01..=36.0).contains(&out.mp) {
+        return Err("expected 1..=16 images, 0.01..=36 MP per image and 1..=25 repetitions".into());
+    }
+    Ok(out)
+}
+
+/// Builds deterministic overlapping RGB inputs and times each multi-band blend.
+/// Writes individual samples and whole-process peak RSS to JSON when requested.
+fn run() -> Result<(), String> {
+    let o = options(std::env::args().skip(1))?;
+    let sh = ((o.mp * 1e6 / 1.5).sqrt().round() as usize).max(2);
     let sw = sh * 3 / 2;
     let step = sw / 2;
-    let (cw, ch) = (step * (n - 1) + sw, sh);
-    let rois: Vec<RoiImage> = (0..n)
+    let (cw, ch) = (step * (o.n - 1) + sw, sh);
+    let rois: Vec<RoiImage> = (0..o.n)
         .map(|k| {
             let px = (0..sw * sh * 3).map(|i| ((i / 3 % sw * 7 + i / 3 / sw * 3 + k * 31 + i % 3 * 50) % 251) as f32 / 251.0).collect();
             RoiImage { x0: (step * k) as i32, y0: 0, w: sw, h: sh, ch: 3, px, alpha: vec![1.0; sw * sh] }
         })
         .collect();
-    // Each canvas column belongs to the image whose centre is nearest, as a seam would split it.
-    let wts: Vec<Vec<f32>> = (0..n)
-        .map(|k| (0..sw * sh).map(|i| if ((step * k + i % sw + step / 2) / step).saturating_sub(1).min(n - 1) == k { 1.0 } else { 0.0 }).collect())
+    let wts: Vec<Vec<f32>> = (0..o.n)
+        .map(|k| (0..sw * sh).map(|i| if ((step * k + i % sw + step / 2) / step).saturating_sub(1).min(o.n - 1) == k { 1.0 } else { 0.0 }).collect())
         .collect();
     let levels = panorama::blend_levels(cw, ch).min(7);
-    let before = peak_mib();
-    let t0 = Instant::now();
-    let (px, cov) = panorama::multiband(cw, ch, &rois, &wts, levels);
-    let ms = t0.elapsed().as_secs_f64() * 1000.0;
-    let peak = peak_mib().zip(before).map_or("n/a".to_string(), |(a, b)| format!("{:.0} MiB", a - b));
-    println!("{n} × {sw}×{sh} ({mp} MP) RGB, canvas {cw}×{ch}, {levels} levels: {ms:.0} ms, peak +{peak} during the blend");
-    std::hint::black_box((px, cov));
+    let before = perf::process_peak_rss_bytes().or_else(perf::current_rss_bytes);
+    let sampler = RssSampler::start(std::time::Duration::from_millis(2));
+    let mut samples_ms = Vec::with_capacity(o.reps);
+    for _ in 0..o.reps {
+        let t0 = Instant::now();
+        let output = panorama::multiband(cw, ch, &rois, &wts, levels);
+        samples_ms.push(t0.elapsed().as_secs_f64() * 1000.0);
+        std::hint::black_box(&output);
+    }
+    let peak = perf::process_peak_rss_bytes().or(sampler.peak());
+    let delta = before.zip(peak).map(|(a, b)| b.saturating_sub(a) as f64 / (1024.0 * 1024.0));
+    // The same nearest-rank p50 that `cargo xtask perf` reports for these samples.
+    let p50 = Summary::of(&samples_ms).map_or(f64::NAN, |s| s.p50);
+    println!(
+        "{} × {}×{} ({:.2} MP) RGB, canvas {}×{}, {} levels: {:.1} ms p50 ({} runs), peak +{}",
+        o.n,
+        sw,
+        sh,
+        o.mp,
+        cw,
+        ch,
+        levels,
+        p50,
+        o.reps,
+        delta.map_or("n/a".to_string(), |m| format!("{m:.0} MiB"))
+    );
+    if let Some(path) = o.json {
+        let context = json!({"sources": o.n, "mp_per_source": o.mp, "canvas_width": cw, "canvas_height": ch, "levels": levels});
+        let report = perf::report("bench_multiband", context, vec![perf::row(ROW, &samples_ms, peak, None)], Some(&sampler));
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent).map_err(|e| format!("create {}: {e}", parent.display()))?;
+        }
+        std::fs::write(&path, serde_json::to_vec_pretty(&report).map_err(|e| e.to_string())?).map_err(|e| format!("write {}: {e}", path.display()))?;
+    }
+    Ok(())
+}
+
+/// Runs the benchmark, reporting argument or output errors with a failing exit status.
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("bench_multiband: {e}");
+        std::process::exit(2);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Converts borrowed argument slices for the owned-string command-line parser.
+    fn parse(args: &[&str]) -> Result<Options, String> {
+        options(args.iter().map(|s| s.to_string()))
+    }
+
+    /// Confirms backwards compatibility with the positional and perf-runner forms.
+    #[test]
+    fn parses_old_positional_args_and_perf_runner_args() {
+        assert_eq!(parse(&[]).unwrap().n, 4);
+        assert_eq!(
+            parse(&["2", "0.25", "--reps", "3", "--json", "out.json"]).unwrap(),
+            Options { n: 2, mp: 0.25, reps: 3, json: Some(PathBuf::from("out.json")) }
+        );
+        // The 24-36 MP range AGENTS.md benchmarks at, as before the flags were added.
+        assert_eq!(parse(&["4", "36"]).unwrap().mp, 36.0);
+    }
+
+    /// Checks invalid counts, non-finite sizes, repetitions, and missing flag values.
+    #[test]
+    fn rejects_bad_benchmark_args() {
+        for args in [
+            vec!["0"],
+            vec!["17"],
+            vec!["2", "0"],
+            vec!["2", "NaN"],
+            vec!["2", "inf"],
+            vec!["2", "37"],
+            vec!["--reps", "0"],
+            vec!["--reps", "26"],
+            vec!["--json"],
+            vec!["--json", "--reps", "5"],
+            vec!["--reps"],
+            vec!["--unknown"],
+        ] {
+            assert!(parse(&args).is_err(), "{args:?}");
+        }
+    }
 }
diff --git a/crates/algo/examples/bench_seam_cas.rs b/crates/algo/examples/bench_seam_cas.rs
new file mode 100644
index 0000000000..b8acbfe3f2
--- /dev/null
+++ b/crates/algo/examples/bench_seam_cas.rs
@@ -0,0 +1,78 @@
+//! Timing of Content-Aware Scale's seam carving alone (no document plumbing), on a synthetic
+//! photo-like RGBA image: perf scenario P28's 24 MP width change (#211), the same image's height
+//! (the transposed pass) and two images short enough for the exact full-resolution seam search.
+//! Prints an FNV-style hash of each output's bits (over 32-bit words), so a speed-up can be checked
+//! to choose exactly the same seams.
+//! `cargo run --release -p photocraft-algo --example bench_seam_cas [reps] [case filter]`
+use std::time::Instant;
+
+use photocraft_algo::seam::carve;
+
+/// Smooth gradients, a few hard-edged shapes and fine noise: enough structure that seams are
+/// steered by content, as in a photo.
+fn photo(w: usize, h: usize) -> Vec<f32> {
+    let mut seed = 0x9e37_79b9u32;
+    let mut noise = move || {
+        seed ^= seed << 13;
+        seed ^= seed >> 17;
+        seed ^= seed << 5;
+        (seed % 1000) as f32 / 1000.0 - 0.5
+    };
+    let mut img = Vec::with_capacity(w * h * 4);
+    for y in 0..h {
+        for x in 0..w {
+            let (u, v) = (x as f32 / w as f32, y as f32 / h as f32);
+            let sky = 0.35 + 0.4 * v;
+            let disc = ((u - 0.3).powi(2) + (v - 0.55).powi(2)) < 0.02;
+            let bar = (0.62..0.66).contains(&u) && v > 0.3;
+            let hill = v > 0.7 + 0.08 * (u * 11.0).sin();
+            let (r, g, b) = if disc {
+                (0.85, 0.3, 0.2)
+            } else if bar {
+                (0.1, 0.1, 0.12)
+            } else if hill {
+                (0.2, 0.45 + 0.1 * (u * 40.0).sin(), 0.15)
+            } else {
+                (sky * 0.6, sky * 0.8, sky)
+            };
+            let n = noise() * 0.02;
+            img.extend_from_slice(&[r + n, g + n, b + n, 1.0]);
+        }
+    }
+    img
+}
+
+fn fnv(v: &[f32]) -> u64 {
+    v.iter().fold(0xcbf2_9ce4_8422_2325u64, |h, f| (h ^ u64::from(f.to_bits())).wrapping_mul(0x0100_0000_01b3))
+}
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    let reps = args.get(1).and_then(|s| s.parse::<usize>().ok()).unwrap_or(1).clamp(1, 20);
+    let only = args.get(2).cloned();
+    // (name, w, h, new w, new h)
+    let cases = [
+        ("24 MP to 90 % width (P28, proxy rows)", 6000, 4000, 5400, 4000),
+        ("24 MP to 90 % height (transposed, proxy rows)", 6000, 4000, 6000, 3600),
+        ("5.4 MP to 90 % width (exact)", 3000, 1800, 2700, 1800),
+        ("1.5 MP to 70 % width (exact)", 1500, 1000, 1050, 1000),
+    ];
+    for (name, w, h, nw, nh) in cases {
+        if only.as_ref().is_some_and(|o| !name.contains(o.as_str())) {
+            continue;
+        }
+        let img = photo(w, h);
+        let mut times = Vec::with_capacity(reps);
+        let mut hash = 0;
+        for _ in 0..reps {
+            let t = Instant::now();
+            let out = carve(w, h, 4, &img, None, nw, nh);
+            times.push(t.elapsed().as_secs_f64() * 1000.0);
+            hash = fnv(&out);
+        }
+        times.sort_by(f64::total_cmp);
+        let p50 = times[times.len() / 2];
+        let max = times[times.len() - 1];
+        println!("{name:<48} p50 {p50:>9.1} ms  max {max:>9.1} ms  output {hash:016x}");
+    }
+}
diff --git a/crates/algo/src/art_history.rs b/crates/algo/src/art_history.rs
new file mode 100644
index 0000000000..7fcb286c22
--- /dev/null
+++ b/crates/algo/src/art_history.rs
@@ -0,0 +1,1053 @@
+//! Oriented history-state dabs: sample a snapshot patch, pose it along the stroke, and stamp.
+//!
+//! Tile processing reads each dab's rotated source straight from the history state, so a dab
+//! that crosses a tile edge paints the same as an untiled pass. Scatter is seeded, so the same
+//! stroke is replayable.
+
+#![allow(clippy::needless_range_loop)]
+
+/// Mixes the history-state index into dab scatter so two documents with different snapshots diverge.
+pub const RNG_SEED: u32 = 0xA7B1_57E0;
+
+/// Largest number of dabs one stroke may emit.
+pub const MAX_DABS: usize = 4096;
+
+/// Largest coverage rectangle, in pixels, a stroke may allocate.
+pub const MAX_COVERAGE: u64 = 4096 * 4096;
+
+/// Why [`stamp`] refused to write.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum StampError {
+    /// A zero-sized buffer, no dabs, or nothing to cover.
+    Empty,
+    /// Source and destination disagree on channel count.
+    Mismatched,
+    /// The read/write window would exceed [`MAX_COVERAGE`].
+    TooLarge,
+}
+
+/// Named dab layout. Multipliers are documented in the command params; keep them stable.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Style {
+    TightShort,
+    TightMedium,
+    TightLong,
+    LooseMedium,
+    LooseLong,
+    Dab,
+    TightCurl,
+    LooseCurl,
+}
+
+impl Style {
+    /// Parse a command-style identifier (`tightMedium`, …).
+    pub fn parse(name: &str) -> Option<Self> {
+        Some(match name {
+            "tightShort" => Self::TightShort,
+            "tightMedium" => Self::TightMedium,
+            "tightLong" => Self::TightLong,
+            "looseMedium" => Self::LooseMedium,
+            "looseLong" => Self::LooseLong,
+            "dab" => Self::Dab,
+            "tightCurl" => Self::TightCurl,
+            "looseCurl" => Self::LooseCurl,
+            _ => return None,
+        })
+    }
+
+    /// Stable id used in command params.
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::TightShort => "tightShort",
+            Self::TightMedium => "tightMedium",
+            Self::TightLong => "tightLong",
+            Self::LooseMedium => "looseMedium",
+            Self::LooseLong => "looseLong",
+            Self::Dab => "dab",
+            Self::TightCurl => "tightCurl",
+            Self::LooseCurl => "looseCurl",
+        }
+    }
+
+    fn spacing_mul(self) -> f32 {
+        match self {
+            Self::TightShort => 0.35,
+            Self::TightMedium => 0.55,
+            Self::TightLong => 0.85,
+            Self::LooseMedium => 0.70,
+            Self::LooseLong => 1.10,
+            Self::Dab => 1.60,
+            Self::TightCurl => 0.50,
+            Self::LooseCurl => 0.80,
+        }
+    }
+
+    fn scatter_mul(self) -> f32 {
+        match self {
+            Self::TightShort => 0.00,
+            Self::TightMedium => 0.00,
+            Self::TightLong => 0.05,
+            Self::LooseMedium => 0.45,
+            Self::LooseLong => 0.70,
+            Self::Dab => 0.10,
+            Self::TightCurl => 0.05,
+            Self::LooseCurl => 0.40,
+        }
+    }
+
+    fn curl_deg(self) -> f32 {
+        match self {
+            Self::TightCurl => 18.0,
+            Self::LooseCurl => 28.0,
+            _ => 0.0,
+        }
+    }
+
+    fn size_mul(self) -> f32 {
+        match self {
+            Self::TightShort => 0.7,
+            Self::TightMedium => 0.9,
+            Self::TightLong => 1.1,
+            Self::LooseMedium => 1.0,
+            Self::LooseLong => 1.2,
+            Self::Dab => 1.0,
+            Self::TightCurl => 0.9,
+            Self::LooseCurl => 1.1,
+        }
+    }
+}
+
+/// One posed dab in document pixels.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Dab {
+    pub x: f32,
+    pub y: f32,
+    pub theta: f32,
+    pub radius: f32,
+    pub pressure: f32,
+}
+
+/// Spacing along the stroke, in pixels.
+pub fn spacing_px(size: f32, area: f32, style: Style) -> Option<f32> {
+    if !(size.is_finite() && area.is_finite()) || size <= 0.0 {
+        return None;
+    }
+    let s = size * style.spacing_mul() * (0.25 + 0.02 * area);
+    if s.is_finite() && s > 0.0 { Some(s) } else { None }
+}
+
+/// Reach of a dab around its stroke point: half the dab plus its scatter, plus a margin.
+pub fn halo_radius(size: f32, style: Style) -> Option<i32> {
+    if !size.is_finite() || size <= 0.0 {
+        return None;
+    }
+    let v = (size * style.size_mul() / 2.0 + style.scatter_mul() * size + 2.0).ceil();
+    if !v.is_finite() || v > 1_000_000.0 {
+        return None;
+    }
+    Some(v as i32)
+}
+
+/// Side of the rotated source square (`ceil(size · size_mul) + 2`).
+pub fn sample_side(size: f32, style: Style) -> Option<i32> {
+    if !size.is_finite() || size <= 0.0 {
+        return None;
+    }
+    let v = (size * style.size_mul()).ceil() + 2.0;
+    if !v.is_finite() || v > 1_000_000.0 {
+        return None;
+    }
+    Some(v as i32)
+}
+
+fn mix32(seed: u32, dab: u32, lane: u32) -> u32 {
+    let mut x = seed ^ dab.wrapping_mul(0x9E37_79B9) ^ lane.wrapping_mul(0x85EB_CA6B);
+    x = x.wrapping_add(0x9E37_79B9);
+    x ^= x >> 16;
+    x = x.wrapping_mul(0x7FEB_352D);
+    x ^= x >> 15;
+    x = x.wrapping_mul(0x846C_A68B);
+    x ^= x >> 16;
+    x
+}
+
+fn signed01(seed: u32, dab: u32, lane: u32) -> f32 {
+    let u = mix32(seed, dab, lane) >> 8;
+    (u as f32) * (2.0 / 16_777_215.0) - 1.0
+}
+
+fn dab_radius(size: f32, style: Style) -> Option<f32> {
+    let r = size * style.size_mul() * 0.5;
+    if r.is_finite() && r > 0.0 { Some(r) } else { None }
+}
+
+/// Walk `points` and emit posed dabs. `seed` is typically [`RNG_SEED`] XOR the history index.
+pub fn place_dabs(points: &[[f32; 2]], size: f32, area: f32, style: Style, seed: u32) -> Result<Vec<Dab>, StampError> {
+    if points.is_empty() {
+        return Err(StampError::Empty);
+    }
+    let spacing = spacing_px(size, area, style).ok_or(StampError::Empty)?;
+    let radius = dab_radius(size, style).ok_or(StampError::TooLarge)?;
+    let curl = style.curl_deg().to_radians();
+    let scatter = style.scatter_mul();
+    let mut out = Vec::new();
+    let mut emit = |i: u32, x: f32, y: f32, tx: f32, ty: f32, pressure: f32| -> Result<(), StampError> {
+        if !(x.is_finite() && y.is_finite() && tx.is_finite() && ty.is_finite()) {
+            return Err(StampError::Empty);
+        }
+        let u = signed01(seed, i, 1);
+        let v = signed01(seed, i, 2);
+        let w = signed01(seed, i, 3);
+        let dx = scatter * size * u;
+        let dy = scatter * size * v;
+        let (cx, cy) = (x + dx, y + dy);
+        if !(cx.is_finite() && cy.is_finite()) {
+            return Err(StampError::TooLarge);
+        }
+        let theta = ty.atan2(tx) + (i as f32) * curl + scatter * w;
+        if !theta.is_finite() {
+            return Err(StampError::Empty);
+        }
+        if out.len() >= MAX_DABS {
+            return Err(StampError::TooLarge);
+        }
+        out.push(Dab { x: cx, y: cy, theta, radius, pressure: pressure.clamp(0.0, 1.0) });
+        Ok(())
+    };
+
+    let Some(first) = points.first() else {
+        return Err(StampError::Empty);
+    };
+    if !first[0].is_finite() || !first[1].is_finite() {
+        return Err(StampError::Empty);
+    }
+    let (mut px, mut py) = (first[0], first[1]);
+    let (mut tx, mut ty) = (1.0f32, 0.0f32);
+    if let Some(second) = points.get(1) {
+        tx = second[0] - px;
+        ty = second[1] - py;
+        if tx == 0.0 && ty == 0.0 {
+            tx = 1.0;
+        }
+    }
+    emit(0, px, py, tx, ty, 1.0)?;
+
+    let mut carry = 0.0f32;
+    let mut i = 1u32;
+    for w in points.windows(2) {
+        let (Some(a), Some(b)) = (w.first(), w.get(1)) else { continue };
+        if !(a[0].is_finite() && a[1].is_finite() && b[0].is_finite() && b[1].is_finite()) {
+            return Err(StampError::Empty);
+        }
+        let (dx, dy) = (b[0] - a[0], b[1] - a[1]);
+        let len = dx.hypot(dy);
+        if !len.is_finite() {
+            return Err(StampError::Empty);
+        }
+        if len < 1.0e-6 {
+            continue;
+        }
+        tx = dx;
+        ty = dy;
+        let mut consumed = 0.0f32;
+        while carry + (len - consumed) >= spacing {
+            let need = spacing - carry;
+            if !need.is_finite() || need < 0.0 {
+                return Err(StampError::Empty);
+            }
+            consumed += need;
+            if consumed > len {
+                break;
+            }
+            let t = consumed / len;
+            px = a[0] + dx * t;
+            py = a[1] + dy * t;
+            emit(i, px, py, tx, ty, 1.0)?;
+            i = i.saturating_add(1);
+            carry = 0.0;
+        }
+        carry += len - consumed;
+        if !carry.is_finite() {
+            return Err(StampError::Empty);
+        }
+    }
+    if out.is_empty() { Err(StampError::Empty) } else { Ok(out) }
+}
+
+/// Bounding rectangle of a dab, in document pixels (1 px of anti-alias slack).
+pub fn dab_bounds(dab: &Dab) -> Option<(i32, i32, i32, i32)> {
+    let r = dab.radius + 1.0;
+    if !r.is_finite() {
+        return None;
+    }
+    let x0 = (dab.x - r).floor();
+    let y0 = (dab.y - r).floor();
+    let x1 = (dab.x + r).ceil();
+    let y1 = (dab.y + r).ceil();
+    if !(x0.is_finite() && y0.is_finite() && x1.is_finite() && y1.is_finite()) {
+        return None;
+    }
+    let clamp = |v: f32| v.clamp(i32::MIN as f32, i32::MAX as f32) as i32;
+    Some((clamp(x0), clamp(y0), clamp(x1), clamp(y1)))
+}
+
+fn coverage_at(dab: &Dab, x: i32, y: i32, hardness: f32) -> f32 {
+    let dx = x as f32 + 0.5 - dab.x;
+    let dy = y as f32 + 0.5 - dab.y;
+    let d = dx.hypot(dy);
+    if !d.is_finite() || d >= dab.radius + 0.5 {
+        return 0.0;
+    }
+    let edge = (dab.radius + 0.5 - d).clamp(0.0, 1.0);
+    let h = hardness.clamp(0.0, 1.0);
+    let inner = dab.radius * h;
+    let falloff = if d <= inner || dab.radius - inner < 1.0e-3 {
+        1.0
+    } else {
+        let t = ((d - inner) / (dab.radius - inner)).clamp(0.0, 1.0);
+        1.0 - t * t * (3.0 - 2.0 * t)
+    };
+    edge * falloff
+}
+
+fn pixel_index(x: usize, y: usize, w: usize, h: usize, ch: usize) -> Option<usize> {
+    if x >= w || y >= h || ch == 0 {
+        return None;
+    }
+    y.checked_mul(w)?.checked_add(x)?.checked_mul(ch)
+}
+
+fn origin_index(origin: (i32, i32), x: i32, y: i32, w: usize, h: usize, ch: usize) -> Option<usize> {
+    let dx = x.checked_sub(origin.0)?;
+    let dy = y.checked_sub(origin.1)?;
+    pixel_index(usize::try_from(dx).ok()?, usize::try_from(dy).ok()?, w, h, ch)
+}
+
+fn floor_i32(v: f32) -> i32 {
+    v.clamp(-2_147_483_648.0, 2_147_483_647.0).floor() as i32
+}
+
+struct SrcView<'a> {
+    data: &'a [f32],
+    w: usize,
+    h: usize,
+    origin: (i32, i32),
+    ch: usize,
+}
+
+fn sample_bilinear(src: SrcView<'_>, sx: f32, sy: f32, out: &mut [f32]) -> bool {
+    let ch = src.ch;
+    if ch == 0 || out.len() < ch {
+        return false;
+    }
+    let dst = &mut out[..ch];
+    dst.fill(0.0);
+    if !(sx.is_finite() && sy.is_finite()) {
+        return false;
+    }
+    // `sx, sy` are continuous coordinates; pixel `i` has its centre at `i + 0.5`.
+    let lx = sx - src.origin.0 as f32 - 0.5;
+    let ly = sy - src.origin.1 as f32 - 0.5;
+    if !(lx.is_finite() && ly.is_finite()) {
+        return false;
+    }
+    let x0 = floor_i32(lx);
+    let y0 = floor_i32(ly);
+    let fx = (lx - x0 as f32).clamp(0.0, 1.0);
+    let fy = (ly - y0 as f32).clamp(0.0, 1.0);
+    let mut any = false;
+    for (iy, wy) in [(0i32, 1.0 - fy), (1i32, fy)] {
+        for (ix, wx) in [(0i32, 1.0 - fx), (1i32, fx)] {
+            let wt = wx * wy;
+            if wt <= 0.0 {
+                continue;
+            }
+            let px = x0.saturating_add(ix);
+            let py = y0.saturating_add(iy);
+            if px < 0 || py < 0 {
+                continue;
+            }
+            let (Ok(ux), Ok(uy)) = (usize::try_from(px), usize::try_from(py)) else { continue };
+            let Some(base) = pixel_index(ux, uy, src.w, src.h, ch) else { continue };
+            let Some(pxs) = src.data.get(base..base.saturating_add(ch)) else { continue };
+            for (d, s) in dst.iter_mut().zip(pxs.iter()) {
+                *d += *s * wt;
+            }
+            any = true;
+        }
+    }
+    any
+}
+
+fn rotated_source(dab: &Dab, x: i32, y: i32) -> (f32, f32) {
+    let dx = x as f32 + 0.5 - dab.x;
+    let dy = y as f32 + 0.5 - dab.y;
+    let (c, s) = (dab.theta.cos(), dab.theta.sin());
+    (dab.x + c * dx + s * dy, dab.y - s * dx + c * dy)
+}
+
+fn over_native(dst: &mut [f32], src: &[f32], k: f32, alpha: Option<usize>, lock: bool) {
+    if k <= 0.0 {
+        return;
+    }
+    match alpha {
+        Some(a) => {
+            let Some((&da, &sa0)) = dst.get(a).zip(src.get(a)) else { return };
+            let sa = sa0 * k;
+            let oa = sa + da * (1.0 - sa);
+            if oa > 0.0 {
+                for c in 0..a {
+                    let Some(d) = dst.get_mut(c) else { continue };
+                    let Some(&s) = src.get(c) else { continue };
+                    *d = (s * sa + *d * da * (1.0 - sa)) / oa;
+                }
+            }
+            if !lock && let Some(d) = dst.get_mut(a) {
+                *d = oa;
+            }
+        }
+        None => {
+            for (d, s) in dst.iter_mut().zip(src.iter()) {
+                *d += (*s - *d) * k;
+            }
+        }
+    }
+}
+
+fn buf_len(w: usize, h: usize, ch: usize) -> Option<usize> {
+    w.checked_mul(h)?.checked_mul(ch)
+}
+
+/// Parameters for [`stamp`].
+pub struct StampParams<'a> {
+    pub dest: &'a mut [f32],
+    pub dest_w: usize,
+    pub dest_h: usize,
+    pub dest_origin: (i32, i32),
+    pub src: &'a [f32],
+    pub src_w: usize,
+    pub src_h: usize,
+    pub src_origin: (i32, i32),
+    pub ch: usize,
+    pub dabs: &'a [Dab],
+    pub hardness: f32,
+    pub opacity: f32,
+    pub flow: f32,
+    pub tolerance: f32,
+    /// Destination tile edge; `0` processes the whole buffer as one tile.
+    pub tile: i32,
+    pub selection: Option<&'a [f32]>,
+    pub lock_transparent: bool,
+    pub alpha: Option<usize>,
+}
+
+fn dest_pixels(p: &StampParams<'_>) -> Result<u64, StampError> {
+    let n = buf_len(p.dest_w, p.dest_h, p.ch).ok_or(StampError::TooLarge)?;
+    if p.dest.len() < n {
+        return Err(StampError::Empty);
+    }
+    let sn = buf_len(p.src_w, p.src_h, p.ch).ok_or(StampError::TooLarge)?;
+    if p.src.len() < sn {
+        return Err(StampError::Empty);
+    }
+    if p.ch == 0 || p.dest_w == 0 || p.dest_h == 0 {
+        return Err(StampError::Empty);
+    }
+    Ok(n as u64)
+}
+
+fn tile_grid(w: usize, h: usize, origin: (i32, i32), tile: i32) -> Vec<(i32, i32, i32, i32)> {
+    let (x0, y0) = origin;
+    let x1 = x0.saturating_add(w.min(i32::MAX as usize) as i32);
+    let y1 = y0.saturating_add(h.min(i32::MAX as usize) as i32);
+    if tile <= 0 {
+        return vec![(x0, y0, x1, y1)];
+    }
+    let mut tiles = Vec::new();
+    let mut y = y0;
+    while y < y1 {
+        let ny = y.saturating_add(tile).min(y1);
+        let mut x = x0;
+        while x < x1 {
+            let nx = x.saturating_add(tile).min(x1);
+            tiles.push((x, y, nx, ny));
+            x = nx;
+        }
+        y = ny;
+    }
+    tiles
+}
+
+fn stamp_dab_on_rect(p: &mut StampParams<'_>, dab: &Dab, rect: (i32, i32, i32, i32)) -> Result<u32, StampError> {
+    let (x0, y0, x1, y1) = rect;
+    if x1 <= x0 || y1 <= y0 {
+        return Ok(0);
+    }
+    let Some(tw) = (x1 as i64 - x0 as i64).try_into().ok().filter(|w: &usize| *w > 0) else {
+        return Err(StampError::TooLarge);
+    };
+    let Some(th) = (y1 as i64 - y0 as i64).try_into().ok().filter(|h: &usize| *h > 0) else {
+        return Err(StampError::TooLarge);
+    };
+    let area = (tw as u64).saturating_mul(th as u64);
+    if area > MAX_COVERAGE {
+        return Err(StampError::TooLarge);
+    }
+    let n = tw.checked_mul(th).and_then(|m| m.checked_mul(p.ch)).ok_or(StampError::TooLarge)?;
+    let mut local = vec![0.0f32; n];
+    let mut cov = vec![0.0f32; tw.checked_mul(th).ok_or(StampError::TooLarge)?];
+    // Copy dest tile into local.
+    for y in y0..y1 {
+        for x in x0..x1 {
+            let lx = (x - x0) as usize;
+            let ly = (y - y0) as usize;
+            let Some(di) = origin_index(p.dest_origin, x, y, p.dest_w, p.dest_h, p.ch) else { continue };
+            let Some(li) = pixel_index(lx, ly, tw, th, p.ch) else { continue };
+            if let (Some(dst), Some(src)) = (local.get_mut(li..li + p.ch), p.dest.get(di..di + p.ch)) {
+                dst.copy_from_slice(src);
+            }
+            if let Some(c) = cov.get_mut(ly.saturating_mul(tw).saturating_add(lx)) {
+                *c = coverage_at(dab, x, y, p.hardness);
+            }
+        }
+    }
+
+    // The rotated read keeps the distance to the dab centre, so it stays inside the dab's bounds:
+    // sample the source directly, whichever tile the destination pixel is in.
+    let mut sampled = vec![0.0f32; p.ch];
+    let mut written = 0u32;
+    let k_stroke = (p.opacity * p.flow * dab.pressure).clamp(0.0, 1.0);
+    for y in y0..y1 {
+        for x in x0..x1 {
+            let lx = (x - x0) as usize;
+            let ly = (y - y0) as usize;
+            let Some(&c) = cov.get(ly.saturating_mul(tw).saturating_add(lx)) else { continue };
+            if c <= 0.0 {
+                continue;
+            }
+            let mut k = c * k_stroke;
+            if let Some(sel) = p.selection {
+                let Some(si) = origin_index(p.dest_origin, x, y, p.dest_w, p.dest_h, 1) else { continue };
+                let Some(&sv) = sel.get(si) else { continue };
+                k *= sv.clamp(0.0, 1.0);
+            }
+            if k <= 0.0 {
+                continue;
+            }
+            let (sx, sy) = rotated_source(dab, x, y);
+            if !sample_bilinear(SrcView { data: p.src, w: p.src_w, h: p.src_h, origin: p.src_origin, ch: p.ch }, sx, sy, &mut sampled) {
+                continue;
+            }
+            let Some(li) = pixel_index(lx, ly, tw, th, p.ch) else { continue };
+            let Some(dst) = local.get_mut(li..li + p.ch) else { continue };
+            if p.lock_transparent && p.alpha.is_some_and(|a| dst.get(a).is_some_and(|&v| v <= 0.0)) {
+                continue;
+            }
+            over_native(dst, &sampled, k, p.alpha, p.lock_transparent);
+            written = written.saturating_add(1);
+        }
+    }
+
+    // Write the dest tile back.
+    for y in y0..y1 {
+        for x in x0..x1 {
+            let lx = (x - x0) as usize;
+            let ly = (y - y0) as usize;
+            let Some(di) = origin_index(p.dest_origin, x, y, p.dest_w, p.dest_h, p.ch) else { continue };
+            let Some(li) = pixel_index(lx, ly, tw, th, p.ch) else { continue };
+            if let (Some(dst), Some(src)) = (p.dest.get_mut(di..di + p.ch), local.get(li..li + p.ch)) {
+                dst.copy_from_slice(src);
+            }
+        }
+    }
+    Ok(written)
+}
+
+fn dab_intersects(dab: &Dab, tile: (i32, i32, i32, i32)) -> bool {
+    let Some((x0, y0, x1, y1)) = dab_bounds(dab) else { return false };
+    x0 < tile.2 && x1 > tile.0 && y0 < tile.3 && y1 > tile.1
+}
+
+/// Mean difference between `src` and `dest` over the dab's covered pixels (working-space peak is
+/// 1, so a tolerance of 50% is `0.5`). Per pixel it is the larger of the mean colour change and the
+/// alpha change: an opaque pixel's unchanged alpha must not water a colour change down, and the
+/// Eraser keeps the colour and lowers only the alpha. `None` if nothing is covered.
+fn dab_mean_diff(p: &StampParams<'_>, dab: &Dab) -> Option<f32> {
+    let (x0, y0, x1, y1) = dab_bounds(dab)?;
+    let mut sampled = vec![0.0f32; p.ch];
+    let mut sum = 0.0f32;
+    let mut count = 0u32;
+    for y in y0..y1 {
+        for x in x0..x1 {
+            if coverage_at(dab, x, y, p.hardness) <= 0.0 {
+                continue;
+            }
+            let Some(di) = origin_index(p.dest_origin, x, y, p.dest_w, p.dest_h, p.ch) else { continue };
+            let Some(dst) = p.dest.get(di..di.saturating_add(p.ch)) else { continue };
+            let (sx, sy) = rotated_source(dab, x, y);
+            if !sample_bilinear(SrcView { data: p.src, w: p.src_w, h: p.src_h, origin: p.src_origin, ch: p.ch }, sx, sy, &mut sampled) {
+                continue;
+            }
+            let nch = p.ch.min(dst.len()).min(sampled.len());
+            if nch == 0 {
+                continue;
+            }
+            let (mut colour, mut colours, mut alpha) = (0.0f32, 0u32, 0.0f32);
+            for i in 0..nch {
+                let Some((&s, &d)) = sampled.get(i).zip(dst.get(i)) else { continue };
+                if p.alpha == Some(i) {
+                    alpha = (s - d).abs();
+                } else {
+                    colour += (s - d).abs();
+                    colours += 1;
+                }
+            }
+            let colour = if colours == 0 { 0.0 } else { colour / colours as f32 };
+            sum += colour.max(alpha);
+            count = count.saturating_add(1);
+        }
+    }
+    if count == 0 {
+        return None;
+    }
+    let mean = sum / count as f32;
+    mean.is_finite().then_some(mean)
+}
+
+/// Stamp posed dabs into `dest`, tile by tile, reading `src` at each dab's rotated positions.
+///
+/// Sequential dabs overlap: dab *n* sees dab *n − 1*. Returns how many destination pixels were
+/// written (tolerance-skipped dabs count as zero).
+pub fn stamp(p: &mut StampParams<'_>) -> Result<u32, StampError> {
+    dest_pixels(p)?;
+    if p.src_w == 0 || p.src_h == 0 {
+        return Err(StampError::Empty);
+    }
+    if p.dabs.is_empty() {
+        return Err(StampError::Empty);
+    }
+    let dest_area = (p.dest_w as u64).saturating_mul(p.dest_h as u64);
+    if dest_area > MAX_COVERAGE {
+        return Err(StampError::TooLarge);
+    }
+    let tiles = tile_grid(p.dest_w, p.dest_h, p.dest_origin, p.tile);
+    let mut written = 0u32;
+    let dabs: Vec<Dab> = p.dabs.to_vec();
+    for dab in &dabs {
+        let Some(bounds) = dab_bounds(dab) else { continue };
+        if p.tolerance > 0.0 && dab_mean_diff(p, dab).is_some_and(|m| m < p.tolerance) {
+            continue;
+        }
+        let overlapping: Vec<(i32, i32, i32, i32)> = tiles.iter().copied().filter(|t| dab_intersects(dab, *t)).collect();
+        if overlapping.is_empty() {
+            continue;
+        }
+        // Sequential tiles: each writes dest before the next dab. Parallel tiles of one dab do not
+        // share destination pixels, so they can run independently; we still apply them in order
+        // here so overlapping dabs stay deterministic.
+        for tile in overlapping {
+            let (bx0, by0, bx1, by1) = bounds;
+            let dest_rect = (tile.0.max(bx0), tile.1.max(by0), tile.2.min(bx1), tile.3.min(by1));
+            written = written.saturating_add(stamp_dab_on_rect(p, dab, dest_rect)?);
+        }
+    }
+    Ok(written)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn fill(w: usize, h: usize, ch: usize, f: impl Fn(i32, i32, usize) -> f32) -> Vec<f32> {
+        let mut v = vec![0.0; w * h * ch];
+        for y in 0..h {
+            for x in 0..w {
+                for c in 0..ch {
+                    v[(y * w + x) * ch + c] = f(x as i32, y as i32, c);
+                }
+            }
+        }
+        v
+    }
+
+    fn horizontal(len: f32) -> Vec<[f32; 2]> {
+        vec![[10.0, 32.0], [10.0 + len, 32.0]]
+    }
+
+    #[test]
+    fn tight_short_emits_more_dabs_than_tight_long() {
+        let pts = horizontal(100.0);
+        let short = place_dabs(&pts, 10.0, 50.0, Style::TightShort, RNG_SEED).unwrap();
+        let long = place_dabs(&pts, 10.0, 50.0, Style::TightLong, RNG_SEED).unwrap();
+        assert!(short.len() > long.len(), "short {} long {}", short.len(), long.len());
+        let s = spacing_px(10.0, 50.0, Style::TightShort).unwrap();
+        let l = spacing_px(10.0, 50.0, Style::TightLong).unwrap();
+        assert!(s < l, "{s} {l}");
+    }
+
+    #[test]
+    fn tight_curl_angles_increase_and_loose_curl_scatters() {
+        let pts = horizontal(80.0);
+        let tight = place_dabs(&pts, 12.0, 50.0, Style::TightCurl, RNG_SEED).unwrap();
+        let loose = place_dabs(&pts, 12.0, 50.0, Style::LooseCurl, RNG_SEED).unwrap();
+        assert!(tight.len() >= 3 && loose.len() >= 3);
+        let dt: Vec<f32> = tight.windows(2).map(|w| w[1].theta - w[0].theta).collect();
+        assert!(dt.iter().all(|d| *d > 0.05), "tight curl steps {dt:?}");
+        let dl: Vec<f32> = loose.windows(2).map(|w| w[1].theta - w[0].theta).collect();
+        let mean = |v: &[f32]| v.iter().sum::<f32>() / v.len() as f32;
+        assert!(mean(&dl) > mean(&dt), "loose curl {dl:?} vs tight {dt:?}");
+        let scatter_t: f32 = tight.iter().map(|d| (d.y - 32.0).abs()).sum();
+        let scatter_l: f32 = loose.iter().map(|d| (d.y - 32.0).abs()).sum();
+        assert!(scatter_l > scatter_t, "loose scatter {scatter_l} tight {scatter_t}");
+    }
+
+    #[test]
+    fn seeded_scatter_is_replayable() {
+        let pts = horizontal(60.0);
+        let a = place_dabs(&pts, 16.0, 40.0, Style::LooseMedium, RNG_SEED ^ 3).unwrap();
+        let b = place_dabs(&pts, 16.0, 40.0, Style::LooseMedium, RNG_SEED ^ 3).unwrap();
+        assert_eq!(a, b);
+        let c = place_dabs(&pts, 16.0, 40.0, Style::LooseMedium, RNG_SEED ^ 4).unwrap();
+        assert_ne!(a, c);
+    }
+
+    fn fixture(ch: usize) -> (usize, usize, Vec<f32>, Vec<f32>, Dab) {
+        let (w, h) = (128usize, 96usize);
+        let src = fill(w, h, ch, |x, y, c| if c + 1 == ch && ch > 1 { 1.0 } else { ((x * 13 + y * 7 + c as i32 * 3).rem_euclid(251) as f32) / 255.0 });
+        let dest0 = fill(w, h, ch, |_, _, c| if c + 1 == ch && ch > 1 { 1.0 } else { 0.1 });
+        // Centre 1 px inside a 64-tile so the rotated read crosses the seam.
+        let dab = Dab { x: 63.0, y: 40.0, theta: 0.4, radius: 18.0, pressure: 1.0 };
+        (w, h, src, dest0, dab)
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn stamp_run(w: usize, h: usize, ch: usize, src: &[f32], dest: &mut [f32], dab: &Dab, tile: i32) -> u32 {
+        stamp_dabs(w, h, ch, src, dest, std::slice::from_ref(dab), tile)
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn stamp_dabs(w: usize, h: usize, ch: usize, src: &[f32], dest: &mut [f32], dabs: &[Dab], tile: i32) -> u32 {
+        let mut p = StampParams {
+            dest,
+            dest_w: w,
+            dest_h: h,
+            dest_origin: (0, 0),
+            src,
+            src_w: w,
+            src_h: h,
+            src_origin: (0, 0),
+            ch,
+            dabs,
+            hardness: 1.0,
+            opacity: 1.0,
+            flow: 1.0,
+            tolerance: 0.0,
+            tile,
+            selection: None,
+            lock_transparent: false,
+            alpha: (ch > 1).then_some(ch - 1),
+        };
+        stamp(&mut p).unwrap()
+    }
+
+    fn max_abs(a: &[f32], b: &[f32]) -> f32 {
+        a.iter().zip(b).fold(0.0f32, |m, (x, y)| m.max((x - y).abs()))
+    }
+
+    fn max_u8(a: &[f32], b: &[f32]) -> i32 {
+        a.iter()
+            .zip(b)
+            .map(|(x, y)| {
+                let q = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as i32;
+                (q(*x) - q(*y)).abs()
+            })
+            .max()
+            .unwrap_or(0)
+    }
+
+    #[test]
+    fn tiled_stamp_matches_untiled_at_a_tile_seam() {
+        let (w, h, src, dest0, dab) = fixture(4);
+        let mut tiled = dest0.clone();
+        let mut flat = dest0.clone();
+        let n_t = stamp_run(w, h, 4, &src, &mut tiled, &dab, 64);
+        let n_f = stamp_run(w, h, 4, &src, &mut flat, &dab, 0);
+        assert!(n_t > 0 && n_f > 0, "wrote {n_t} tiled / {n_f} flat");
+        assert_eq!(max_u8(&tiled, &flat), 0, "8-bit seam");
+        assert!(max_abs(&tiled, &flat) <= 1.0 / 32_767.0, "16-bit seam {}", max_abs(&tiled, &flat));
+        assert!(max_abs(&tiled, &flat) <= 1.0e-5, "32f seam {}", max_abs(&tiled, &flat));
+
+        let (w, h, src, dest0, dab) = fixture(1);
+        let mut tiled = dest0.clone();
+        let mut flat = dest0;
+        stamp_run(w, h, 1, &src, &mut tiled, &dab, 64);
+        stamp_run(w, h, 1, &src, &mut flat, &dab, 0);
+        assert_eq!(max_u8(&tiled, &flat), 0, "gray 8-bit seam");
+    }
+
+    #[test]
+    fn leftward_and_curl_strokes_match_untiled_across_a_tile_edge() {
+        let (w, h, ch) = (128usize, 96usize, 4);
+        let src = fill(w, h, ch, |x, y, c| if c == 3 { 1.0 } else { ((x * 13 + y * 7 + c as i32 * 3).rem_euclid(251) as f32) / 255.0 });
+        let dest0 = fill(w, h, ch, |_, _, c| if c == 3 { 1.0 } else { 0.1 });
+        for style in [Style::TightMedium, Style::TightCurl, Style::LooseCurl] {
+            let dabs = place_dabs(&[[110.0, 40.0], [20.0, 40.0]], 40.0, 50.0, style, RNG_SEED).unwrap();
+            let mut tiled = dest0.clone();
+            let mut flat = dest0.clone();
+            stamp_dabs(w, h, ch, &src, &mut tiled, &dabs, 64);
+            stamp_dabs(w, h, ch, &src, &mut flat, &dabs, 0);
+            assert_eq!(max_abs(&tiled, &flat), 0.0, "{} seam at x = 64", style.as_str());
+        }
+    }
+
+    /// A dab at angle 0 copies the history pixel under each covered pixel, not a blend of it
+    /// and its lower-right neighbours.
+    #[test]
+    fn unrotated_dab_restores_the_source_pixel() {
+        let (w, h, ch) = (48usize, 48usize, 4);
+        let src = fill(w, h, ch, |x, y, c| if c == 3 { 1.0 } else { ((x * 37 + y * 11 + c as i32 * 5).rem_euclid(97) as f32) / 96.0 });
+        let mut dest = fill(w, h, ch, |_, _, c| if c == 3 { 1.0 } else { 0.5 });
+        let dab = Dab { x: 24.0, y: 24.0, theta: 0.0, radius: 8.0, pressure: 1.0 };
+        stamp_run(w, h, ch, &src, &mut dest, &dab, 0);
+        for (x, y) in [(24usize, 24usize), (20, 22), (27, 26)] {
+            let i = (y * w + x) * ch;
+            assert_eq!(&dest[i..i + ch], &src[i..i + ch], "pixel {x},{y}");
+        }
+    }
+
+    #[test]
+    fn halo_covers_rotated_read_reach() {
+        let size = 40.0;
+        for style in
+            [Style::TightShort, Style::TightMedium, Style::TightLong, Style::LooseMedium, Style::LooseLong, Style::Dab, Style::TightCurl, Style::LooseCurl]
+        {
+            let halo = halo_radius(size, style).unwrap();
+            let side = sample_side(size, style).unwrap();
+            let reach = (side + 1) / 2;
+            assert!(halo >= reach, "{:?}: halo {halo} < reach {reach} (side {side})", style.as_str());
+        }
+    }
+
+    #[test]
+    fn tolerance_skips_an_unchanged_layer() {
+        let (w, h, ch) = (48usize, 48usize, 4);
+        let src = fill(w, h, ch, |x, y, c| if c == 3 { 1.0 } else { (x + y) as f32 / 100.0 });
+        let mut dest = src.clone();
+        let dab = Dab { x: 24.0, y: 24.0, theta: 0.0, radius: 8.0, pressure: 1.0 };
+        let mut p = StampParams {
+            dest: &mut dest,
+            dest_w: w,
+            dest_h: h,
+            dest_origin: (0, 0),
+            src: &src,
+            src_w: w,
+            src_h: h,
+            src_origin: (0, 0),
+            ch,
+            dabs: std::slice::from_ref(&dab),
+            hardness: 1.0,
+            opacity: 1.0,
+            flow: 1.0,
+            tolerance: 1.0,
+            tile: 0,
+            selection: None,
+            lock_transparent: false,
+            alpha: Some(3),
+        };
+        let n = stamp(&mut p).unwrap();
+        assert_eq!(n, 0);
+        assert_eq!(dest, src);
+    }
+
+    #[test]
+    fn tolerance_zero_writes_where_history_differs() {
+        let (w, h, ch) = (48usize, 48usize, 4);
+        let src = fill(w, h, ch, |_, _, c| if c == 3 { 1.0 } else { 0.9 });
+        let mut dest = fill(w, h, ch, |_, _, c| if c == 3 { 1.0 } else { 0.1 });
+        let dab = Dab { x: 24.0, y: 24.0, theta: 0.0, radius: 8.0, pressure: 1.0 };
+        let mut p = StampParams {
+            dest: &mut dest,
+            dest_w: w,
+            dest_h: h,
+            dest_origin: (0, 0),
+            src: &src,
+            src_w: w,
+            src_h: h,
+            src_origin: (0, 0),
+            ch,
+            dabs: std::slice::from_ref(&dab),
+            hardness: 1.0,
+            opacity: 1.0,
+            flow: 1.0,
+            tolerance: 0.0,
+            tile: 0,
+            selection: None,
+            lock_transparent: false,
+            alpha: Some(3),
+        };
+        let n = stamp(&mut p).unwrap();
+        assert!(n > 0);
+        let i = (24 * w + 24) * ch;
+        assert!((dest[i] - 0.9).abs() < 1.0e-5, "{}", dest[i]);
+    }
+
+    #[test]
+    fn tolerance_ignores_unchanged_alpha() {
+        // Colour moved by 0.3 and alpha did not: the 0.25 threshold must not see a 0.225 average.
+        let (w, h, ch) = (48usize, 48usize, 4);
+        let src = fill(w, h, ch, |_, _, c| if c == 3 { 1.0 } else { 0.6 });
+        let dest0 = fill(w, h, ch, |_, _, c| if c == 3 { 1.0 } else { 0.3 });
+        let dab = Dab { x: 24.0, y: 24.0, theta: 0.0, radius: 8.0, pressure: 1.0 };
+        for (tolerance, paints) in [(0.25, true), (0.35, false)] {
+            let mut dest = dest0.clone();
+            let mut p = StampParams {
+                dest: &mut dest,
+                dest_w: w,
+                dest_h: h,
+                dest_origin: (0, 0),
+                src: &src,
+                src_w: w,
+                src_h: h,
+                src_origin: (0, 0),
+                ch,
+                dabs: std::slice::from_ref(&dab),
+                hardness: 1.0,
+                opacity: 1.0,
+                flow: 1.0,
+                tolerance,
+                tile: 0,
+                selection: None,
+                lock_transparent: false,
+                alpha: Some(3),
+            };
+            let n = stamp(&mut p).unwrap();
+            assert_eq!(n > 0, paints, "tolerance {tolerance}");
+        }
+    }
+
+    /// The Eraser keeps the colour and lowers only the alpha: an erased patch differs from the
+    /// history state and is painted back with a tolerance above 0.
+    #[test]
+    fn tolerance_sees_an_erased_patch() {
+        let (w, h, ch) = (48usize, 48usize, 4);
+        let src = fill(w, h, ch, |_, _, c| if c == 0 || c == 3 { 1.0 } else { 0.0 });
+        let mut dest = fill(w, h, ch, |_, _, c| match c {
+            0 => 1.0,
+            3 => 0.6,
+            _ => 0.0,
+        });
+        let dab = Dab { x: 24.0, y: 24.0, theta: 0.0, radius: 8.0, pressure: 1.0 };
+        let mut p = StampParams {
+            dest: &mut dest,
+            dest_w: w,
+            dest_h: h,
+            dest_origin: (0, 0),
+            src: &src,
+            src_w: w,
+            src_h: h,
+            src_origin: (0, 0),
+            ch,
+            dabs: std::slice::from_ref(&dab),
+            hardness: 1.0,
+            opacity: 1.0,
+            flow: 1.0,
+            tolerance: 0.25,
+            tile: 0,
+            selection: None,
+            lock_transparent: false,
+            alpha: Some(3),
+        };
+        assert!(stamp(&mut p).unwrap() > 0, "alpha 1 -> 0.6 is over tolerance 0.25");
+        let i = (24 * w + 24) * ch;
+        assert!((dest[i + 3] - 1.0).abs() < 1.0e-5, "alpha restored, got {}", dest[i + 3]);
+    }
+    #[test]
+    fn empty_or_mismatched_buffers_error() {
+        let mut dest = vec![0.0f32; 16];
+        let src = vec![0.0f32; 16];
+        let dab = Dab { x: 1.0, y: 1.0, theta: 0.0, radius: 1.0, pressure: 1.0 };
+        let mut p = StampParams {
+            dest: &mut dest,
+            dest_w: 0,
+            dest_h: 4,
+            dest_origin: (0, 0),
+            src: &src,
+            src_w: 4,
+            src_h: 4,
+            src_origin: (0, 0),
+            ch: 1,
+            dabs: std::slice::from_ref(&dab),
+            hardness: 1.0,
+            opacity: 1.0,
+            flow: 1.0,
+            tolerance: 0.0,
+            tile: 0,
+            selection: None,
+            lock_transparent: false,
+            alpha: None,
+        };
+        assert_eq!(stamp(&mut p), Err(StampError::Empty));
+        let mut dest = vec![0.0f32; 16];
+        let src = vec![0.0f32; 8];
+        let mut p = StampParams {
+            dest: &mut dest,
+            dest_w: 4,
+            dest_h: 4,
+            dest_origin: (0, 0),
+            src: &src,
+            src_w: 2,
+            src_h: 2,
+            src_origin: (0, 0),
+            ch: 4,
+            dabs: std::slice::from_ref(&dab),
+            hardness: 1.0,
+            opacity: 1.0,
+            flow: 1.0,
+            tolerance: 0.0,
+            tile: 0,
+            selection: None,
+            lock_transparent: false,
+            alpha: None,
+        };
+        assert!(stamp(&mut p).is_err());
+        assert!(place_dabs(&[], 10.0, 50.0, Style::TightMedium, 0).is_err());
+        assert!(Style::parse("nope").is_none());
+        assert_eq!(Style::parse("tightMedium"), Some(Style::TightMedium));
+    }
+
+    #[test]
+    fn two_stamps_with_the_same_seed_match() {
+        let pts = horizontal(50.0);
+        let dabs = place_dabs(&pts, 12.0, 50.0, Style::LooseCurl, RNG_SEED).unwrap();
+        let (w, h, ch) = (80usize, 64usize, 4);
+        let src = fill(w, h, ch, |x, y, c| if c == 3 { 1.0 } else { (x + 3 * y) as f32 / 200.0 });
+        let dest0 = fill(w, h, ch, |_, _, c| if c == 3 { 1.0 } else { 0.2 });
+        let run = |dest: &mut [f32]| {
+            let mut p = StampParams {
+                dest,
+                dest_w: w,
+                dest_h: h,
+                dest_origin: (0, 0),
+                src: &src,
+                src_w: w,
+                src_h: h,
+                src_origin: (0, 0),
+                ch,
+                dabs: &dabs,
+                hardness: 0.8,
+                opacity: 1.0,
+                flow: 1.0,
+                tolerance: 0.0,
+                tile: 64,
+                selection: None,
+                lock_transparent: false,
+                alpha: Some(3),
+            };
+            stamp(&mut p).unwrap()
+        };
+        let mut a = dest0.clone();
+        let mut b = dest0;
+        assert_eq!(run(&mut a), run(&mut b));
+        assert_eq!(a, b);
+    }
+}
diff --git a/crates/algo/src/camera_raw.rs b/crates/algo/src/camera_raw.rs
index 3cadd1d20c..5bd0c8ab06 100644
--- a/crates/algo/src/camera_raw.rs
+++ b/crates/algo/src/camera_raw.rs
@@ -56,8 +56,11 @@ pub fn validate_curve(points: &[[f32; 2]]) -> Result<(), String> {
 use crate::photo_util::{hash01, linear_to_srgb, par_rows, srgb_to_linear};
 
 mod local_tone;
+mod per_pixel;
 mod whites_blacks;
 
+pub use per_pixel::{CURVE_LUT, Grade, Grain, PerPixel, Vignette, VignetteStyle, WB_STEPS, WhitesBlacks, per_pixel, white_black_points};
+
 /// How the pixels encode light: the sRGB curve (gamma 0) or a pure power law (ProPhoto's 1.8,
 /// Adobe RGB's 2.2). The tone controls work on light, so the document's own curve decodes it.
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -166,6 +169,13 @@ pub struct CameraRaw {
     /// The document's transfer curve: 0 for sRGB's, else the gamma of a power-law space (1.8
     /// for ProPhoto). Set from the document's profile; Whites and Blacks act on light.
     pub encoding_gamma: f32,
+    // Calibration (Camera Raw's Calibration panel)
+    /// Shadows › Tint: −100 (green) … 100 (magenta), strongest in the darkest tones.
+    pub shadow_tint: f32,
+    /// Red, Green and Blue Primary › Hue: −100 … 100, the primary turned towards its neighbours.
+    pub calibration_hue: [f32; 3],
+    /// Red, Green and Blue Primary › Saturation: −100 (grey) … 100 (purer).
+    pub calibration_sat: [f32; 3],
 }
 
 impl Default for CameraRaw {
@@ -222,6 +232,9 @@ impl Default for CameraRaw {
             seed: 0,
             pixel_scale: 1.0,
             encoding_gamma: 0.0,
+            shadow_tint: 0.0,
+            calibration_hue: [0.0; 3],
+            calibration_sat: [0.0; 3],
         }
     }
 }
@@ -229,6 +242,90 @@ impl Default for CameraRaw {
 /// Hue band centres of the Color Mixer (degrees).
 pub const HSL_BANDS: [f32; 8] = [0.0, 30.0, 60.0, 120.0, 180.0, 240.0, 270.0, 300.0];
 
+/// How far a primary turns at Hue ±100 (degrees), as the Color Mixer's hue sliders do.
+const CALIBRATION_TURN: f32 = 30.0;
+
+/// How much of each primary (red, green, blue) a hue is made of: triangular weights around
+/// 0°, 120° and 240° that sum to one, so a colour between two primaries follows both.
+pub fn calibration_weights(hue: f32) -> [f32; 3] {
+    let h = hue.rem_euclid(360.0);
+    let mut w = [0.0f32; 3];
+    for (i, centre) in [0.0f32, 120.0, 240.0].iter().enumerate() {
+        let d = (h - centre).abs().min(360.0 - (h - centre).abs());
+        w[i] = (1.0 - d / 120.0).max(0.0);
+    }
+    let sum: f32 = w.iter().sum();
+    if sum > 1e-6 { w.map(|v| v / sum) } else { [1.0, 0.0, 0.0] }
+}
+
+/// The Calibration panel's primaries on one linear-light pixel: its hue turns by the weighted
+/// Hue of the primaries it is made of (±100 is ±30°, positive towards the next primary) and its
+/// saturation scales by their weighted Saturation (−100 greys it); the luminance is kept, so
+/// neutrals are untouched.
+fn calibrate(c: [f32; 3], hue: [f32; 3], sat: [f32; 3]) -> [f32; 3] {
+    let [h, s, v] = rgb_to_hsv(c.map(|x| x.max(0.0)));
+    if s <= 1e-5 || v <= 1e-6 {
+        return c;
+    }
+    let w = calibration_weights(h);
+    let (mut dh, mut ds) = (0.0f32, 0.0f32);
+    for i in 0..3 {
+        dh += w[i] * hue[i].clamp(-100.0, 100.0);
+        ds += w[i] * sat[i].clamp(-100.0, 100.0);
+    }
+    let nh = h + dh / 100.0 * CALIBRATION_TURN;
+    let ns = (s * (1.0 + ds / 100.0)).clamp(0.0, 1.0);
+    let out = hsv_to_rgb(nh, ns, v);
+    let (l0, l1) = (luma(c), luma(out));
+    if l1 > 1e-6 { out.map(|x| x * l0 / l1) } else { out }
+}
+
+/// Shadows › Tint on one linear-light pixel: `tint` −1 (green) … 1 (magenta), weighted by how
+/// dark the pixel is; the luminance is kept.
+fn shadow_tint(c: [f32; 3], tint: f32) -> [f32; 3] {
+    let l = luma(c).max(0.0);
+    // Linear 0.18 is middle grey: full strength below it, fading out towards white.
+    let weight = (1.0 - (l / 0.18).sqrt().min(1.0)).powi(2) * 0.5 + (1.0 - l.min(1.0)).powi(4) * 0.5;
+    let k = tint * 0.12 * weight * (l + 0.02);
+    let o = [c[0] + k, c[1] - k, c[2] + k].map(|v| v.max(0.0));
+    let l2 = luma(o);
+    if l2 > 1e-6 { o.map(|v| v * l / l2) } else { o }
+}
+
+/// Camera Raw's Auto for the Light panel: Exposure, Contrast, Highlights, Shadows, Whites and
+/// Blacks from the image's luminance histogram (`px` in the document's encoding). A well
+/// exposed image gets near-zero settings; a dark one more exposure and lifted shadows; one
+/// with a crushed or blown end gets Blacks or Whites back from the edge. The other panels are
+/// left alone, as Camera Raw's Auto leaves them.
+pub fn auto_tone(px: &[[f32; 4]], p: &mut CameraRaw) {
+    if px.is_empty() {
+        return;
+    }
+    let mut lum: Vec<f32> = px.iter().map(|q| luma([q[0], q[1], q[2]]).clamp(0.0, 1.0)).collect();
+    lum.sort_by(|a, b| a.total_cmp(b));
+    let at = |f: f32| lum[((lum.len() - 1) as f32 * f).round() as usize];
+    let (black, shadow, median, light, white) = (at(0.001), at(0.1), at(0.5), at(0.9), at(0.999));
+    // Exposure: the median towards middle grey (sRGB 0.46), damped so flat scenes aren't
+    // forced to it.
+    let median_lin = srgb_to_linear(median).max(1e-4);
+    p.exposure = (0.6 * (0.18f32 / median_lin).log2()).clamp(-2.0, 2.0);
+    // Blacks and Whites bring the ends to the edges without clipping more than Camera Raw does.
+    p.blacks = ((0.04 - black) * 400.0).clamp(-40.0, 40.0);
+    p.whites = ((0.96 - white) * 300.0).clamp(-40.0, 40.0);
+    // Shadows up when the darker tenth is crushed, highlights down when the brighter tenth is
+    // near white.
+    p.shadows = ((0.25 - shadow) * 200.0).clamp(0.0, 50.0);
+    p.highlights = ((light - 0.85) * -300.0).clamp(-50.0, 0.0);
+    // A little contrast for a flat histogram.
+    let spread = (light - shadow).max(0.0);
+    p.contrast = ((0.6 - spread) * 60.0).clamp(0.0, 25.0);
+    // Shown as Camera Raw shows them: Exposure to a hundredth of a stop, the others whole.
+    p.exposure = (p.exposure * 100.0).round() / 100.0;
+    for v in [&mut p.blacks, &mut p.whites, &mut p.shadows, &mut p.highlights, &mut p.contrast] {
+        *v = v.round();
+    }
+}
+
 fn luma(c: [f32; 3]) -> f32 {
     0.2126 * c[0] + 0.7152 * c[1] + 0.0722 * c[2]
 }
@@ -534,6 +631,10 @@ impl CameraRaw {
     fn grade_neutral(&self) -> bool {
         self.grade_shadows.neutral() && self.grade_midtones.neutral() && self.grade_highlights.neutral() && self.grade_global.neutral()
     }
+    /// The Calibration panel at rest.
+    fn calibration_neutral(&self) -> bool {
+        self.shadow_tint == 0.0 && self.calibration_hue.iter().chain(&self.calibration_sat).all(|v| *v == 0.0)
+    }
     fn curves_neutral(&self) -> bool {
         [self.curve_highlights, self.curve_lights, self.curve_darks, self.curve_shadows].iter().all(|v| *v == 0.0)
             && [&self.point_curve, &self.point_curve_red, &self.point_curve_green, &self.point_curve_blue].iter().all(|c| is_linear(c))
@@ -541,6 +642,7 @@ impl CameraRaw {
     /// True when every control is neutral (the filter is an identity).
     pub fn is_identity(&self) -> bool {
         self.wb_neutral()
+            && self.calibration_neutral()
             && self.tone_neutral()
             && self.dehaze == 0.0
             && self.vibrance == 0.0
@@ -580,14 +682,27 @@ pub fn develop(px: &mut [[f32; 4]], w: usize, h: usize, p: &CameraRaw, float: bo
     let ps = p.pixel_scale.clamp(0.01, 1.0);
     let long = w.max(h) as f32;
     // 1. White balance + exposure in linear light.
-    if !p.wb_neutral() {
-        let mut g = white_balance_gains(p.temperature, p.tint);
-        let norm = luma(g);
-        g = g.map(|v| v / norm * 2f32.powf(p.exposure));
+    if let Some(g) = per_pixel::gains(p) {
         par_rows(px, w, 1, |_, row| {
             for q in row.iter_mut() {
-                for c in 0..3 {
-                    q[c] = linear_to_srgb((srgb_to_linear(q[c]) * g[c]).max(0.0));
+                *q = balance(*q, g);
+            }
+        });
+    }
+    // 1b. Calibration: the primaries turned and purer or greyer, and the shadows tinted, in
+    // linear light (the camera's primaries are what Camera Raw's panel calibrates).
+    if !p.calibration_neutral() {
+        let primaries = p.calibration_hue.iter().chain(&p.calibration_sat).any(|v| *v != 0.0);
+        let tint = p.shadow_tint.clamp(-100.0, 100.0) / 100.0;
+        par_rows(px, w, 1, |_, row| {
+            for q in row.iter_mut() {
+                let c = [srgb_to_linear(q[0]), srgb_to_linear(q[1]), srgb_to_linear(q[2])];
+                let mut o = if primaries { calibrate(c, p.calibration_hue, p.calibration_sat) } else { c };
+                if tint != 0.0 {
+                    o = shadow_tint(o, tint);
+                }
+                for k in 0..3 {
+                    q[k] = linear_to_srgb(o[k].max(0.0));
                 }
             }
         });
@@ -606,7 +721,6 @@ pub fn develop(px: &mut [[f32; 4]], w: usize, h: usize, p: &CameraRaw, float: bo
         let clar = (p.clarity != 0.0).then(|| guided_fast(&lc, &lc, w, h, ((long * 0.02) as usize).max(3), 0.005));
         let tex = (p.texture != 0.0).then(|| gauss(&lc, w, h, (long * 0.002).max(1.5 * ps)));
         let k_con = p.contrast / 100.0 * 0.6;
-        let tau = std::f32::consts::TAU;
         par_rows(px, w, 1, |y, row| {
             for (x, q) in row.iter_mut().enumerate() {
                 let i = y * w + x;
@@ -619,22 +733,14 @@ pub fn develop(px: &mut [[f32; 4]], w: usize, h: usize, p: &CameraRaw, float: bo
                 if let Some(t) = &tex {
                     lv += p.texture / 100.0 * 0.9 * (lc[i] - t[i]).clamp(-0.1, 0.1);
                 }
-                if k_con != 0.0 {
-                    let xx = lv.clamp(0.0, 1.0);
-                    lv += -k_con * (tau * xx).sin() / tau;
-                }
-                let lv = lv.max(0.0) + (l0 - lc[i]);
-                let ratio = if l0 > 1e-5 { lv / l0 } else { 1.0 };
-                for c in 0..3 {
-                    q[c] = if l0 > 1e-5 { q[c] * ratio } else { q[c] + (lv - l0) };
-                }
+                *q = tone(*q, l0, lc[i], lv, k_con);
             }
         });
     }
     // 3b. Whites and Blacks: global curves adapted to the image's black and white points.
     if p.whites != 0.0 || p.blacks != 0.0 {
         let enc = Encoding::of(p.encoding_gamma);
-        let (bp, wp) = luminance_points(px, w, h, enc);
+        let (bp, wp) = luminance_points(px, w, h, enc, |q| q);
         let (xw, xb) = whites_blacks::amounts(p.whites.clamp(-100.0, 100.0), p.blacks.clamp(-100.0, 100.0), bp, wp);
         whites_blacks::apply(px, w, xw, xb, enc);
     }
@@ -646,14 +752,7 @@ pub fn develop(px: &mut [[f32; 4]], w: usize, h: usize, p: &CameraRaw, float: bo
         let (master, cr, cg, cb) = (pts(&p.point_curve), pts(&p.point_curve_red), pts(&p.point_curve_green), pts(&p.point_curve_blue));
         let hsl = !p.hsl_neutral();
         let grade = !p.grade_neutral();
-        let wheel_tint = |wh: &Wheel| -> [f32; 3] {
-            let c = hsv_to_rgb(wh.hue, 1.0, 1.0);
-            let l = luma(c);
-            [c[0] - l, c[1] - l, c[2] - l].map(|v| v * wh.sat / 100.0 * 0.3)
-        };
-        let tints = [wheel_tint(&p.grade_shadows), wheel_tint(&p.grade_midtones), wheel_tint(&p.grade_highlights), wheel_tint(&p.grade_global)];
-        let blend = 0.15 + p.grade_blending.clamp(0.0, 100.0) / 100.0 * 0.35;
-        let bal = p.grade_balance.clamp(-100.0, 100.0) / 100.0 * 0.25;
+        let Grade { tints, lums, blend, balance: bal } = Grade::new(p);
         par_rows(px, w, 1, |_, row| {
             for q in row.iter_mut() {
                 let mut c = [q[0], q[1], q[2]];
@@ -706,7 +805,6 @@ pub fn develop(px: &mut [[f32; 4]], w: usize, h: usize, p: &CameraRaw, float: bo
                     let hi = smoothstep(0.5 + bal - blend, 1.0, l);
                     let mid = (1.0 - sh - hi).max(0.0);
                     let masks = [sh, mid, hi, 1.0];
-                    let lums = [p.grade_shadows.lum, p.grade_midtones.lum, p.grade_highlights.lum, p.grade_global.lum];
                     for k in 0..4 {
                         for ch in 0..3 {
                             c[ch] += masks[k] * tints[k][ch];
@@ -732,11 +830,7 @@ pub fn develop(px: &mut [[f32; 4]], w: usize, h: usize, p: &CameraRaw, float: bo
         vignette(px, w, h, p);
     }
     if p.grain_amount > 0.0 {
-        let cell = 1.0 + p.grain_size / 25.0;
-        let rough = p.grain_roughness / 100.0;
-        let amt = p.grain_amount / 100.0 * 0.12;
-        let seed = p.seed as u64;
-        let pscale = 1.0 / ps;
+        let Grain { cell, roughness: rough, amount: amt, seed, scale: pscale } = Grain::new(p);
         par_rows(px, w, 1, |y, row| {
             for (x, q) in row.iter_mut().enumerate() {
                 // Sample in full-resolution coordinates so previews match the result.
@@ -759,24 +853,60 @@ pub fn develop(px: &mut [[f32; 4]], w: usize, h: usize, p: &CameraRaw, float: bo
     }
 }
 
+/// The end of stage 3 on one pixel: Contrast (strength `k_con`) on the luminance `lv` that
+/// Clarity and Texture left, then the pixel rescaled to it. `l0` is its luminance, `lc` that
+/// clipped to 1.
+fn tone(mut q: [f32; 4], l0: f32, lc: f32, mut lv: f32, k_con: f32) -> [f32; 4] {
+    if k_con != 0.0 {
+        let tau = std::f32::consts::TAU;
+        let xx = lv.clamp(0.0, 1.0);
+        lv += -k_con * (tau * xx).sin() / tau;
+    }
+    let lv = lv.max(0.0) + (l0 - lc);
+    let ratio = if l0 > 1e-5 { lv / l0 } else { 1.0 };
+    for c in 0..3 {
+        q[c] = if l0 > 1e-5 { q[c] * ratio } else { q[c] + (lv - l0) };
+    }
+    q
+}
+
+/// Stage 3 on one pixel when Contrast is its only control.
+fn contrast(q: [f32; 4], k_con: f32) -> [f32; 4] {
+    let l0 = luma([q[0], q[1], q[2]]).max(0.0);
+    let lc = l0.min(1.0);
+    tone(q, l0, lc, lc, k_con)
+}
+
+/// Stage 1 on one pixel: white balance and exposure `gains` in linear light.
+fn balance(mut q: [f32; 4], g: [f32; 3]) -> [f32; 4] {
+    for c in 0..3 {
+        q[c] = linear_to_srgb((srgb_to_linear(q[c]) * g[c]).max(0.0));
+    }
+    q
+}
+
 /// The image's black and white points as sRGB-encoded grey levels: the 3rd percentile of the
 /// luminance and the 99.5th of the brightest channel, on a copy at most 256 pixels across (so a
-/// preview proxy and the full image agree).
-fn luminance_points(px: &[[f32; 4]], w: usize, h: usize, enc: Encoding) -> (f32, f32) {
+/// preview proxy and the full image agree). `map` is applied to each pixel first.
+fn luminance_points(px: &[[f32; 4]], w: usize, h: usize, enc: Encoding, map: impl Fn([f32; 4]) -> [f32; 4] + Sync) -> (f32, f32) {
     let f = w.max(h).div_ceil(256).max(1);
     let (sw, sh) = (w.div_ceil(f), h.div_ceil(f));
-    let mut sum = vec![[0.0f64; 4]; sw * sh];
-    for y in 0..h {
-        for x in 0..w {
-            let q = px[y * w + x];
-            let s = &mut sum[(y / f) * sw + x / f];
-            for c in 0..3 {
-                s[c] += f64::from(enc.decode(q[c]).clamp(0.0, 1.0));
+    // Each band of `f` rows sums into its own row of cells, in the same order as one pass would.
+    let bands = crate::photo_util::par_map(sh, |sy| {
+        let mut sum = vec![[0.0f64; 4]; sw];
+        for y in sy * f..((sy + 1) * f).min(h) {
+            for x in 0..w {
+                let q = map(px[y * w + x]);
+                let s = &mut sum[x / f];
+                for c in 0..3 {
+                    s[c] += f64::from(enc.decode(q[c]).clamp(0.0, 1.0));
+                }
+                s[3] += 1.0;
             }
-            s[3] += 1.0;
         }
-    }
-    let cells: Vec<[f32; 3]> = sum.iter().filter(|s| s[3] > 0.0).map(|s| [0, 1, 2].map(|c| (s[c] / s[3]) as f32)).collect();
+        sum
+    });
+    let cells: Vec<[f32; 3]> = bands.iter().flatten().filter(|s| s[3] > 0.0).map(|s| [0, 1, 2].map(|c| (s[c] / s[3]) as f32)).collect();
     if cells.is_empty() {
         return (0.0, 1.0);
     }
@@ -818,23 +948,25 @@ fn dehaze(px: &mut [[f32; 4]], w: usize, h: usize, amount: f32) {
         *s = s.map(|v| v / c.max(1.0));
     }
     let r = (sw.max(sh) / 60).max(2);
-    let min_filter = |v: &[f32]| -> Vec<f32> {
+    // The minimum (or, with `f32::max`, maximum) over each (2r + 1)² window.
+    let rank_filter = |v: &[f32], start: f32, pick: fn(f32, f32) -> f32| -> Vec<f32> {
         let mut a = vec![0.0f32; sw * sh];
         for y in 0..sh {
             for x in 0..sw {
                 let (x0, x1) = (x.saturating_sub(r), (x + r).min(sw - 1));
-                a[y * sw + x] = (x0..=x1).map(|xx| v[y * sw + xx]).fold(f32::MAX, f32::min);
+                a[y * sw + x] = (x0..=x1).map(|xx| v[y * sw + xx]).fold(start, pick);
             }
         }
         let mut b = vec![0.0f32; sw * sh];
         for y in 0..sh {
             for x in 0..sw {
                 let (y0, y1) = (y.saturating_sub(r), (y + r).min(sh - 1));
-                b[y * sw + x] = (y0..=y1).map(|yy| a[yy * sw + x]).fold(f32::MAX, f32::min);
+                b[y * sw + x] = (y0..=y1).map(|yy| a[yy * sw + x]).fold(start, pick);
             }
         }
         b
     };
+    let min_filter = |v: &[f32]| rank_filter(v, f32::MAX, f32::min);
     let dark = min_filter(&small.iter().map(|c| c[0].min(c[1]).min(c[2])).collect::<Vec<_>>());
     // Atmospheric light: mean colour of the brightest 0.1 % of the dark channel.
     let mut idx: Vec<usize> = (0..sw * sh).collect();
@@ -848,7 +980,15 @@ fn dehaze(px: &mut [[f32; 4]], w: usize, h: usize, amount: f32) {
     }
     let air = air.map(|v| v.max(0.2));
     let norm_dark = min_filter(&small.iter().map(|c| (c[0] / air[0]).min(c[1] / air[1]).min(c[2] / air[2])).collect::<Vec<_>>());
-    let t_raw: Vec<f32> = norm_dark.iter().map(|d| 1.0 - 0.95 * d).collect();
+    // Opened (a maximum filter of the same radius after the minimum): the minimum grows every
+    // dark object by `r`, so sky beside a dark building took its dark channel, counted as
+    // haze-free and kept a bright halo (#9273). Opening shrinks dark regions back to their
+    // outline and is still a lower bound of the dark channel over the window. It raises the dark
+    // channel on average, so the 0.95 weight is scaled to keep the slider's overall strength.
+    let opened = rank_filter(&norm_dark, f32::MIN, f32::max);
+    let mean = |v: &[f32]| v.iter().sum::<f32>() / v.len().max(1) as f32;
+    let weight = 0.95 * mean(&norm_dark) / mean(&opened).max(1e-6);
+    let t_raw: Vec<f32> = opened.iter().map(|d| 1.0 - weight * d).collect();
     let guide: Vec<f32> = small.iter().map(|c| luma(*c)).collect();
     let t = guided(&guide, &t_raw, sw, sh, r * 2, 1e-3);
     let ks = k as f32;
@@ -923,24 +1063,7 @@ fn detail(px: &mut [[f32; 4]], w: usize, h: usize, p: &CameraRaw, ps: f32) {
 }
 
 fn vignette(px: &mut [[f32; 4]], w: usize, h: usize, p: &CameraRaw) {
-    let amt = p.vignette_amount / 100.0;
-    let mid = p.vignette_midpoint.clamp(0.0, 100.0) / 100.0;
-    let feather = p.vignette_feather.clamp(0.0, 100.0) / 100.0;
-    let round = p.vignette_roundness.clamp(-100.0, 100.0) / 100.0;
-    let hl = p.vignette_highlights.clamp(0.0, 100.0) / 100.0;
-    let style = p.vignette_style.as_str();
-    let (cx, cy) = (w as f32 / 2.0, h as f32 / 2.0);
-    // Roundness: 0 follows the frame's aspect, +1 a circle, −1 a rounded rectangle.
-    let (ax, ay) = if round >= 0.0 {
-        let r = cx.min(cy) + (cx.max(cy) - cx.min(cy)) * (1.0 - round);
-        (if cx >= cy { r } else { cx }, if cy > cx { r } else { cy })
-    } else {
-        (cx, cy)
-    };
-    let pw = 2.0 + (-round).max(0.0) * 6.0;
-    let inner = 1.0 - mid * 0.8;
-    let edge0 = inner - feather * 0.5 * inner;
-    let edge1 = inner + feather * 0.5 * (1.4 - inner) + 0.02;
+    let Vignette { amount: amt, highlights: hl, style, centre: [cx, cy], axes: [ax, ay], power: pw, edges: [edge0, edge1] } = Vignette::new(w, h, p);
     par_rows(px, w, 1, |y, row| {
         for (x, q) in row.iter_mut().enumerate() {
             let (dx, dy) = (((x as f32 + 0.5 - cx) / ax).abs(), ((y as f32 + 0.5 - cy) / ay).abs());
@@ -951,7 +1074,7 @@ fn vignette(px: &mut [[f32; 4]], w: usize, h: usize, p: &CameraRaw) {
             }
             let l = luma([q[0], q[1], q[2]]).clamp(0.0, 1.0);
             match style {
-                "paintOverlay" => {
+                VignetteStyle::PaintOverlay => {
                     let target = if amt < 0.0 { 0.0 } else { 1.0 };
                     let k = m * amt.abs();
                     for c in 0..3 {
@@ -965,7 +1088,7 @@ fn vignette(px: &mut [[f32; 4]], w: usize, h: usize, p: &CameraRaw) {
                         let protect = smoothstep(0.6, 1.0, l) * hl;
                         k += (1.0 - k) * protect;
                     }
-                    if style == "colorPriority" {
+                    if style == VignetteStyle::ColorPriority {
                         let nl = l * k;
                         for c in 0..3 {
                             q[c] += nl - l;
@@ -985,6 +1108,37 @@ fn vignette(px: &mut [[f32; 4]], w: usize, h: usize, p: &CameraRaw) {
 mod tests {
     use super::*;
 
+    /// #9273: Dehaze clears the haze evenly over a sky, right up to a dark building, instead of
+    /// leaving a bright halo of uncorrected haze around it. Synthetic scene: a clear sky and a
+    /// dark tower, hazed with `I = J·t + A·(1 − t)`.
+    #[test]
+    fn dehaze_leaves_no_halo_beside_dark_objects() {
+        let (w, h) = (600usize, 400usize);
+        let tower = |x: usize, y: usize| (250..350).contains(&x) && y >= 120;
+        let (t, air) = (0.55f32, [0.9f32, 0.9, 0.9]);
+        let mut px: Vec<[f32; 4]> = (0..w * h)
+            .map(|i| {
+                let (x, y) = (i % w, i / w);
+                let j = if tower(x, y) { [0.06, 0.06, 0.07] } else { [0.35 + 0.1 * y as f32 / h as f32, 0.5, 0.8] };
+                let c: [f32; 3] = std::array::from_fn(|k| j[k] * t + air[k] * (1.0 - t));
+                [c[0], c[1], c[2], 1.0]
+            })
+            .collect();
+        dehaze(&mut px, w, h, 1.0);
+        let sky = |xs: std::ops::Range<usize>| {
+            let v: Vec<f32> =
+                (150..390).flat_map(|y| xs.clone().map(move |x| (x, y))).map(|(x, y)| luma([px[y * w + x][0], px[y * w + x][1], px[y * w + x][2]])).collect();
+            v.iter().sum::<f32>() / v.len() as f32
+        };
+        // Sky 1–8 px from the tower against open sky: the haze left beside it, in 8-bit levels.
+        let halo = (sky(242..250) - sky(20..80)) * 255.0;
+        // 6.4 levels before the dark channel was opened, under 1 after.
+        assert!(halo < 3.0, "a {halo:.1}-level halo beside the tower");
+        // The open sky is still cleared: darker than the hazy input.
+        let hazy = luma(std::array::from_fn(|k| [0.4, 0.5, 0.8][k] * t + air[k] * (1.0 - t)));
+        assert!(sky(20..80) < hazy - 0.02, "{} vs hazy {hazy}", sky(20..80));
+    }
+
     #[test]
     fn new_curves_are_validated_but_saved_curves_still_load_and_render() {
         for field in ["pointCurve", "pointCurveRed", "pointCurveGreen", "pointCurveBlue"] {
@@ -1144,6 +1298,105 @@ mod tests {
         assert!(v[0][0] < 0.35 && (v[(h / 2) * w + w / 2][0] - 0.5).abs() < 0.01, "{:?}", v[0]);
     }
 
+    #[test]
+    fn calibration_keeps_the_develop_off_the_per_pixel_gpu_stages() {
+        // The per-pixel stages (the Camera Raw dialog's GPU preview) don't run Calibration, so
+        // settings with it must fall back to the CPU develop instead of previewing without it.
+        for p in [
+            CameraRaw { shadow_tint: 40.0, ..Default::default() },
+            CameraRaw { calibration_hue: [0.0, 0.0, 30.0], whites: 20.0, ..Default::default() },
+            CameraRaw { calibration_sat: [-50.0, 0.0, 0.0], exposure: 0.5, ..Default::default() },
+        ] {
+            assert!(!p.spatial());
+            assert!(per_pixel(&p, 2, 2, false, Some((0.0, 1.0))).is_none(), "{p:?}");
+        }
+        assert!(per_pixel(&CameraRaw { exposure: 0.5, ..Default::default() }, 2, 2, false, None).is_some());
+    }
+
+    #[test]
+    fn calibration_turns_primaries_keeps_neutrals_and_tints_shadows() {
+        let w = calibration_weights(0.0);
+        assert!((w[0] - 1.0).abs() < 1e-6, "pure red is all red primary: {w:?}");
+        let w = calibration_weights(60.0);
+        assert!((w[0] - 0.5).abs() < 1e-6 && (w[1] - 0.5).abs() < 1e-6, "yellow is half red, half green: {w:?}");
+        let w = calibration_weights(300.0);
+        assert!((w[2] - 0.5).abs() < 1e-6 && (w[0] - 0.5).abs() < 1e-6, "magenta wraps round: {w:?}");
+        let (none, zero) = ([0.0f32; 3], [0.0f32; 3]);
+        let grey = calibrate([0.3, 0.3, 0.3], [100.0, -100.0, 50.0], [100.0, -100.0, 100.0]);
+        assert!(grey.iter().all(|v| (v - 0.3).abs() < 1e-5), "greys are untouched: {grey:?}");
+        // Red turned towards green: it gains green, keeps its luminance.
+        let red = calibrate([0.5, 0.0, 0.0], [100.0, 0.0, 0.0], zero);
+        assert!(red[1] > 0.05 && (red[1] / red[0] - 0.5).abs() < 0.02 && red[2] < 1e-6, "red turns 30° towards green (orange): {red:?}");
+        assert!((luma(red) - luma([0.5, 0.0, 0.0])).abs() < 1e-4, "luminance kept: {red:?}");
+        // Blue at saturation −100 is grey; green at −50 is paler.
+        let blue = calibrate([0.0, 0.0, 0.8], none, [0.0, 0.0, -100.0]);
+        assert!((blue[0] - blue[1]).abs() < 1e-5 && (blue[1] - blue[2]).abs() < 1e-5, "blue at −100 saturation is grey: {blue:?}");
+        let green = calibrate([0.2, 0.8, 0.2], none, [0.0, -50.0, 0.0]);
+        assert!(green[0] > 0.2 && green[1] < 0.8, "green at −50 is paler: {green:?}");
+        // A primary's sliders leave the other primaries alone.
+        let unchanged = calibrate([0.0, 0.0, 0.8], [100.0, 100.0, 0.0], [100.0, 100.0, 0.0]);
+        assert!(unchanged.iter().zip([0.0, 0.0, 0.8]).all(|(a, b)| (a - b).abs() < 1e-5), "{unchanged:?}");
+        // Shadows tint: magenta lifts red and blue over green in a dark pixel, keeps luminance,
+        // and leaves white alone.
+        let dark = shadow_tint([0.02, 0.02, 0.02], 1.0);
+        assert!(dark[0] > dark[1] && dark[2] > dark[1], "{dark:?}");
+        assert!((luma(dark) - 0.02).abs() < 1e-4, "luminance kept: {dark:?}");
+        let green = shadow_tint([0.02, 0.02, 0.02], -1.0);
+        assert!(green[1] > green[0], "{green:?}");
+        let white = shadow_tint([1.0, 1.0, 1.0], 1.0);
+        assert!(white.iter().all(|v| (v - 1.0).abs() < 1e-3), "white is not tinted: {white:?}");
+        // Through develop: neutral settings are an identity, a tint changes dark pixels only.
+        let mut p = CameraRaw::default();
+        assert!(p.is_identity());
+        p.shadow_tint = 100.0;
+        assert!(!p.is_identity());
+        let mut px = vec![[0.1, 0.1, 0.1, 1.0], [0.95, 0.95, 0.95, 1.0]];
+        develop(&mut px, 2, 1, &p, false);
+        assert!(px[0][0] > px[0][1], "dark grey turns magenta: {:?}", px[0]);
+        assert!((px[1][0] - px[1][1]).abs() < 0.01, "near-white stays neutral: {:?}", px[1]);
+        p = CameraRaw::default();
+        p.calibration_hue[2] = 100.0;
+        let mut px = vec![[0.0, 0.0, 0.8, 1.0]];
+        develop(&mut px, 1, 1, &p, false);
+        assert!(px[0][0] > 0.05, "blue turned towards red: {:?}", px[0]);
+    }
+
+    #[test]
+    fn auto_tone_brightens_dark_and_darkens_bright_images() {
+        let mut p = CameraRaw::default();
+        auto_tone(&[], &mut p);
+        assert_eq!(p, CameraRaw::default(), "no pixels: nothing changes");
+        let dark: Vec<[f32; 4]> = (0..4096)
+            .map(|i| {
+                let v = 0.05 + (i % 64) as f32 / 64.0 * 0.15;
+                [v, v, v, 1.0]
+            })
+            .collect();
+        auto_tone(&dark, &mut p);
+        assert!(p.exposure > 0.5, "a dark image gets exposure: {}", p.exposure);
+        assert!(p.shadows > 0.0, "and lifted shadows: {}", p.shadows);
+        let mut p = CameraRaw::default();
+        let bright: Vec<[f32; 4]> = (0..4096)
+            .map(|i| {
+                let v = 0.8 + (i % 64) as f32 / 64.0 * 0.19;
+                [v, v, v, 1.0]
+            })
+            .collect();
+        auto_tone(&bright, &mut p);
+        assert!(p.exposure < -0.5, "a bright image loses exposure: {}", p.exposure);
+        assert!(p.highlights < 0.0, "and its highlights come down: {}", p.highlights);
+        let mut p = CameraRaw::default();
+        let good: Vec<[f32; 4]> = (0..4096)
+            .map(|i| {
+                let v = 0.04 + (i % 64) as f32 / 63.0 * 0.92;
+                [v, v, v, 1.0]
+            })
+            .collect();
+        auto_tone(&good, &mut p);
+        assert!(p.exposure.abs() < 0.3 && p.blacks.abs() < 10.0 && p.whites.abs() < 10.0, "a full-range image is left nearly alone: {p:?}");
+        assert!(p.saturation == 0.0 && p.hsl_neutral(), "other panels untouched");
+    }
+
     #[test]
     fn float_documents_keep_overrange() {
         let mut a = vec![[2.0f32, 1.5, 0.5, 1.0]; 16];
diff --git a/crates/algo/src/camera_raw/per_pixel.rs b/crates/algo/src/camera_raw/per_pixel.rs
new file mode 100644
index 0000000000..6400db8a25
--- /dev/null
+++ b/crates/algo/src/camera_raw/per_pixel.rs
@@ -0,0 +1,240 @@
+//! Develop's per-pixel stages resolved for one image: every constant and table they use, so
+//! another implementation of them (the GPU preview, `photocraft_gpu::CameraRawDevelop`) runs the
+//! same maths. [`develop`](super::develop) builds its own constants with the same functions.
+
+use super::{CameraRaw, Encoding, Wheel, curve_lut, hsv_to_rgb, is_linear, luma, parametric_lut, white_balance_gains, whites_blacks};
+
+/// Entries of the tone curve tables (parametric and point curves).
+pub const CURVE_LUT: usize = 1024;
+/// Samples of a Whites or Blacks curve row: grey levels 0, 1/32, …, 1.
+pub const WB_STEPS: usize = whites_blacks::STEPS;
+
+/// White balance and exposure: channel gains in linear light, when the stage is on.
+pub(crate) fn gains(p: &CameraRaw) -> Option<[f32; 3]> {
+    if p.wb_neutral() {
+        return None;
+    }
+    let g = white_balance_gains(p.temperature, p.tint);
+    let norm = luma(g);
+    Some(g.map(|v| v / norm * 2f32.powf(p.exposure)))
+}
+
+/// Contrast's strength, when Contrast is set.
+fn contrast(p: &CameraRaw) -> Option<f32> {
+    (p.contrast != 0.0).then_some(p.contrast / 100.0 * 0.6)
+}
+
+/// Whites and Blacks as two curve rows for the image's amounts.
+#[derive(Clone, Debug, PartialEq)]
+pub struct WhitesBlacks {
+    /// The Whites curve over grey levels 0, 1/32, …, 1, when Whites is set.
+    pub whites: Option<[f32; WB_STEPS]>,
+    /// The Blacks curve, applied after Whites.
+    pub blacks: Option<[f32; WB_STEPS]>,
+    /// The clipping directions (Whites up, Blacks down) curve each channel; the others scale the
+    /// pixel by the change of its luminance.
+    pub per_channel: bool,
+}
+
+/// Color Grading's wheels resolved.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Grade {
+    /// Colour offsets of the shadows, midtones, highlights and global wheels.
+    pub tints: [[f32; 3]; 4],
+    /// Luminance of the same wheels (slider units).
+    pub lums: [f32; 4],
+    pub blend: f32,
+    pub balance: f32,
+}
+
+impl Grade {
+    pub(crate) fn new(p: &CameraRaw) -> Self {
+        let tint = |wh: &Wheel| -> [f32; 3] {
+            let c = hsv_to_rgb(wh.hue, 1.0, 1.0);
+            let l = luma(c);
+            [c[0] - l, c[1] - l, c[2] - l].map(|v| v * wh.sat / 100.0 * 0.3)
+        };
+        Grade {
+            tints: [tint(&p.grade_shadows), tint(&p.grade_midtones), tint(&p.grade_highlights), tint(&p.grade_global)],
+            lums: [p.grade_shadows.lum, p.grade_midtones.lum, p.grade_highlights.lum, p.grade_global.lum],
+            blend: 0.15 + p.grade_blending.clamp(0.0, 100.0) / 100.0 * 0.35,
+            balance: p.grade_balance.clamp(-100.0, 100.0) / 100.0 * 0.25,
+        }
+    }
+}
+
+/// The vignette's `vignette_style`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum VignetteStyle {
+    HighlightPriority,
+    ColorPriority,
+    PaintOverlay,
+}
+
+/// The post-crop vignette's shape on a `w × h` frame.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Vignette {
+    /// −1 … 1.
+    pub amount: f32,
+    /// 0 … 1.
+    pub highlights: f32,
+    pub style: VignetteStyle,
+    /// Frame centre (pixels).
+    pub centre: [f32; 2],
+    /// Half axes of the shape (pixels).
+    pub axes: [f32; 2],
+    /// Exponent of the superellipse.
+    pub power: f32,
+    /// The mask's smoothstep edges in normalised radius.
+    pub edges: [f32; 2],
+}
+
+impl Vignette {
+    pub(crate) fn new(w: usize, h: usize, p: &CameraRaw) -> Self {
+        let mid = p.vignette_midpoint.clamp(0.0, 100.0) / 100.0;
+        let feather = p.vignette_feather.clamp(0.0, 100.0) / 100.0;
+        let round = p.vignette_roundness.clamp(-100.0, 100.0) / 100.0;
+        let (cx, cy) = (w as f32 / 2.0, h as f32 / 2.0);
+        // Roundness: 0 follows the frame's aspect, +1 a circle, −1 a rounded rectangle.
+        let (ax, ay) = if round >= 0.0 {
+            let r = cx.min(cy) + (cx.max(cy) - cx.min(cy)) * (1.0 - round);
+            (if cx >= cy { r } else { cx }, if cy > cx { r } else { cy })
+        } else {
+            (cx, cy)
+        };
+        let inner = 1.0 - mid * 0.8;
+        Vignette {
+            amount: p.vignette_amount / 100.0,
+            highlights: p.vignette_highlights.clamp(0.0, 100.0) / 100.0,
+            style: match p.vignette_style.as_str() {
+                "paintOverlay" => VignetteStyle::PaintOverlay,
+                "colorPriority" => VignetteStyle::ColorPriority,
+                _ => VignetteStyle::HighlightPriority,
+            },
+            centre: [cx, cy],
+            axes: [ax, ay],
+            power: 2.0 + (-round).max(0.0) * 6.0,
+            edges: [inner - feather * 0.5 * inner, inner + feather * 0.5 * (1.4 - inner) + 0.02],
+        }
+    }
+}
+
+/// Grain: value noise sampled in full-resolution coordinates.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Grain {
+    /// Noise cell size (full-resolution pixels).
+    pub cell: f32,
+    /// Weight of the finer octave.
+    pub roughness: f32,
+    pub amount: f32,
+    pub seed: u64,
+    /// Full-resolution pixels per pixel (`1 / pixel_scale`).
+    pub scale: f32,
+}
+
+impl Grain {
+    pub(crate) fn new(p: &CameraRaw) -> Self {
+        Grain {
+            cell: 1.0 + p.grain_size / 25.0,
+            roughness: p.grain_roughness / 100.0,
+            amount: p.grain_amount / 100.0 * 0.12,
+            seed: u64::from(p.seed),
+            scale: 1.0 / p.pixel_scale.clamp(0.01, 1.0),
+        }
+    }
+}
+
+/// Develop's per-pixel stages for one image and settings, in order. `None` stages are off.
+#[derive(Clone, Debug, PartialEq)]
+pub struct PerPixel {
+    /// 1. White balance and exposure gains in linear light (sRGB-decoded values).
+    pub gains: Option<[f32; 3]>,
+    /// 3. Contrast's strength (Contrast without Texture or Clarity is per pixel).
+    pub contrast: Option<f32>,
+    /// 3b. Whites and Blacks, in the document's encoding.
+    pub whites_blacks: Option<WhitesBlacks>,
+    /// The document's transfer curve: 0 for sRGB's, else a power-law gamma.
+    pub encoding: f32,
+    /// 4. Vibrance and Saturation (slider / 100).
+    pub presence: Option<[f32; 2]>,
+    /// 5. The parametric tone curve, [`CURVE_LUT`] entries over 0 … 1.
+    pub parametric: Option<Vec<f32>>,
+    /// 5. Point curves: master, red, green, blue.
+    pub point: [Option<Vec<f32>>; 4],
+    /// 6. Color Mixer hue, saturation and luminance per band.
+    pub hsl: Option<[[f32; 8]; 3]>,
+    /// 7. Color Grading.
+    pub grade: Option<Grade>,
+    /// 9. Vignette.
+    pub vignette: Option<Vignette>,
+    /// 9. Grain.
+    pub grain: Option<Grain>,
+    /// Clip RGB to 0 … 1 at the end (all but 32-bit documents).
+    pub clamp: bool,
+}
+
+impl CameraRaw {
+    /// Whether developing needs a stage that reads neighbouring pixels: Dehaze, Shadows and
+    /// Highlights, Texture, Clarity, sharpening or noise reduction.
+    pub fn spatial(&self) -> bool {
+        self.dehaze != 0.0
+            || [self.highlights, self.shadows, self.texture, self.clarity].iter().any(|v| *v != 0.0)
+            || self.sharpen_amount > 0.0
+            || self.noise_luminance > 0.0
+            || self.noise_color > 0.0
+    }
+}
+
+/// The image's black and white points that Whites and Blacks adapt to, for `px` (`w × h`,
+/// display-encoded) developed per pixel with `p`: what [`develop`](super::develop) measures
+/// after white balance and Contrast. `None` when Whites and Blacks are 0 or `p` needs a
+/// spatial stage.
+pub fn white_black_points(px: &[[f32; 4]], w: usize, h: usize, p: &CameraRaw) -> Option<(f32, f32)> {
+    if (p.whites == 0.0 && p.blacks == 0.0) || p.spatial() || px.len() != w.saturating_mul(h) {
+        return None;
+    }
+    let enc = Encoding::of(p.encoding_gamma);
+    let (g, k_con) = (gains(p), contrast(p));
+    Some(super::luminance_points(px, w, h, enc, |q| {
+        let q = g.map_or(q, |g| super::balance(q, g));
+        k_con.map_or(q, |k| super::contrast(q, k))
+    }))
+}
+
+/// Develop's stages for settings without spatial stages, on a `w × h` image; `points` are the
+/// image's [`white_black_points`]. `None` when `p` needs a spatial stage or Calibration (these
+/// stages don't run it), or Whites or Blacks is set without `points`. The points themselves
+/// leave Calibration out, so a caller may cache them across Calibration changes.
+pub fn per_pixel(p: &CameraRaw, w: usize, h: usize, float: bool, points: Option<(f32, f32)>) -> Option<PerPixel> {
+    if p.spatial() || !p.calibration_neutral() {
+        return None;
+    }
+    let identity = p.is_identity();
+    let whites_blacks = if p.whites != 0.0 || p.blacks != 0.0 {
+        let (bp, wp) = points?;
+        let (xw, xb) = whites_blacks::amounts(p.whites.clamp(-100.0, 100.0), p.blacks.clamp(-100.0, 100.0), bp, wp);
+        (xw != 0.0 || xb != 0.0).then(|| WhitesBlacks {
+            whites: (xw != 0.0).then(|| whites_blacks::whites_row(xw)),
+            blacks: (xb != 0.0).then(|| whites_blacks::blacks_row(xb)),
+            per_channel: xw > 0.0 || xb < 0.0,
+        })
+    } else {
+        None
+    };
+    let parametric_on = !(p.curve_highlights == 0.0 && p.curve_lights == 0.0 && p.curve_darks == 0.0 && p.curve_shadows == 0.0);
+    let pts = |c: &Vec<[f32; 2]>| (!is_linear(c)).then(|| curve_lut(c, CURVE_LUT));
+    Some(PerPixel {
+        gains: gains(p),
+        contrast: contrast(p),
+        whites_blacks,
+        encoding: Encoding::of(p.encoding_gamma).0,
+        presence: (p.vibrance != 0.0 || p.saturation != 0.0).then_some([p.vibrance / 100.0, p.saturation / 100.0]),
+        parametric: parametric_on.then(|| parametric_lut(p, CURVE_LUT)),
+        point: [pts(&p.point_curve), pts(&p.point_curve_red), pts(&p.point_curve_green), pts(&p.point_curve_blue)],
+        hsl: (!p.hsl_neutral()).then_some([p.hsl_hue, p.hsl_sat, p.hsl_lum]),
+        grade: (!p.grade_neutral()).then(|| Grade::new(p)),
+        vignette: (p.vignette_amount != 0.0).then(|| Vignette::new(w, h, p)),
+        grain: (p.grain_amount > 0.0).then(|| Grain::new(p)),
+        clamp: !float && !identity,
+    })
+}
diff --git a/crates/algo/src/camera_raw/whites_blacks.rs b/crates/algo/src/camera_raw/whites_blacks.rs
index 93bb9cff31..cfce5378b4 100644
--- a/crates/algo/src/camera_raw/whites_blacks.rs
+++ b/crates/algo/src/camera_raw/whites_blacks.rs
@@ -24,7 +24,7 @@ use super::Encoding;
 use crate::photo_util::par_rows;
 
 /// Grey levels the curves are sampled at: 0, 1/32, …, 1 (sRGB-encoded).
-const STEPS: usize = 33;
+pub(crate) const STEPS: usize = 33;
 /// The first row's internal amount; rows are 10 apart.
 const WHITES_FROM: f32 = -100.0;
 const BLACKS_FROM: f32 = -100.0;
@@ -315,6 +315,25 @@ fn curve(rows: &[[f32; STEPS]], from: f32, x: f32, v: f32) -> f32 {
     at(&rows[i]) * (1.0 - t) + at(&rows[i + 1]) * t
 }
 
+/// The curve at a fractional internal amount `x` as one row: `curve(rows, from, x, v)` is this
+/// row interpolated at `v`, because both interpolations are linear.
+fn row_at(rows: &[[f32; STEPS]], from: f32, x: f32) -> [f32; STEPS] {
+    let r = ((x - from) / 10.0).clamp(0.0, (rows.len() - 1) as f32);
+    let i = (r as usize).min(rows.len() - 2);
+    let t = r - i as f32;
+    std::array::from_fn(|j| rows[i][j] * (1.0 - t) + rows[i + 1][j] * t)
+}
+
+/// The Whites curve at internal amount `x` as a row over grey levels 0, 1/32, …, 1.
+pub(crate) fn whites_row(x: f32) -> [f32; STEPS] {
+    row_at(&WHITES, WHITES_FROM, x)
+}
+
+/// The Blacks curve at internal amount `x` as a row over grey levels 0, 1/32, …, 1.
+pub(crate) fn blacks_row(x: f32) -> [f32; STEPS] {
+    row_at(&BLACKS, BLACKS_FROM, x)
+}
+
 /// Whites at internal amount `x` (−100 … 270) of grey level `v`.
 pub(crate) fn whites(v: f32, x: f32) -> f32 {
     curve(&WHITES, WHITES_FROM, x, v)
diff --git a/crates/algo/src/lib.rs b/crates/algo/src/lib.rs
index 665f6fd6e9..9e8fa5301d 100644
--- a/crates/algo/src/lib.rs
+++ b/crates/algo/src/lib.rs
@@ -18,6 +18,7 @@
 #![forbid(unsafe_code)]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+pub mod art_history;
 mod artistic;
 mod artistic_fx;
 mod blur;
diff --git a/crates/algo/src/paint.rs b/crates/algo/src/paint.rs
index 8146af2582..4862304786 100644
--- a/crates/algo/src/paint.rs
+++ b/crates/algo/src/paint.rs
@@ -5,6 +5,14 @@ use photocraft_geom::Rect;
 use photocraft_raster::{Surface, from_rgba_into};
 use serde::{Deserialize, Serialize};
 
+/// How a fill lays down its colour: blended with a mode, or Clear, which erases what it covers
+/// (the Paint Bucket's Mode › Clear).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum FillMode {
+    Blend(BlendMode),
+    Clear,
+}
+
 /// Gradient tool shape.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, Default)]
 #[serde(rename_all = "camelCase")]
@@ -59,7 +67,7 @@ pub fn sample_stops(stops: &[(f32, [f32; 4])], t: f32) -> [f32; 4] {
 fn composite_area(
     s: &mut Surface,
     area: Rect,
-    blend_mode: BlendMode,
+    mode: FillMode,
     coverage: impl Fn(i32, i32) -> f32 + Sync,
     color: impl Fn(i32, i32) -> [f32; 4] + Sync,
     lock_transparency: bool,
@@ -89,12 +97,18 @@ fn composite_area(
                 let i = ((y - r.y0) as usize * w + (x - r.x0) as usize) * n;
                 let px = &mut region[i..i + n];
                 let d = photocraft_raster::to_rgba(&fmt, px);
-                let o = if lock_transparency { blend::composite_atop(blend_mode, d, color(x, y), k) } else { blend::composite(blend_mode, d, color(x, y), k) };
+                let o = match mode {
+                    FillMode::Blend(m) if lock_transparency => blend::composite_atop(m, d, color(x, y), k),
+                    FillMode::Blend(m) => blend::composite(m, d, color(x, y), k),
+                    // Locked transparency keeps the alpha, so Clear leaves the pixel as it is.
+                    FillMode::Clear if lock_transparency => d,
+                    FillMode::Clear => [d[0], d[1], d[2], d[3] * (1.0 - k.min(1.0))],
+                };
                 from_rgba_into(&fmt, o, &mut enc);
                 // A colour picked as CMYK inks replaces fully covered pixels of a CMYK target as it is.
                 if let Some(i) = inks
                     && fmt.mode == photocraft_color::ColorMode::Cmyk
-                    && blend_mode == BlendMode::Normal
+                    && mode == FillMode::Blend(BlendMode::Normal)
                     && k >= 1.0
                 {
                     enc[..4].copy_from_slice(&i);
@@ -135,7 +149,7 @@ pub fn paint_gradient(
     composite_area(
         s,
         area,
-        blend_mode,
+        FillMode::Blend(blend_mode),
         |x, y| opacity * selection.map_or(1.0, |m| m.sample_channel(x, y, 0)),
         |x, y| {
             let t = tool_gradient_t(shape, from, to, x as f32 + 0.5, y as f32 + 0.5);
@@ -187,11 +201,12 @@ pub fn bucket_fill_src(
     lock_transparency: bool,
     src: impl Fn(i32, i32) -> [f32; 4] + Sync,
 ) -> bool {
-    bucket_fill_inks(s, area, seed, tolerance, contiguous, anti_alias, opacity, selection, lock_transparency, src, None)
+    bucket_fill_inks(s, area, seed, tolerance, contiguous, anti_alias, opacity, selection, lock_transparency, src, None, FillMode::Blend(BlendMode::Normal))
 }
 
 /// [`bucket_fill_src`] where `inks` (CMYK, 0..1) are what a fully covered pixel of a CMYK target
-/// gets instead of `src`'s sRGB stand-in (a colour that was picked as CMYK).
+/// gets instead of `src`'s sRGB stand-in (a colour that was picked as CMYK), laid down with `mode`
+/// (the options bar's Mode).
 #[allow(clippy::too_many_arguments)]
 pub fn bucket_fill_inks(
     s: &mut Surface,
@@ -205,6 +220,7 @@ pub fn bucket_fill_inks(
     lock_transparency: bool,
     src: impl Fn(i32, i32) -> [f32; 4] + Sync,
     inks: Option<[f32; 4]>,
+    mode: FillMode,
 ) -> bool {
     if !area.contains(seed.0, seed.1) {
         return false;
@@ -212,7 +228,7 @@ pub fn bucket_fill_inks(
     let img = crate::selection::rgba8_image(s, area);
     let Some(region) = crate::selection::wand_region(&img, area, seed, tolerance, contiguous, anti_alias) else { return false };
     drop(img);
-    bucket_fill_region_inks(s, &region, opacity, selection, lock_transparency, src, inks);
+    bucket_fill_region_inks(s, &region, opacity, selection, lock_transparency, src, inks, mode);
     true
 }
 
@@ -226,10 +242,11 @@ pub fn bucket_fill_region_src(
     lock_transparency: bool,
     src: impl Fn(i32, i32) -> [f32; 4] + Sync,
 ) {
-    bucket_fill_region_inks(s, region, opacity, selection, lock_transparency, src, None);
+    bucket_fill_region_inks(s, region, opacity, selection, lock_transparency, src, None, FillMode::Blend(BlendMode::Normal));
 }
 
-/// [`bucket_fill_region_src`] with the CMYK `inks` of [`bucket_fill_inks`].
+/// [`bucket_fill_region_src`] with the CMYK `inks` and the `mode` of [`bucket_fill_inks`].
+#[allow(clippy::too_many_arguments)]
 pub fn bucket_fill_region_inks(
     s: &mut Surface,
     region: &crate::selection::Region,
@@ -238,18 +255,11 @@ pub fn bucket_fill_region_inks(
     lock_transparency: bool,
     src: impl Fn(i32, i32) -> [f32; 4] + Sync,
     inks: Option<[f32; 4]>,
+    mode: FillMode,
 ) {
     // Composite only over the filled region's box.
     let b = region.bbox;
-    composite_area(
-        s,
-        b,
-        BlendMode::Normal,
-        |x, y| region.at(x, y) * opacity * selection.map_or(1.0, |m| m.sample_channel(x, y, 0)),
-        src,
-        lock_transparency,
-        inks,
-    );
+    composite_area(s, b, mode, |x, y| region.at(x, y) * opacity * selection.map_or(1.0, |m| m.sample_channel(x, y, 0)), src, lock_transparency, inks);
 }
 
 #[cfg(test)]
@@ -333,4 +343,24 @@ mod tests {
         assert_eq!(s.rgba(-1, 4), [0.0; 4], "outside the selection");
         assert_eq!(s.rgba(-4, 4), [0.0; 4], "outside the region");
     }
+
+    /// The Paint Bucket's Mode: Multiply darkens what's there, Clear erases it (half at 50 %).
+    #[test]
+    fn bucket_mode_blends_or_clears() {
+        let a = Rect::new(0, 0, 4, 1);
+        let grey = [0.5, 0.5, 0.5, 1.0];
+        for fmt in [PixelFormat::RGBA8, PixelFormat::RGBA16, PixelFormat::RGBA32F] {
+            let mut s = Surface::new(fmt);
+            s.fill_rect(a, &grey);
+            let red = |_, _| [1.0, 0.0, 0.0, 1.0];
+            assert!(bucket_fill_inks(&mut s, a, (0, 0), 0.0, true, false, 1.0, None, false, red, None, FillMode::Blend(BlendMode::Multiply)));
+            let px = s.rgba(1, 0);
+            assert!((px[0] - 0.5).abs() < 0.01 && px[1] < 0.01 && (px[3] - 1.0).abs() < 1e-3, "{fmt:?} multiply: {px:?}");
+            assert!(bucket_fill_inks(&mut s, a, (0, 0), 0.0, true, false, 0.5, None, false, red, None, FillMode::Clear));
+            assert!((s.rgba(1, 0)[3] - 0.5).abs() < 0.01, "{fmt:?} clear at 50 %");
+            // Locked transparency keeps the alpha, so Clear does nothing.
+            assert!(bucket_fill_inks(&mut s, a, (0, 0), 0.0, true, false, 1.0, None, true, red, None, FillMode::Clear));
+            assert!((s.rgba(1, 0)[3] - 0.5).abs() < 0.01, "{fmt:?} locked");
+        }
+    }
 }
diff --git a/crates/algo/src/seam.rs b/crates/algo/src/seam.rs
index 0cbd9a66a2..b85fba5bab 100644
--- a/crates/algo/src/seam.rs
+++ b/crates/algo/src/seam.rs
@@ -9,16 +9,26 @@
 //!
 //! A protect map (`0..=1`, e.g. an alpha channel or detected skin tones) adds a large energy so
 //! seams avoid protected pixels. Buffers are interleaved `w × h × ch` normalised floats of any
-//! colour model and depth (alpha is carried like any other channel). Deterministic.
+//! colour model and depth (alpha is carried like any other channel). Deterministic on every
+//! platform: an energy that isn't a number (from NaN samples, or infinite ones next to each other
+//! or at the border) is the highest energy, and NaN protection protects nothing, so no NaN (whose
+//! sign and payload arithmetic does not keep consistently across builds) reaches the seam search.
 
 use photocraft_raster::{Cancelled, Interrupt};
 
 /// Energy added per unit of protection: far above any gradient magnitude.
 const PROTECT_ENERGY: f32 = 1.0e4;
 
-/// Keep full horizontal detail while reducing the height used to find vertical seams. At a
-/// 24 MP working size this cuts the dynamic-programming work by about four times without
-/// quantising the output pixels or changing the requested output dimensions.
+/// The energy protection `p` (`0..=1`) adds. NaN protects nothing.
+#[inline]
+fn protection(p: f32) -> f32 {
+    if p.is_nan() { 0.0 } else { p.clamp(0.0, 1.0) * PROTECT_ENERGY }
+}
+
+/// Keep full horizontal detail while reducing the height used to find vertical seams. On a
+/// 6000×4000 image this cuts the dynamic-programming work eight times for a width change (4000
+/// rows to 500) and twelve times for a height change, without quantising the output pixels or
+/// changing the requested output dimensions.
 const SEAM_SEARCH_MAX_HEIGHT: usize = 512;
 const PROXY_SHRINK_MIN_HEIGHT: usize = 2_048;
 const PROXY_SHRINK_MIN_SEAMS: usize = 64;
@@ -33,7 +43,7 @@ pub fn energy(w: usize, h: usize, ch: usize, img: &[f32]) -> Vec<f32> {
     }
     let row = |(y, out): (usize, &mut [f32])| {
         for (x, v) in out.iter_mut().enumerate() {
-            *v = energy_at(img, w, w, h, ch, x, y);
+            *v = energy_at(img, w, w, h, ch, x, y, |xx, _| xx);
         }
     };
     #[cfg(not(target_arch = "wasm32"))]
@@ -46,20 +56,25 @@ pub fn energy(w: usize, h: usize, ch: usize, img: &[f32]) -> Vec<f32> {
     e
 }
 
-/// [`energy`] of one pixel of a `cw`-wide image whose rows are `stride` pixels apart. Shared by
-/// the full map and the per-seam updates so both give bit-identical values.
+/// [`energy`] of pixel `x` of row `y` of a `cw`-wide, `h`-tall image whose pixel `xx` of row `yy`
+/// is column `col(xx, yy)` of `img` (`w` pixels per row). Shared by the full map and the carver's
+/// per-seam updates, so both give bit-identical values. An energy that isn't a number is the
+/// highest energy (`+inf`).
+#[allow(clippy::too_many_arguments)]
 #[inline]
-fn energy_at(img: &[f32], stride: usize, cw: usize, h: usize, ch: usize, x: usize, y: usize) -> f32 {
+fn energy_at(img: &[f32], w: usize, cw: usize, h: usize, ch: usize, x: usize, y: usize, col: impl Fn(usize, usize) -> usize) -> f32 {
     let (xl, xr) = (x.saturating_sub(1), (x + 1).min(cw - 1));
     let (yu, yd) = (y.saturating_sub(1), (y + 1).min(h - 1));
-    let at = |xx: usize, yy: usize, c: usize| img[(yy * stride + xx) * ch + c];
+    let at = |xx: usize, yy: usize| (yy * w + col(xx, yy)) * ch;
+    let (centre, right, left, down, up) = (at(x, y), at(xr, y), at(xl, y), at(x, yd), at(x, yu));
     let mut s = 0.0;
     for c in 0..ch {
-        let v = at(x, y, c);
-        s += (at(xr, y, c) - v).abs() + (v - at(xl, y, c)).abs();
-        s += (at(x, yd, c) - v).abs() + (v - at(x, yu, c)).abs();
+        let v = img[centre + c];
+        s += (img[right + c] - v).abs() + (v - img[left + c]).abs();
+        s += (img[down + c] - v).abs() + (v - img[up + c]).abs();
     }
-    s * 0.5
+    let e = s * 0.5;
+    if e.is_nan() { f32::INFINITY } else { e }
 }
 
 /// The lowest-energy vertical seam: one x per row.
@@ -67,57 +82,178 @@ pub fn find_seam(w: usize, h: usize, energy: &[f32]) -> Vec<usize> {
     if w == 0 || h == 0 || energy.len() < w * h {
         return vec![0; h];
     }
-    Dp::default().seam(w, w, h, energy)
+    let off = vec![0; h];
+    let rows = Rows { stride: w, cw: w, off: &off };
+    let mut dp = Dp::default();
+    dp.full(rows, energy);
+    dp.seam(rows)
 }
 
-/// Scratch buffers for the seam search, reused across seams.
+/// Where the `cw` pixels in use of each of a carver's rows are, in buffers whose rows are
+/// `stride` apart: row y's are `off[y]..off[y] + cw` of its `stride` slots.
+#[derive(Clone, Copy)]
+struct Rows<'o> {
+    stride: usize,
+    cw: usize,
+    off: &'o [usize],
+}
+
+impl Rows<'_> {
+    fn h(&self) -> usize {
+        self.off.len()
+    }
+
+    /// Row y's pixels in use, as a range of its buffers.
+    #[inline]
+    fn of(&self, y: usize) -> std::ops::Range<usize> {
+        let start = y * self.stride + self.off[y];
+        start..start + self.cw
+    }
+}
+
+/// The seam search's dynamic programme over an energy map laid out as [`Rows`] (the carver's own
+/// layout, so a removal shifts it like the other buffers): for every pixel, the cost of the
+/// cheapest 8-connected path down to it from the top row. [`Carver`] keeps it across seams and
+/// recomputes only what each removal changed ([`Dp::update`]).
 #[derive(Default)]
 struct Dp {
+    /// Cost of the cheapest path from the top row to each pixel.
     cost: Vec<f32>,
-    next: Vec<f32>,
-    /// Per pixel, where the cheapest path came from: 0 = up-left, 1 = up, 2 = up-right.
-    from: Vec<u8>,
+}
+
+/// Pixel `x` of a `cw`-wide row with energy `e`, given the path costs of the row above (`up`):
+/// its path cost and where that path came from (0 = up-left, 1 = up, 2 = up-right). Ties go to
+/// the pixel straight up, then up-left, then up-right. The cost doesn't depend on the tie-break
+/// and the direction doesn't depend on `e`, so the seam can be traced back from the costs alone.
+/// [`row_costs`] uses it at the ends of a row and repeats its selection in between, and
+/// [`Dp::seam`] traces seams with it, so every way of filling the map gives the same bits (costs
+/// are never NaN: see [`energy_at`] and [`protection`]).
+#[inline]
+fn cell(up: &[f32], cw: usize, x: usize, e: f32) -> (f32, u8) {
+    let (b, d) = if x == 0 {
+        if cw > 1 && up[1] < up[0] { (up[1], 2) } else { (up[0], 1) }
+    } else if x + 1 == cw {
+        if up[x - 1] < up[x] { (up[x - 1], 0) } else { (up[x], 1) }
+    } else {
+        let (b, d) = if up[x - 1] < up[x] { (up[x - 1], 0) } else { (up[x], 1) };
+        if up[x + 1] < b { (up[x + 1], 2) } else { (b, d) }
+    };
+    (b + e, d)
+}
+
+/// Path costs of pixels `lo..lo + out.len()` of a `cw`-wide row with energies `e` (the whole
+/// row's), from the path costs of the row above (`up`), into `out`. [`cell`] at the ends of the
+/// row; in between, the same selection without edge tests or directions, so it vectorises.
+#[inline]
+fn row_costs(up: &[f32], e: &[f32], cw: usize, lo: usize, out: &mut [f32]) {
+    let Some(last) = (lo + out.len()).checked_sub(1) else { return };
+    let (mut a, mut b) = (lo, last);
+    if a == 0 {
+        out[0] = cell(up, cw, 0, e[0]).0;
+        a = 1;
+    }
+    if b + 1 == cw && b >= a {
+        out[b - lo] = cell(up, cw, b, e[b]).0;
+        b -= 1;
+    }
+    if a > b {
+        return;
+    }
+    // Every pixel in a..=b has all three parents: up-left, up and up-right.
+    let parents = up[a - 1..b].iter().zip(&up[a..=b]).zip(&up[a + 1..=b + 1]);
+    for ((n, &ev), ((&l, &u), &r)) in out[a - lo..=b - lo].iter_mut().zip(&e[a..=b]).zip(parents) {
+        let m = if l < u { l } else { u };
+        let m = if r < m { r } else { m };
+        *n = m + ev;
+    }
 }
 
 impl Dp {
-    /// The lowest-energy seam of a `cw`-wide, `h`-tall energy map with rows `stride` apart.
-    /// Ties go to the pixel straight up, then up-left, then up-right; at the bottom, to the
-    /// leftmost end.
-    fn seam(&mut self, stride: usize, cw: usize, h: usize, energy: &[f32]) -> Vec<usize> {
-        self.cost.clear();
-        self.cost.extend_from_slice(&energy[..cw]);
-        self.next.resize(cw, 0.0);
-        self.from.resize(cw * h, 0);
-        for y in 1..h {
-            let (cost, next) = (&self.cost[..cw], &mut self.next[..cw]);
-            let e = &energy[y * stride..y * stride + cw];
-            let from = &mut self.from[y * cw..(y + 1) * cw];
-            if cw == 1 {
-                (next[0], from[0]) = (cost[0] + e[0], 1);
-            } else {
-                let (b, d) = if cost[1] < cost[0] { (cost[1], 2) } else { (cost[0], 1) };
-                (next[0], from[0]) = (b + e[0], d);
-                // The interior has all three parents: no edge tests in the hot loop.
-                let inner = next[1..cw - 1].iter_mut().zip(&mut from[1..cw - 1]).zip(&e[1..cw - 1]).zip(cost.windows(3));
-                for (((n, f), &ev), c) in inner {
-                    let (b, d) = if c[0] < c[1] { (c[0], 0) } else { (c[1], 1) };
-                    let (b, d) = if c[2] < b { (c[2], 2) } else { (b, d) };
-                    (*n, *f) = (b + ev, d);
-                }
-                let (b, d) = if cost[cw - 2] < cost[cw - 1] { (cost[cw - 2], 0) } else { (cost[cw - 1], 1) };
-                (next[cw - 1], from[cw - 1]) = (b + e[cw - 1], d);
-            }
-            std::mem::swap(&mut self.cost, &mut self.next);
+    /// Fill the map for the pixels in use of every row of `energy`.
+    fn full(&mut self, rows: Rows, energy: &[f32]) {
+        let (cw, h) = (rows.cw, rows.h());
+        self.cost.resize(rows.stride * h, 0.0);
+        if cw == 0 || h == 0 {
+            return;
         }
-        let cost = &self.cost[..cw];
-        let mut x = (0..cw).min_by(|a, b| cost[*a].total_cmp(&cost[*b])).unwrap_or(0);
+        let first = rows.of(0);
+        self.cost[first.clone()].copy_from_slice(&energy[first]);
+        for y in 1..h {
+            let (above, rest) = self.cost.split_at_mut(y * rows.stride);
+            let (r, base) = (rows.of(y), y * rows.stride);
+            row_costs(&above[rows.of(y - 1)], &energy[r.clone()], cw, 0, &mut rest[r.start - base..r.end - base]);
+        }
+    }
+
+    /// Bring the map up to date after `seam` (one x per row, counted before the removal) was
+    /// removed from every row of the map and of `energy`, leaving `rows.cw` pixels per row.
+    ///
+    /// A pixel's path cost depends only on its energy and on the costs of its parents in the row
+    /// above. Where a pixel and all its parents are on the same side of the seam in their rows,
+    /// the removal moved them together; that leaves, in row y, only the pixels from one left of
+    /// min(seam[y-1], seam[y]) to max(seam[y-1], seam[y]) with new parents. The energy changed
+    /// only where [`Carver::update_energy`] recomputed it: from one left of the leftmost of
+    /// `seam[y-1..=y+1]` to the rightmost, which covers those pixels too. Every other pixel needs
+    /// recomputing only if a parent's cost changed, so the work follows the changed costs down
+    /// the map and narrows wherever they settle, instead of covering the whole map. Recomputed
+    /// pixels go through [`row_costs`], like a [`Dp::full`] pass's, so the map matches one over
+    /// the same energy bit for bit.
+    fn update(&mut self, rows: Rows, energy: &[f32], seam: &[usize]) {
+        let (cw, h) = (rows.cw, rows.h());
+        if cw == 0 || h == 0 || seam.len() < h {
+            return;
+        }
+        // Pixels of the row above whose cost changed: `lo..=hi`, or none when `lo > hi`.
+        let (mut changed_lo, mut changed_hi) = (usize::MAX, 0);
+        let mut fresh = Vec::new();
+        for y in 0..h {
+            let near = &seam[y.saturating_sub(1)..(y + 2).min(h)];
+            let mut lo = near.iter().min().map_or(0, |&s| s.saturating_sub(1));
+            let mut hi = near.iter().max().map_or(0, |&s| s.min(cw - 1));
+            if changed_lo <= changed_hi {
+                lo = lo.min(changed_lo.saturating_sub(1));
+                hi = hi.max((changed_hi + 1).min(cw - 1));
+            }
+            let (above, rest) = self.cost.split_at_mut(y * rows.stride);
+            let (r, base) = (rows.of(y), y * rows.stride);
+            let e = &energy[r.clone()];
+            if fresh.len() < hi + 1 - lo {
+                fresh.resize(hi + 1 - lo, 0.0);
+            }
+            let fresh = &mut fresh[..hi + 1 - lo];
+            match y.checked_sub(1) {
+                Some(u) => row_costs(&above[rows.of(u)], e, cw, lo, fresh),
+                None => fresh.copy_from_slice(&e[lo..=hi]),
+            }
+            // Store only what changed, and remember where that was for the row below.
+            let row = &mut rest[r.start - base + lo..r.start - base + hi + 1];
+            let differs = |(a, b): (&f32, &f32)| a.to_bits() != b.to_bits();
+            (changed_lo, changed_hi) = (usize::MAX, 0);
+            if let Some(first) = fresh.iter().zip(row.iter()).position(differs) {
+                let last = fresh.iter().zip(row.iter()).rposition(differs).unwrap_or(first);
+                row[first..=last].copy_from_slice(&fresh[first..=last]);
+                (changed_lo, changed_hi) = (lo + first, lo + last);
+            }
+        }
+    }
+
+    /// The lowest-energy seam of the map: one x per row. At the bottom, ties go to the leftmost
+    /// end; going up, [`cell`] tells where each pixel's path came from.
+    fn seam(&self, rows: Rows) -> Vec<usize> {
+        let (cw, h) = (rows.cw, rows.h());
         let mut seam = vec![0usize; h];
+        if cw == 0 || h == 0 {
+            return seam;
+        }
+        let last = &self.cost[rows.of(h - 1)];
+        let mut x = (0..cw).min_by(|a, b| last[*a].total_cmp(&last[*b])).unwrap_or(0);
         for y in (0..h).rev() {
             seam[y] = x;
             if y > 0 {
-                x = match self.from[y * cw + x] {
-                    0 => x - 1,
-                    2 => x + 1,
+                // `cell` never points past either end of the row; saturate rather than trust it.
+                x = match cell(&self.cost[rows.of(y - 1)], cw, x, 0.0).1 {
+                    0 => x.saturating_sub(1),
+                    2 => (x + 1).min(cw - 1),
                     _ => x,
                 };
             }
@@ -126,121 +262,223 @@ impl Dp {
     }
 }
 
-/// Shrinks an image one seam at a time in place. Rows keep their original stride, so removing a
-/// seam shifts only the rest of each row (in parallel), and the energy map is updated only next
-/// to the removed seam instead of being recomputed: the gradient of a pixel changes only when a
-/// neighbour does, which happens within a pixel of the seam in its own row and the rows around it.
-struct Carver {
-    stride: usize,
-    cw: usize,
+/// Shrinks an image one seam at a time without moving its pixels: the carver keeps which source
+/// column each remaining pixel is (`idx`) and reads pixels through it. A removal shifts, in each
+/// row, whichever side of the seam is shorter in the three per-pixel buffers (in parallel over
+/// rows), and nothing is recomputed in full: the gradient of a pixel changes only when a
+/// neighbour does, which happens within a pixel of the seam in its own row and the rows around
+/// it, and the seam search's path costs are updated from there down ([`Dp::update`]).
+struct Carver<'a> {
+    /// The image, `w × h × ch`, and the protection, one value per pixel: as given, never moved.
+    src: &'a [f32],
+    prot: Option<&'a [f32]>,
+    w: usize,
     h: usize,
     ch: usize,
-    img: Vec<f32>,
-    prot: Option<Vec<f32>>,
+    /// Pixels left per row.
+    cw: usize,
+    /// Where each row's first remaining pixel is in the per-pixel buffers (see [`Rows`]).
+    off: Vec<usize>,
+    /// Source column of each remaining pixel (rows `w` apart; layer areas are at most i32::MAX
+    /// wide, so `u32` holds any column).
+    idx: Vec<u32>,
     /// Energy plus protection, as the seam search sees it.
     e: Vec<f32>,
-    /// Original column of each pixel, when the caller needs to know which ones were removed.
-    idx: Option<Vec<usize>>,
+    /// The seam search over `e`, kept up to date.
     dp: Dp,
 }
 
-impl Carver {
-    fn new(w: usize, h: usize, ch: usize, img: Vec<f32>, prot: Option<Vec<f32>>, track: bool) -> Self {
-        let mut e = energy(w, h, ch, &img);
-        if let Some(p) = &prot {
-            for (e, p) in e.iter_mut().zip(p) {
-                *e += p.clamp(0.0, 1.0) * PROTECT_ENERGY;
+impl<'a> Carver<'a> {
+    fn new(w: usize, h: usize, ch: usize, src: &'a [f32], prot: Option<&'a [f32]>) -> Self {
+        let mut e = energy(w, h, ch, src);
+        if let Some(p) = prot {
+            for (e, &p) in e.iter_mut().zip(p) {
+                *e += protection(p);
             }
         }
-        let idx = track.then(|| (0..h).flat_map(|_| 0..w).collect());
-        Carver { stride: w, cw: w, h, ch, img, prot, e, idx, dp: Dp::default() }
+        let mut idx = Vec::with_capacity(w * h);
+        for _ in 0..h {
+            idx.extend((0..w).map(|x| u32::try_from(x).unwrap_or(u32::MAX)));
+        }
+        let off = vec![0; h];
+        let mut dp = Dp::default();
+        dp.full(Rows { stride: w, cw: w, off: &off }, &e);
+        Carver { src, prot, w, h, ch, cw: w, off, idx, e, dp }
     }
 
-    /// Remove the lowest-energy seam. Returns, per row, the removed column (the original column
-    /// when tracking).
+    /// Remove the lowest-energy seam. Returns, per row, the source column removed.
     fn remove_seam(&mut self) -> Vec<usize> {
-        let (stride, cw, h, ch) = (self.stride, self.cw, self.h, self.ch);
-        let seam = self.dp.seam(stride, cw, h, &self.e);
-        let removed = match &self.idx {
-            Some(idx) => seam.iter().enumerate().map(|(y, &x)| idx[y * stride + x]).collect(),
-            None => seam.clone(),
-        };
-        shift_rows(&mut self.img, stride * ch, &seam, ch, cw);
-        shift_rows(&mut self.e, stride, &seam, 1, cw);
-        if let Some(p) = &mut self.prot {
-            shift_rows(p, stride, &seam, 1, cw);
-        }
-        if let Some(idx) = &mut self.idx {
-            shift_rows(idx, stride, &seam, 1, cw);
+        if self.cw == 0 {
+            return Vec::new();
         }
+        let rows = Rows { stride: self.w, cw: self.cw, off: &self.off };
+        let seam = self.dp.seam(rows);
+        let removed = seam.iter().enumerate().map(|(y, &x)| self.idx[rows.of(y).start + x] as usize).collect();
+        self.shift(&seam);
         self.cw -= 1;
         self.update_energy(&seam);
+        self.dp.update(Rows { stride: self.w, cw: self.cw, off: &self.off }, &self.e, &seam);
         removed
     }
 
+    /// Remove `seam[y]` from each row of the per-pixel buffers.
+    fn shift(&mut self, seam: &[usize]) {
+        let (w, cw) = (self.w, self.cw);
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            use rayon::prelude::*;
+            self.e
+                .par_chunks_mut(w)
+                .zip(self.idx.par_chunks_mut(w))
+                .zip(self.dp.cost.par_chunks_mut(w))
+                .zip(self.off.par_iter_mut())
+                .zip(seam.par_iter())
+                .for_each(|((((e, idx), cost), off), &x)| shift_row(e, idx, cost, off, x, cw));
+        }
+        #[cfg(target_arch = "wasm32")]
+        self.e
+            .chunks_mut(w)
+            .zip(self.idx.chunks_mut(w))
+            .zip(self.dp.cost.chunks_mut(w))
+            .zip(self.off.iter_mut())
+            .zip(seam)
+            .for_each(|((((e, idx), cost), off), &x)| shift_row(e, idx, cost, off, x, cw));
+    }
+
     /// Recompute the energy of the pixels whose neighbours changed when `seam` was removed: in
     /// row y, from one left of the leftmost of the seam's x in rows y-1..=y+1 to the rightmost.
     fn update_energy(&mut self, seam: &[usize]) {
-        let (stride, cw, h, ch) = (self.stride, self.cw, self.h, self.ch);
+        let (w, cw, h, ch) = (self.w, self.cw, self.h, self.ch);
         if cw == 0 {
             return;
         }
-        let (img, prot) = (&self.img, self.prot.as_deref());
+        let (src, prot, off, idx) = (self.src, self.prot, &self.off, &self.idx);
+        let col = |xx: usize, yy: usize| idx[yy * w + off[yy] + xx] as usize;
         let row = |(y, e): (usize, &mut [f32])| {
             let near = &seam[y.saturating_sub(1)..(y + 2).min(h)];
             let lo = near.iter().min().map_or(0, |&s| s.saturating_sub(1));
             let hi = near.iter().max().map_or(0, |&s| s.min(cw - 1));
             for x in lo..=hi {
-                let mut v = energy_at(img, stride, cw, h, ch, x, y);
+                let mut v = energy_at(src, w, cw, h, ch, x, y, col);
                 if let Some(p) = prot {
-                    v += p[y * stride + x].clamp(0.0, 1.0) * PROTECT_ENERGY;
+                    v += protection(p[y * w + col(x, y)]);
                 }
-                e[x] = v;
+                e[off[y] + x] = v;
+            }
+        };
+        // A few pixels per row (seams move at most one column per row), but each waits on reads
+        // from three rows of the source: rows in parallel overlap the waits.
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            use rayon::prelude::*;
+            self.e.par_chunks_mut(w).enumerate().for_each(row);
+        }
+        #[cfg(target_arch = "wasm32")]
+        self.e.chunks_mut(w).enumerate().for_each(row);
+    }
+
+    /// The carved pixels, `cw × h × ch`, rows packed.
+    fn into_pixels(self) -> Vec<f32> {
+        let (w, cw, ch) = (self.w, self.cw, self.ch);
+        let mut out = vec![0.0f32; cw * self.h * ch];
+        if cw == 0 {
+            return out;
+        }
+        let (src, off, idx) = (self.src, &self.off, &self.idx);
+        let row = |(y, out): (usize, &mut [f32])| {
+            let cols = &idx[y * w + off[y]..y * w + off[y] + cw];
+            for (px, &x) in out.chunks_exact_mut(ch).zip(cols) {
+                let s = (y * w + x as usize) * ch;
+                px.copy_from_slice(&src[s..s + ch]);
             }
         };
         #[cfg(not(target_arch = "wasm32"))]
         {
             use rayon::prelude::*;
-            self.e.par_chunks_mut(stride).enumerate().for_each(row);
+            out.par_chunks_mut(cw * ch).enumerate().for_each(row);
         }
         #[cfg(target_arch = "wasm32")]
-        self.e.chunks_mut(stride).enumerate().for_each(row);
-    }
-
-    /// The carved pixels, `cw × h × ch`, rows packed.
-    fn into_pixels(self) -> Vec<f32> {
-        let (row, used) = (self.stride * self.ch, self.cw * self.ch);
-        if row == used {
-            return self.img;
-        }
-        self.img.chunks(row).flat_map(|r| &r[..used]).copied().collect()
+        out.chunks_mut(cw * ch).enumerate().for_each(row);
+        out
     }
 }
 
-/// Remove pixel `seam[y]` (of `n` values) from each `row_len`-long row whose first `cw` pixels
-/// are in use, by shifting the rest of the row left.
-fn shift_rows<T: Copy + Send>(buf: &mut [T], row_len: usize, seam: &[usize], n: usize, cw: usize) {
-    let shift = |(r, &x): (&mut [T], &usize)| r.copy_within((x + 1) * n..cw * n, x * n);
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        use rayon::prelude::*;
-        buf.par_chunks_mut(row_len).zip(seam.par_iter()).for_each(shift);
+/// Remove pixel `x` of the `cw` in use, from `off` on, of one row of a carver's per-pixel
+/// buffers, moving whichever side of it holds fewer pixels (the row then starts one later when
+/// that is the left side).
+fn shift_row(e: &mut [f32], idx: &mut [u32], cost: &mut [f32], off: &mut usize, x: usize, cw: usize) {
+    let o = *off;
+    if x < cw - 1 - x {
+        e.copy_within(o..o + x, o + 1);
+        idx.copy_within(o..o + x, o + 1);
+        cost.copy_within(o..o + x, o + 1);
+        *off = o + 1;
+    } else {
+        e.copy_within(o + x + 1..o + cw, o + x);
+        idx.copy_within(o + x + 1..o + cw, o + x);
+        cost.copy_within(o + x + 1..o + cw, o + x);
     }
-    #[cfg(target_arch = "wasm32")]
-    buf.chunks_mut(row_len).zip(seam).for_each(shift);
 }
 
 fn transpose(w: usize, h: usize, ch: usize, img: &[f32]) -> Vec<f32> {
     let mut out = vec![0.0f32; img.len()];
-    for y in 0..h {
-        for x in 0..w {
-            let (s, d) = ((y * w + x) * ch, (x * h + y) * ch);
-            out[d..d + ch].copy_from_slice(&img[s..s + ch]);
-        }
+    if w == 0 || h == 0 || ch == 0 {
+        return out;
     }
+    // Output rows (source columns) in blocks, so each source cache line serves several of them.
+    const BLOCK: usize = 16;
+    let block = |(b, out): (usize, &mut [f32])| {
+        let x0 = b * BLOCK;
+        let n = out.len() / (h * ch);
+        for y in 0..h {
+            for i in 0..n {
+                let (s, d) = ((y * w + x0 + i) * ch, (i * h + y) * ch);
+                out[d..d + ch].copy_from_slice(&img[s..s + ch]);
+            }
+        }
+    };
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        use rayon::prelude::*;
+        out.par_chunks_mut(BLOCK * h * ch).enumerate().for_each(block);
+    }
+    #[cfg(target_arch = "wasm32")]
+    out.chunks_mut(BLOCK * h * ch).enumerate().for_each(block);
     out
 }
 
+/// Each `step` rows of `src` (`h` rows of `row_len` values) averaged into one, the last group
+/// possibly shorter: `h.div_ceil(step)` rows.
+fn average_rows(src: &[f32], row_len: usize, h: usize, step: usize) -> Vec<f32> {
+    let mut out = vec![0.0; h.div_ceil(step) * row_len];
+    if row_len == 0 {
+        return out;
+    }
+    let group = |(py, out_row): (usize, &mut [f32])| {
+        let y0 = py * step;
+        let y1 = (y0 + step).min(h);
+        let divisor = (y1 - y0) as f32;
+        for y in y0..y1 {
+            for (out, &sample) in out_row.iter_mut().zip(&src[y * row_len..(y + 1) * row_len]) {
+                *out += sample / divisor;
+            }
+        }
+    };
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        use rayon::prelude::*;
+        out.par_chunks_exact_mut(row_len).enumerate().for_each(group);
+    }
+    #[cfg(target_arch = "wasm32")]
+    out.chunks_exact_mut(row_len).enumerate().for_each(group);
+    out
+}
+
+/// No pixels or channels to work with, or `img` holds fewer than `w × h × ch` values.
+fn unusable(w: usize, h: usize, ch: usize, img: &[f32]) -> bool {
+    w == 0 || h == 0 || ch == 0 || w.checked_mul(h).and_then(|n| n.checked_mul(ch)).is_none_or(|n| img.len() < n)
+}
+
 /// Change the width of `img` to `new_w` by removing or duplicating vertical seams.
 pub fn carve_width(w: usize, h: usize, ch: usize, img: &[f32], protect: Option<&[f32]>, new_w: usize) -> Vec<f32> {
     // Never cancelled; the fallback is unreachable.
@@ -250,15 +488,23 @@ pub fn carve_width(w: usize, h: usize, ch: usize, img: &[f32], protect: Option<&
 /// [`carve_width`] that checks `ctl` before every seam and reports progress per seam.
 pub fn carve_width_with(w: usize, h: usize, ch: usize, img: &[f32], protect: Option<&[f32]>, new_w: usize, ctl: &Interrupt) -> Result<Vec<f32>, Cancelled> {
     let new_w = new_w.max(1);
-    if new_w == w || w == 0 || h == 0 {
+    // Nothing to carve: no pixels or channels, or fewer values than the size says.
+    if unusable(w, h, ch, img) {
         return Ok(img.to_vec());
     }
+    // Values past the size are not part of the image.
+    let img = img.get(..w * h * ch).unwrap_or(img);
+    if new_w == w {
+        return Ok(img.to_vec());
+    }
+    // A protection map that doesn't cover the image protects nothing.
+    let protect = protect.filter(|p| p.len() >= w * h);
     let seams = new_w.abs_diff(w).max(1) as f32;
     if new_w < w {
         if h >= PROXY_SHRINK_MIN_HEIGHT && w - new_w >= PROXY_SHRINK_MIN_SEAMS {
             return carve_width_proxy_height(w, h, ch, img, protect, new_w, ctl);
         }
-        let mut carver = Carver::new(w, h, ch, img.to_vec(), protect.map(<[f32]>::to_vec), false);
+        let mut carver = Carver::new(w, h, ch, img, protect);
         while carver.cw > new_w {
             ctl.check()?;
             ctl.progress((w - carver.cw) as f32 / seams);
@@ -272,7 +518,7 @@ pub fn carve_width_with(w: usize, h: usize, ch: usize, img: &[f32], protect: Opt
     while cw < new_w {
         let k = (new_w - cw).min((cw / 2).max(1));
         // Find k seams on a shrinking copy, mapping each back to original columns.
-        let mut carver = Carver::new(cw, h, ch, cur.clone(), prot.clone(), true);
+        let mut carver = Carver::new(cw, h, ch, &cur, prot.as_deref());
         let mut dup: Vec<Vec<usize>> = vec![Vec::with_capacity(k); h];
         for _ in 0..k {
             // A 1 px wide image's only seam is its one column: take it, so it is duplicated.
@@ -329,103 +575,65 @@ fn carve_width_proxy_height(w: usize, h: usize, ch: usize, img: &[f32], protect:
     let step = h.div_ceil(SEAM_SEARCH_MAX_HEIGHT);
     let proxy_h = h.div_ceil(step);
     let row_len = w * ch;
-    let proxy_row_len = proxy_h * row_len;
-    let mut proxy = vec![0.0; proxy_row_len];
-    for (py, out_row) in proxy.chunks_exact_mut(row_len).enumerate() {
-        let y0 = py * step;
-        let y1 = (y0 + step).min(h);
-        let divisor = (y1 - y0) as f32;
-        for y in y0..y1 {
-            let in_row = &img[y * row_len..(y + 1) * row_len];
-            for (out, &sample) in out_row.iter_mut().zip(in_row) {
-                *out += sample / divisor;
-            }
-        }
-    }
-    let proxy_protect = protect.map(|mask| {
-        let mut reduced = vec![0.0; proxy_h * w];
-        for (py, out_row) in reduced.chunks_exact_mut(w).enumerate() {
-            let y0 = py * step;
-            let y1 = (y0 + step).min(h);
-            let divisor = (y1 - y0) as f32;
-            for y in y0..y1 {
-                let in_row = &mask[y * w..(y + 1) * w];
-                for (out, &sample) in out_row.iter_mut().zip(in_row) {
-                    *out += sample / divisor;
-                }
-            }
-        }
-        reduced
-    });
+    let proxy = average_rows(img, row_len, h, step);
+    let proxy_protect = protect.map(|mask| average_rows(mask, w, h, step));
 
     let seam_count = w - new_w;
-    // Removing a seam shifts the panel left, so a panel column is not an original one. Tracking
-    // the original column per pixel costs a third buffer that every seam has to shift (24 MB a
-    // seam at 24 MP); counting the columns already taken from that row is exact and costs a
-    // binary search per removed column.
-    let mut carver = Carver::new(w, proxy_h, ch, proxy, proxy_protect, false);
-    let mut removed_by_row: Vec<Vec<usize>> = vec![Vec::new(); proxy_h];
-    let mut taken = 0usize;
+    let mut carver = Carver::new(w, proxy_h, ch, &proxy, proxy_protect.as_deref());
+    let mut removed = Vec::with_capacity(seam_count);
     while carver.cw > new_w {
         ctl.check()?;
-        record_removed(&mut removed_by_row, &carver.remove_seam());
-        taken += 1;
-        ctl.progress(taken as f32 / seam_count as f32);
+        removed.push(carver.remove_seam());
+        ctl.progress(removed.len() as f32 / seam_count as f32);
     }
-    let mut out = Vec::with_capacity(new_w * h * ch);
-    let mut columns = vec![0; seam_count];
-    for y in 0..h {
+
+    let mut removed_by_row = Vec::with_capacity(proxy_h);
+    for proxy_y in 0..proxy_h {
+        let mut columns: Vec<usize> = removed.iter().map(|path| path[proxy_y]).collect();
+        columns.sort_unstable();
+        removed_by_row.push(columns);
+    }
+    // Each full-resolution row removes the columns interpolated between its two proxy rows'.
+    let rebuild = |columns: &mut Vec<usize>, (y, out): (usize, &mut [f32])| -> Result<(), Cancelled> {
         ctl.check()?;
         let proxy_y = (y / step).min(proxy_h - 1);
         let next_proxy_y = (proxy_y + 1).min(proxy_h - 1);
         let blend = (y % step) as f32 / step as f32;
         let lower = &removed_by_row[proxy_y];
         let upper = &removed_by_row[next_proxy_y];
+        columns.clear();
         let mut min_x = 0;
-        for (i, x) in columns.iter_mut().enumerate() {
+        for i in 0..seam_count {
             let interpolated = lower[i] as f32 + (upper[i] as f32 - lower[i] as f32) * blend;
             let max_x = w - (seam_count - i);
-            *x = (interpolated.round() as usize).clamp(min_x, max_x);
+            let x = (interpolated.round() as usize).clamp(min_x, max_x);
+            columns.push(x);
             min_x = x.saturating_add(1);
         }
-        let mut next = 0;
+        // The columns rise strictly within the row: copy the runs between them.
         let row = &img[y * row_len..(y + 1) * row_len];
-        for (x, pixel) in row.chunks_exact(ch).enumerate() {
-            if columns.get(next) == Some(&x) {
-                next += 1;
-            } else {
-                out.extend_from_slice(pixel);
-            }
+        let (mut from, mut at) = (0, 0);
+        for &x in columns.iter() {
+            let run = (x - from) * ch;
+            out[at..at + run].copy_from_slice(&row[from * ch..x * ch]);
+            (from, at) = (x + 1, at + run);
         }
-    }
-    ctl.progress(1.0);
-    Ok(out)
-}
-
-/// Add one seam, given in panel columns, to each row's sorted list of removed original columns.
-/// For the `i`-th column already taken from a row, `o - i` is the panel column it occupied, and
-/// that never decreases along the list, so the taken columns at or left of panel column `x` are a
-/// prefix found by binary search. `x` plus that prefix's length is the original column, and every
-/// removal the search passed is left of it, so it inserts where the search stopped. The rows are
-/// independent, so they update in parallel like the pixel shift.
-fn record_removed(removed_by_row: &mut [Vec<usize>], seam: &[usize]) {
-    // The entries are the original columns still taken from one row, sorted, so entry `i` is at
-    // least `i` and `o - i` cannot underflow.
-    let add = |(row, &x): (&mut Vec<usize>, &usize)| {
-        let (mut lo, mut hi) = (0, row.len());
-        while lo < hi {
-            let mid = lo + (hi - lo) / 2;
-            if row[mid] - mid <= x { lo = mid + 1 } else { hi = mid }
-        }
-        row.insert(lo, x + lo);
+        out[at..].copy_from_slice(&row[from * ch..]);
+        Ok(())
     };
+    let mut out = vec![0.0f32; new_w * h * ch];
     #[cfg(not(target_arch = "wasm32"))]
     {
         use rayon::prelude::*;
-        removed_by_row.par_iter_mut().zip(seam.par_iter()).for_each(add);
+        out.par_chunks_exact_mut(new_w * ch).enumerate().try_for_each_init(|| Vec::with_capacity(seam_count), rebuild)?;
     }
     #[cfg(target_arch = "wasm32")]
-    removed_by_row.iter_mut().zip(seam.iter()).for_each(add);
+    {
+        let mut columns = Vec::with_capacity(seam_count);
+        out.chunks_exact_mut(new_w * ch).enumerate().try_for_each(|r| rebuild(&mut columns, r))?;
+    }
+    ctl.progress(1.0);
+    Ok(out)
 }
 
 /// Content-aware resize of `img` to `new_w × new_h` (width first, then height by transposing).
@@ -448,6 +656,11 @@ pub fn carve_with(
     ctl: &Interrupt,
 ) -> Result<Vec<f32>, Cancelled> {
     let (new_w, new_h) = (new_w.max(1), new_h.max(1));
+    if unusable(w, h, ch, img) {
+        return Ok(img.to_vec());
+    }
+    let img = img.get(..w * h * ch).unwrap_or(img);
+    let protect = protect.filter(|p| p.len() >= w * h);
     // Split progress between the passes by their seam counts.
     let (sw, sh) = (new_w.abs_diff(w) as f32, new_h.abs_diff(h) as f32);
     let split = if sw + sh > 0.0 { sw / (sw + sh) } else { 1.0 };
@@ -457,21 +670,40 @@ pub fn carve_with(
     if new_h == h {
         return Ok(wide);
     }
-    // Protection follows the width change by plain resampling (it only steers seams).
-    let prot_t = protect.map(|p| transpose(new_w, h, 1, &resize_bilinear(w, h, 1, p, new_w, h)));
+    let prot_t = protect.map(|p| transpose(new_w, h, 1, &resample_protection(w, h, p, new_w)));
     let t = transpose(new_w, h, ch, &wide);
     let second = |f: f32| ctl.progress(split + f * (1.0 - split));
     let tall = carve_width_with(h, new_w, ch, &t, prot_t.as_deref(), new_h, &Interrupt::new(&cancel, &second))?;
     Ok(transpose(new_h, new_w, ch, &tall))
 }
 
+/// The protection map `p` (`w × h`) for the height pass, after the width changed to `new_w`:
+/// plainly resampled (it only steers seams). Where values out of `0..=1` resample to NaN
+/// (infinities, or neighbours whose difference overflows), the map clamped to `0..=1` (NaN to 0)
+/// resampled instead, so an infinite protection still protects.
+fn resample_protection(w: usize, h: usize, p: &[f32], new_w: usize) -> Vec<f32> {
+    let mut out = resize_bilinear(w, h, 1, p, new_w, h);
+    if out.iter().any(|v| v.is_nan()) {
+        let clamped: Vec<f32> = p.iter().map(|&v| if v.is_nan() { 0.0 } else { v.clamp(0.0, 1.0) }).collect();
+        for (v, c) in out.iter_mut().zip(resize_bilinear(w, h, 1, &clamped, new_w, h)) {
+            if v.is_nan() {
+                *v = c;
+            }
+        }
+    }
+    out
+}
+
 /// Plain bilinear resize (the non-content-aware part of the Amount blend).
 pub fn resize_bilinear(w: usize, h: usize, ch: usize, img: &[f32], nw: usize, nh: usize) -> Vec<f32> {
-    let mut out = vec![0.0f32; nw * nh * ch];
-    if w == 0 || h == 0 {
+    let Some(len) = nw.checked_mul(nh).and_then(|n| n.checked_mul(ch)) else {
+        return Vec::new();
+    };
+    let mut out = vec![0.0f32; len];
+    if len == 0 || unusable(w, h, ch, img) {
         return out;
     }
-    for y in 0..nh {
+    let row = |(y, out): (usize, &mut [f32])| {
         let fy = ((y as f32 + 0.5) * h as f32 / nh as f32 - 0.5).clamp(0.0, (h - 1) as f32);
         let (y0, ty) = (fy.floor() as usize, fy.fract());
         let y1 = (y0 + 1).min(h - 1);
@@ -483,10 +715,17 @@ pub fn resize_bilinear(w: usize, h: usize, ch: usize, img: &[f32], nw: usize, nh
                 let p = |xx: usize, yy: usize| img[(yy * w + xx) * ch + c];
                 let top = p(x0, y0) + (p(x1, y0) - p(x0, y0)) * tx;
                 let bot = p(x0, y1) + (p(x1, y1) - p(x0, y1)) * tx;
-                out[(y * nw + x) * ch + c] = top + (bot - top) * ty;
+                out[x * ch + c] = top + (bot - top) * ty;
             }
         }
+    };
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        use rayon::prelude::*;
+        out.par_chunks_mut(nw * ch).enumerate().for_each(row);
     }
+    #[cfg(target_arch = "wasm32")]
+    out.chunks_mut(nw * ch).enumerate().for_each(row);
     out
 }
 
@@ -515,7 +754,7 @@ mod tests {
     /// The straightforward implementation the per-seam carver replaced (full energy map, fresh
     /// seam search and a new buffer per seam), kept as the oracle for `carver_matches_reference`.
     mod reference {
-        use super::super::{PROTECT_ENERGY, resize_bilinear, transpose};
+        use super::super::{protection, resample_protection, transpose};
 
         pub(super) fn energy(w: usize, h: usize, ch: usize, img: &[f32]) -> Vec<f32> {
             let mut e = vec![0.0f32; w * h];
@@ -530,7 +769,8 @@ mod tests {
                         s += (at(xr, y, c) - v).abs() + (v - at(xl, y, c)).abs();
                         s += (at(x, yd, c) - v).abs() + (v - at(x, yu, c)).abs();
                     }
-                    e[y * w + x] = s * 0.5;
+                    let v = s * 0.5;
+                    e[y * w + x] = if v.is_nan() { f32::INFINITY } else { v };
                 }
             }
             e
@@ -583,8 +823,8 @@ mod tests {
             }
             let protect_e = |e: &mut [f32], p: Option<&Vec<f32>>| {
                 if let Some(p) = p {
-                    for (e, p) in e.iter_mut().zip(p) {
-                        *e += p.clamp(0.0, 1.0) * PROTECT_ENERGY;
+                    for (e, &p) in e.iter_mut().zip(p) {
+                        *e += protection(p);
                     }
                 }
             };
@@ -667,7 +907,7 @@ mod tests {
             if new_h == h {
                 return wide;
             }
-            let prot_t = protect.map(|p| transpose(new_w, h, 1, &resize_bilinear(w, h, 1, p, new_w, h)));
+            let prot_t = protect.map(|p| transpose(new_w, h, 1, &resample_protection(w, h, p, new_w)));
             let t = transpose(new_w, h, ch, &wide);
             let tall = carve_width(h, new_w, ch, &t, prot_t.as_deref(), new_h);
             transpose(new_h, new_w, ch, &tall)
@@ -708,6 +948,161 @@ mod tests {
         }
     }
 
+    /// After every removal, the carver's incrementally updated seam search matches a full pass
+    /// over its current energy bit for bit (path costs and the seam traced from them), on images
+    /// where seams run through the edges, through flat areas full of ties and through protection.
+    /// Its energy matches a fresh map of the pixels left, and so do the pixels.
+    #[test]
+    fn incremental_dp_matches_full_dp() {
+        let mut ramp = vec![0.0f32; 120 * 90];
+        for (i, v) in ramp.iter_mut().enumerate() {
+            let (x, y) = ((i % 120) as f32, (i / 120) as f32);
+            *v = ((x * 0.07).sin() * (y * 0.05).cos() * 0.5 + 0.5).clamp(0.0, 1.0);
+        }
+        // NaN and infinite samples and NaN protection: infinite energies, never NaN costs.
+        let mut odd = noise(40 * 30 * 3, 255, 11);
+        odd.iter_mut().step_by(13).for_each(|v| *v = f32::NAN);
+        odd.iter_mut().skip(5).step_by(17).for_each(|v| *v = f32::INFINITY);
+        let mut odd_prot = noise(40 * 30, 3, 12);
+        odd_prot.iter_mut().step_by(7).for_each(|v| *v = -f32::NAN);
+        // (w, h, channels, image, protection, seams to remove)
+        type Case = (usize, usize, usize, Vec<f32>, Option<Vec<f32>>, usize);
+        let cases: Vec<Case> = vec![
+            (120, 90, 1, ramp, None, 40),
+            (97, 64, 3, noise(97 * 64 * 3, 2, 5), None, 90),
+            (80, 70, 4, noise(80 * 70 * 4, 1000, 6), Some(noise(80 * 70, 3, 7)), 60),
+            (64, 50, 3, bar(64, 50), None, 63),
+            (33, 1, 1, noise(33, 5, 8), None, 32),
+            (2, 40, 3, noise(2 * 40 * 3, 9, 9), None, 2),
+            (50, 40, 1, vec![0.5; 50 * 40], Some(noise(50 * 40, 2, 10)), 49),
+            (40, 30, 3, odd, Some(odd_prot), 25),
+        ];
+        let bits = |v: &[f32]| v.iter().map(|f| f.to_bits()).collect::<Vec<_>>();
+        for (case, (w, h, ch, img, prot, seams)) in cases.into_iter().enumerate() {
+            let mut c = Carver::new(w, h, ch, &img, prot.as_deref());
+            for step in 0..=seams {
+                let rows = Rows { stride: c.w, cw: c.cw, off: &c.off };
+                let mut fresh = Dp::default();
+                fresh.full(rows, &c.e);
+                for y in 0..h {
+                    assert_eq!(bits(&c.dp.cost[rows.of(y)]), bits(&fresh.cost[rows.of(y)]), "case {case} step {step} row {y}: costs");
+                }
+                assert_eq!(c.dp.seam(rows), fresh.seam(rows), "case {case} step {step}: seam");
+                // The pixels left, packed, and their energy (plus protection) from scratch.
+                let left: Vec<f32> = (0..h)
+                    .flat_map(|y| c.idx[rows.of(y)].iter().flat_map(move |&x| (0..ch).map(move |k| (y * w + x as usize) * ch + k)))
+                    .map(|i| img[i])
+                    .collect();
+                let mut want = energy(c.cw, h, ch, &left);
+                if let Some(p) = &prot {
+                    let kept = (0..h).flat_map(|y| c.idx[rows.of(y)].iter().map(move |&x| y * w + x as usize));
+                    for (e, i) in want.iter_mut().zip(kept) {
+                        *e += protection(p[i]);
+                    }
+                }
+                let have: Vec<f32> = (0..h).flat_map(|y| c.e[rows.of(y)].to_vec()).collect();
+                assert_eq!(bits(&have), bits(&want), "case {case} step {step}: energy");
+                if step == seams {
+                    assert_eq!(bits(&c.into_pixels()), bits(&left), "case {case}: pixels");
+                    break;
+                }
+                c.remove_seam();
+            }
+        }
+    }
+
+    /// Hostile but well-formed shapes return early instead of panicking: no channels, empty
+    /// sizes (also through the height pass), and images or protection maps shorter than their
+    /// size says (a short map protects nothing).
+    #[test]
+    fn degenerate_inputs_do_not_panic() {
+        assert!(carve(3, 3, 0, &[], None, 2, 2).is_empty());
+        assert!(carve(3, 3, 0, &[], None, 5, 5).is_empty());
+        assert!(transpose(3, 3, 0, &[]).is_empty());
+        assert!(resize_bilinear(3, 3, 0, &[], 2, 2).is_empty());
+        assert!(resize_bilinear(3, 3, 1, &[0.5; 9], 0, 2).is_empty());
+        assert!(resize_bilinear(3, 3, 1, &[0.5; 9], 2, 0).is_empty());
+        assert_eq!(resize_bilinear(3, 3, 1, &[0.5; 4], 2, 2), vec![0.0; 4]);
+        assert!(carve(0, 5, 3, &[], None, 3, 7).is_empty());
+        assert!(carve(0, 5, 3, &[], None, 3, 2).is_empty());
+        let img = noise(10 * 5, 7, 3);
+        assert_eq!(carve(10, 5, 1, &img, Some(&[0.0; 3]), 4, 5), carve(10, 5, 1, &img, None, 4, 5));
+        assert_eq!(carve(10, 5, 1, &img, Some(&[0.0; 3]), 4, 3), carve(10, 5, 1, &img, None, 4, 3));
+        assert_eq!(carve(10, 5, 3, &[0.5; 20], None, 4, 5), vec![0.5; 20]);
+        assert_eq!(carve_width(usize::MAX, 2, 4, &[0.5; 8], None, 1), vec![0.5; 8]);
+        // Values past the size are ignored, through both passes.
+        let long = noise(20, 7, 4);
+        assert_eq!(carve(5, 3, 1, &long, None, 3, 3), carve(5, 3, 1, &long[..15], None, 3, 3));
+        assert_eq!(carve(5, 3, 1, &long, None, 5, 2), carve(5, 3, 1, &long[..15], None, 5, 2));
+    }
+
+    /// Infinite samples, and finite ones whose differences overflow, give energies that aren't
+    /// numbers; those are the highest energy (pinned deliberately: the code before NaN-free costs
+    /// fed NaN to the seam search and chose differently).
+    #[test]
+    fn infinite_samples_carve_deterministically() {
+        let inf = f32::INFINITY;
+        assert_eq!(carve(2, 1, 1, &[inf, 0.5], None, 1, 1), [0.5]);
+        assert_eq!(carve(2, 1, 1, &[f32::MAX, f32::MAX], None, 6, 1), [f32::MAX, inf, inf, inf, inf, f32::MAX]);
+        let mut img = noise(30 * 20 * 3, 255, 41);
+        img.iter_mut().step_by(11).for_each(|v| *v = inf);
+        img.iter_mut().skip(4).step_by(23).for_each(|v| *v = -inf);
+        let out = carve(30, 20, 3, &img, None, 21, 14);
+        assert_eq!(out.len(), 21 * 14 * 3);
+        assert_eq!(out, carve(30, 20, 3, &img, None, 21, 14));
+    }
+
+    /// Infinite protection protects like full protection in the height pass too, where the map
+    /// is resampled (and an infinity alone would resample to NaN).
+    #[test]
+    fn infinite_protection_protects_in_both_passes() {
+        let (w, h) = (6, 6);
+        let img: Vec<f32> = (0..w * h).map(|i| (i * 7 % 5) as f32 / 4.0).collect();
+        let row = |v: f32| (0..w * h).map(|i| if i / w == 2 { v } else { 0.0 }).collect::<Vec<f32>>();
+        let (full, inf) = (row(1.0), row(f32::INFINITY));
+        for (nw, nh) in [(6, 3), (4, 3), (3, 6)] {
+            assert_eq!(carve(w, h, 1, &img, Some(&inf), nw, nh), carve(w, h, 1, &img, Some(&full), nw, nh), "{nw}x{nh}");
+        }
+        let kept = carve(w, h, 1, &img, Some(&inf), 6, 3);
+        assert!(kept.chunks(6).any(|r| r == &img[12..18]), "the protected row survives");
+    }
+
+    /// A cancel that arrives after the seam search, during the tall-image rebuild, still stops
+    /// the carve.
+    #[test]
+    fn proxy_rebuild_observes_cancellation() {
+        use std::sync::atomic::{AtomicUsize, Ordering};
+        let (w, h, ch, new_w) = (128, PROXY_SHRINK_MIN_HEIGHT, 3, 64);
+        let img = noise(w * h * ch, 7, 5);
+        let calls = AtomicUsize::new(0);
+        // One check per seam passes; the first one after the search cancels.
+        let cancel = || calls.fetch_add(1, Ordering::Relaxed) >= w - new_w;
+        assert_eq!(carve_width_with(w, h, ch, &img, None, new_w, &Interrupt::cancel_only(&cancel)), Err(Cancelled));
+        assert!(calls.load(Ordering::Relaxed) > w - new_w, "the rebuild checked for cancellation");
+    }
+
+    /// NaN samples and NaN protection steer seams the same whatever their sign and payload
+    /// (which arithmetic does not preserve consistently across builds): the same pixels are kept.
+    #[test]
+    fn nan_payloads_do_not_steer_seams() {
+        let (w, h, ch) = (24, 18, 3);
+        let (base, prot_base) = (noise(w * h * ch, 255, 21), noise(w * h, 3, 22));
+        let carve_with_nans = |pixel: f32, prot: f32| {
+            let (mut img, mut p) = (base.clone(), prot_base.clone());
+            img.iter_mut().step_by(37).for_each(|v| *v = pixel);
+            p.iter_mut().step_by(29).for_each(|v| *v = prot);
+            carve(w, h, ch, &img, Some(&p), 15, 11)
+        };
+        let canonical = |v: Vec<f32>| v.into_iter().map(|f| if f.is_nan() { u32::MAX } else { f.to_bits() }).collect::<Vec<_>>();
+        let nans = [f32::NAN, -f32::NAN, f32::from_bits(0x7fc0_1234), f32::from_bits(0xffc0_0001)];
+        let want = canonical(carve_with_nans(nans[0], nans[0]));
+        for &a in &nans {
+            for &b in &nans {
+                assert_eq!(canonical(carve_with_nans(a, b)), want, "pixel NaN {:#x}, protection NaN {:#x}", a.to_bits(), b.to_bits());
+            }
+        }
+    }
+
     #[test]
     fn cancelled_carve_stops() {
         let (w, h) = (40, 20);
@@ -786,33 +1181,6 @@ mod tests {
         assert_eq!(carve_width_with(w, h, ch, &img, None, 64, &Interrupt::cancel_only(&cancelled)), Err(Cancelled));
     }
 
-    /// The proxy path counts each removed original column instead of shifting an index map, so a
-    /// tracking and a counting carver must agree: run both side by side down to one column and
-    /// check every row's list after every seam (tie-heavy noise gives rows different histories;
-    /// 1-4 channels, with and without protection).
-    #[test]
-    fn counted_removed_columns_match_the_tracked_map() {
-        let cases: [(usize, usize, usize, u32, bool); 5] =
-            [(37, 9, 1, 2, false), (40, 12, 2, 3, true), (53, 7, 3, 255, false), (29, 16, 4, 1000, true), (64, 5, 3, 2, true)];
-        for (i, &(w, h, ch, levels, prot)) in cases.iter().enumerate() {
-            let img = noise(w * h * ch, levels, 31 + i as u32);
-            let protect = prot.then(|| noise(w * h, 3, 77 + i as u32));
-            let mut tracked = Carver::new(w, h, ch, img.clone(), protect.clone(), true);
-            let mut counted = Carver::new(w, h, ch, img, protect, false);
-            let mut expected: Vec<Vec<usize>> = vec![Vec::new(); h];
-            let mut got: Vec<Vec<usize>> = vec![Vec::new(); h];
-            while tracked.cw > 1 {
-                let seam = tracked.remove_seam();
-                for (row, &x) in expected.iter_mut().zip(seam.iter()) {
-                    let at = row.partition_point(|&o| o < x);
-                    row.insert(at, x);
-                }
-                record_removed(&mut got, &counted.remove_seam());
-                assert_eq!(got, expected, "case {i} after {} seams", w - tracked.cw);
-            }
-        }
-    }
-
     #[test]
     fn enlarging_duplicates_flat_areas() {
         let (w, h) = (30, 8);
@@ -904,6 +1272,35 @@ mod tests {
         0x2157_9f86_27d6_b835,
     ];
 
+    /// [`output_bits_are_pinned`] for the reduced-height seam search of tall images (rows at
+    /// least [`PROXY_SHRINK_MIN_HEIGHT`], at least [`PROXY_SHRINK_MIN_SEAMS`] seams): widths and,
+    /// through the transposed pass, heights, with and without protection, on tie-heavy and
+    /// fine-grained noise.
+    #[test]
+    fn tall_proxy_output_bits_are_pinned() {
+        let cases: [(usize, usize, usize, u32, bool, usize, usize); 5] = [
+            (96, PROXY_SHRINK_MIN_HEIGHT, 3, 2, false, 30, PROXY_SHRINK_MIN_HEIGHT),
+            (130, 2_100, 4, 255, true, 64, 2_100),
+            (80, 2_600, 1, 65_536, false, 16, 2_600),
+            (PROXY_SHRINK_MIN_HEIGHT, 90, 3, 5, false, PROXY_SHRINK_MIN_HEIGHT, 20),
+            (2_050, 100, 4, 1000, true, 2_050, 36),
+        ];
+        let got: Vec<u64> = cases
+            .iter()
+            .enumerate()
+            .map(|(i, &(w, h, ch, levels, prot, nw, nh))| {
+                let img = noise(w * h * ch, levels, 31 + i as u32);
+                let protect = prot.then(|| noise(w * h, 3, 131 + i as u32));
+                let out = carve(w, h, ch, &img, protect.as_deref(), nw, nh);
+                assert_eq!(out.len(), nw * nh * ch);
+                fnv(&out)
+            })
+            .collect();
+        assert_eq!(got, TALL_PINNED);
+    }
+
+    const TALL_PINNED: [u64; 5] = [0x5657_83ac_cb26_56a5, 0x81a6_b5f7_e299_fdfb, 0xcdf2_9df9_9b83_def5, 0xa713_544a_4dcc_d8d8, 0x3557_de9f_ffb0_881e];
+
     #[test]
     fn one_pixel_lines_enlarge_by_repeating() {
         // Width 1 has no seam to spare: its one column is repeated. Height 1 likewise (through
diff --git a/crates/algo/src/selection/lasso.rs b/crates/algo/src/selection/lasso.rs
index 3ca4eacd52..2471a379b5 100644
--- a/crates/algo/src/selection/lasso.rs
+++ b/crates/algo/src/selection/lasso.rs
@@ -123,7 +123,7 @@ pub fn polygon_surface(points: &[(f32, f32)], clip: Rect) -> Option<Surface> {
     let crossings = |e: &[&Edge], y: f32, xs: &mut Vec<f32>| {
         xs.clear();
         xs.extend(e.iter().map(|&&Edge { a, b, .. }| a.0 + (y - a.1) / (b.1 - a.1) * (b.0 - a.0)));
-        xs.sort_by(|a, b| a.total_cmp(b));
+        xs.sort_by(f32::total_cmp);
     };
     let full = s.solid_tile(&[1.0]);
     let blank = s.solid_tile(&[0.0]);
diff --git a/crates/algo/src/smart_blur_tests.rs b/crates/algo/src/smart_blur_tests.rs
index 47290e2425..505764e42e 100644
--- a/crates/algo/src/smart_blur_tests.rs
+++ b/crates/algo/src/smart_blur_tests.rs
@@ -1,6 +1,6 @@
 //! The pre-#7921 Smart Blur (every neighbour read per channel through `Image::get`) stays as an
 //! exact oracle: the offset fast path must give the same bits for every mode, depth and layout.
-use super::*;
+use super::{BlurQuality, Ctx, Image, MAXC, Rect, SmartBlurMode, native, ncol, smart_blur, unpremul_px, xy};
 use photocraft_color::ColorMode;
 
 #[allow(clippy::too_many_arguments)]
diff --git a/crates/algo/src/vanishing.rs b/crates/algo/src/vanishing.rs
index 1cf39b23ec..25ae5609ef 100644
--- a/crates/algo/src/vanishing.rs
+++ b/crates/algo/src/vanishing.rs
@@ -324,33 +324,114 @@ pub fn paste(scene: &Scene, i: usize, src: &Surface, src_rect: Rect, at: [f64; 2
     Ok(Some(out))
 }
 
+/// The fixed frame of one clone stroke: the source and destination planes, the source offset in
+/// plane-metric units and the brush radius, all set at the stroke's anchor (its first dab).
+struct CloneFrame {
+    hs: Homography,
+    ls: (f64, f64),
+    hd: Homography,
+    hd_inv: Homography,
+    ld: (f64, f64),
+    offset: [f64; 2],
+    r_m: f64,
+}
+
+impl CloneFrame {
+    fn new(scene: &Scene, source: [f64; 2], anchor: [f64; 2], size: f64) -> Option<CloneFrame> {
+        let (ps, pd) = (scene.plane_at(source)?, scene.plane_at(anchor)?);
+        let ((hs, lus, lvs), (hd, lud, lvd)) = (scene.frame(ps)?, scene.frame(pd)?);
+        let (hs_inv, hd_inv) = (hs.inverse()?, hd.inverse()?);
+        let ms = metric(&hs_inv, (lus, lvs), source);
+        let md0 = metric(&hd_inv, (lud, lvd), anchor);
+        // Brush radius in metric units (from the image size at the anchor).
+        let probe = metric(&hd_inv, (lud, lvd), [anchor[0] + size / 2.0, anchor[1]]);
+        let r_m = ((probe[0] - md0[0]).hypot(probe[1] - md0[1])).max(1e-9);
+        let offset = [ms[0] - md0[0], ms[1] - md0[1]];
+        (offset.iter().all(|v| v.is_finite()) && r_m.is_finite()).then_some(CloneFrame { hs, ls: (lus, lvs), hd, hd_inv, ld: (lud, lvd), offset, r_m })
+    }
+
+    /// The source point (image px) that destination `p` copies from.
+    fn source_of(&self, p: [f64; 2]) -> [f64; 2] {
+        let m = metric(&self.hd_inv, self.ld, p);
+        let (x, y) = self.hs.apply((m[0] + self.offset[0]) / self.ls.0, (m[1] + self.offset[1]) / self.ls.1);
+        [x, y]
+    }
+}
+
+/// Image point → plane-metric coordinates through the plane's inverse homography.
+fn metric(inv: &Homography, l: (f64, f64), p: [f64; 2]) -> [f64; 2] {
+    let (u, v) = inv.apply(p[0], p[1]);
+    [u * l.0, v * l.1]
+}
+
 /// Perspective clone stamp: one stroke of dabs at image points `points` on the destination
 /// plane, copying from `source` (image px) with the offset fixed in plane-metric units at the
 /// first dab. `size` is the brush diameter in px at the first dab; `hardness` 0..=1.
 pub fn clone_stroke(scene: &Scene, surf: &mut Surface, source: [f64; 2], points: &[[f64; 2]], size: f64, hardness: f64, opacity: f32) -> usize {
     let Some(first) = points.first() else { return 0 };
-    let (Some(ps), Some(pd)) = (scene.plane_at(source), scene.plane_at(*first)) else { return 0 };
-    let (Some((hs, lus, lvs)), Some((hd, lud, lvd))) = (scene.frame(ps), scene.frame(pd)) else { return 0 };
-    let (Some(hs_inv), Some(hd_inv)) = (hs.inverse(), hd.inverse()) else { return 0 };
-    let metric = |inv: &Homography, lu: f64, lv: f64, p: [f64; 2]| {
-        let (u, v) = inv.apply(p[0], p[1]);
-        [u * lu, v * lv]
-    };
-    let ms = metric(&hs_inv, lus, lvs, source);
-    let md0 = metric(&hd_inv, lud, lvd, *first);
-    let offset = [ms[0] - md0[0], ms[1] - md0[1]];
-    // Brush radius in metric units (from the image size at the first dab).
-    let probe = metric(&hd_inv, lud, lvd, [first[0] + size / 2.0, first[1]]);
-    let r_m = ((probe[0] - md0[0]).hypot(probe[1] - md0[1])).max(1e-9);
+    clone_dabs(scene, surf, source, *first, points, size, hardness, opacity, None).0
+}
+
+/// Where a clone stroke that starts at `anchor` copying from `source` samples for destination
+/// `p`: the same plane-metric offset. A live preview paints a stroke in pieces with it, and
+/// Aligned strokes keep the first stroke's offset. `None` when `source` or `anchor` is off the
+/// planes.
+pub fn clone_source(scene: &Scene, source: [f64; 2], anchor: [f64; 2], p: [f64; 2]) -> Option<[f64; 2]> {
+    let s = CloneFrame::new(scene, source, anchor, 1.0)?.source_of(p);
+    s.iter().all(|v| v.is_finite()).then_some(s)
+}
+
+/// [`clone_stroke`]'s dabs at `points` for a stroke anchored at `anchor` (its first dab, which
+/// fixes the offset and the brush's metric size). Samples a snapshot taken at this call.
+/// For incremental painting use [`clone_dabs_from`] with one snapshot per stroke.
+/// With `clip`, every dab is cut to it before any read or write (a document passes its canvas,
+/// so far off-canvas points allocate no tiles). Returns the dabs painted and the area they changed.
+#[allow(clippy::too_many_arguments)]
+pub fn clone_dabs(
+    scene: &Scene,
+    surf: &mut Surface,
+    source: [f64; 2],
+    anchor: [f64; 2],
+    points: &[[f64; 2]],
+    size: f64,
+    hardness: f64,
+    opacity: f32,
+    clip: Option<Rect>,
+) -> (usize, Rect) {
     let src_copy = surf.clone();
+    clone_dabs_from(scene, surf, &src_copy, source, anchor, points, size, hardness, opacity, clip)
+}
+
+/// Paint a batch of one stroke using the same immutable source snapshot for every batch.
+/// Source and destination must have the same pixel format; otherwise no dabs are painted.
+/// `clip` as in [`clone_dabs`].
+#[allow(clippy::too_many_arguments)]
+pub fn clone_dabs_from(
+    scene: &Scene,
+    surf: &mut Surface,
+    src_copy: &Surface,
+    source: [f64; 2],
+    anchor: [f64; 2],
+    points: &[[f64; 2]],
+    size: f64,
+    hardness: f64,
+    opacity: f32,
+    clip: Option<Rect>,
+) -> (usize, Rect) {
+    if surf.format() != src_copy.format() {
+        return (0, Rect::EMPTY);
+    }
+    let Some(f) = CloneFrame::new(scene, source, anchor, size) else { return (0, Rect::EMPTY) };
+    let CloneFrame { hs, ls: (lus, lvs), hd, hd_inv, ld: (lud, lvd), offset, r_m } = f;
     let fmt = surf.format();
     let n = fmt.channels();
     // Scratch for `sample`: the dab's source pixels, the four bilinear corners, the result.
     let mut win = Window { area: Rect::new(0, 0, 0, 0), data: Vec::new() };
     let (mut corners, mut s) = (vec![0.0f32; 4 * n], vec![0.0f32; n]);
     let mut dabs = 0;
+    let mut changed_area = Rect::EMPTY;
     for p in points {
-        let mc = metric(&hd_inv, lud, lvd, *p);
+        let mc = metric(&hd_inv, (lud, lvd), *p);
         // Image-space footprint: map a metric circle's bounding points.
         let footprint = |h: &Homography, lu: f64, lv: f64, c: [f64; 2]| {
             let mut bb = [f64::MAX, f64::MAX, f64::MIN, f64::MIN];
@@ -359,12 +440,19 @@ pub fn clone_stroke(scene: &Scene, surf: &mut Surface, source: [f64; 2], points:
                 let (x, y) = h.apply((c[0] + r_m * a.cos()) / lu, (c[1] + r_m * a.sin()) / lv);
                 bb = [bb[0].min(x), bb[1].min(y), bb[2].max(x), bb[3].max(y)];
             }
+            if bb.iter().any(|v| !v.is_finite()) {
+                return Rect::EMPTY;
+            }
             Rect::new(bb[0].floor() as i32, bb[1].floor() as i32, (bb[2].ceil() as i32).saturating_add(1), (bb[3].ceil() as i32).saturating_add(1))
         };
         let area = footprint(&hd, lud, lvd, mc);
         if area.is_empty() || area.width() > 4096 || area.height() > 4096 {
             continue;
         }
+        let area = clip.map_or(area, |c| area.intersect(&c));
+        if area.is_empty() {
+            continue;
+        }
         // The source footprint, read once; `sample` reads any pixel outside it from the surface.
         // Skipped when it dwarfs the destination (cloning from near to far in strong perspective):
         // decoding it would cost more than the few per-pixel reads it saves.
@@ -385,9 +473,9 @@ pub fn clone_stroke(scene: &Scene, surf: &mut Surface, source: [f64; 2], points:
         let mut changed = false;
         for (i, px) in data.chunks_exact_mut(n).enumerate() {
             let (x, y) = (area.x0 as f64 + (i % w) as f64 + 0.5, area.y0 as f64 + (i / w) as f64 + 0.5);
-            let m = metric(&hd_inv, lud, lvd, [x, y]);
+            let m = metric(&hd_inv, (lud, lvd), [x, y]);
             let d = (m[0] - mc[0]).hypot(m[1] - mc[1]) / r_m;
-            if d >= 1.0 {
+            if d >= 1.0 || d.is_nan() {
                 continue;
             }
             let hard = hardness.clamp(0.0, 0.99);
@@ -396,7 +484,7 @@ pub fn clone_stroke(scene: &Scene, surf: &mut Surface, source: [f64; 2], points:
             // Source pixel at the same metric offset.
             let sm = [m[0] + offset[0], m[1] + offset[1]];
             let (sx, sy) = hs.apply(sm[0] / lus, sm[1] / lvs);
-            sample(&src_copy, &win, sx - 0.5, sy - 0.5, &mut corners, &mut s);
+            sample(src_copy, &win, sx - 0.5, sy - 0.5, &mut corners, &mut s);
             for c in 0..n {
                 px[c] += (s[c] - px[c]) * k;
             }
@@ -405,9 +493,10 @@ pub fn clone_stroke(scene: &Scene, surf: &mut Surface, source: [f64; 2], points:
         if changed {
             surf.write_region(area, &data);
             dabs += 1;
+            changed_area = if changed_area.is_empty() { area } else { changed_area.union(&area) };
         }
     }
-    dabs
+    (dabs, changed_area)
 }
 
 /// Pixels of `area` read from the source surface (`read_region` layout).
@@ -421,6 +510,10 @@ struct Window {
 /// read from `s`.
 fn sample(s: &Surface, win: &Window, x: f64, y: f64, corners: &mut Vec<f32>, out: &mut [f32]) {
     let n = out.len();
+    if !x.is_finite() || !y.is_finite() {
+        out.fill(0.0);
+        return;
+    }
     let (x0, y0) = (x.floor() as i32, y.floor() as i32);
     let (tx, ty) = ((x - x0 as f64) as f32, (y - y0 as f64) as f32);
     let (x1, y1) = (x0.saturating_add(1), y0.saturating_add(1));
@@ -537,6 +630,42 @@ mod tests {
         let n = clone_stroke(&sc, &mut s, [sx, sy], &[[dx, dy]], 10.0, 0.8, 1.0);
         assert_eq!(n, 1);
         assert!(s.rgba(dx as i32, dy as i32)[0] > 0.8, "{:?}", s.rgba(dx as i32, dy as i32));
+        // The stroke's anchor copies from the source itself.
+        let back = clone_source(&sc, [sx, sy], [dx, dy], [dx, dy]).unwrap();
+        assert!((back[0] - sx).abs() < 1e-6 && (back[1] - sy).abs() < 1e-6, "{back:?}");
+    }
+    #[test]
+    fn incremental_clone_uses_one_source_snapshot_per_stroke() {
+        let sc = Scene::new(VpPlane { corners: [[0.0, 0.0], [100.0, 0.0], [100.0, 100.0], [0.0, 100.0]] }, [50.0, 50.0], None, 800.0);
+        for fmt in [PixelFormat::RGBA8, PixelFormat::RGBA16, PixelFormat::RGBA32F] {
+            let mut original = Surface::new(fmt);
+            for x in 0..100 {
+                original.fill_rect(Rect::new(x, 0, x + 1, 100), &[x as f32 / 100.0, (x % 7) as f32 / 6.0, 0.3, 1.0]);
+            }
+            let points = [[40.0, 50.0], [44.0, 50.0], [48.0, 50.0], [52.0, 50.0]];
+            let mut whole = original.clone();
+            assert_eq!(clone_stroke(&sc, &mut whole, [36.0, 50.0], &points, 12.0, 0.8, 1.0), 4);
+            let mut pieces = original.clone();
+            for part in points.chunks(2) {
+                clone_dabs_from(&sc, &mut pieces, &original, [36.0, 50.0], points[0], part, 12.0, 0.8, 1.0, None);
+            }
+            assert_eq!(whole.read_region(Rect::new(0, 0, 100, 100)), pieces.read_region(Rect::new(0, 0, 100, 100)));
+        }
+    }
+
+    /// A clip cuts every dab before it reads or writes: dabs far outside it allocate no tiles.
+    #[test]
+    fn clipped_clone_allocates_no_tiles_outside_the_clip() {
+        let sc = Scene::new(VpPlane { corners: [[0.0, 0.0], [100.0, 0.0], [100.0, 100.0], [0.0, 100.0]] }, [50.0, 50.0], None, 800.0);
+        let clip = Rect::new(0, 0, 100, 100);
+        let mut s = Surface::new(PixelFormat::RGBA8);
+        s.fill_rect(clip, &[0.5, 0.5, 0.5, 1.0]);
+        let tiles = s.tiles().count();
+        let points = [[50.0, 50.0], [-40.0, 50.0], [5000.0, 5000.0], [-90_000.0, 70_000.0]];
+        let (dabs, area) = clone_dabs(&sc, &mut s, [40.0, 50.0], points[0], &points, 20.0, 0.8, 1.0, Some(clip));
+        assert_eq!(dabs, 1);
+        assert!(clip.contains_rect(&area), "{area:?}");
+        assert_eq!(s.tiles().count(), tiles);
     }
 
     #[test]
diff --git a/crates/automation/Cargo.toml b/crates/automation/Cargo.toml
index 5421640a84..13ab9c527b 100644
--- a/crates/automation/Cargo.toml
+++ b/crates/automation/Cargo.toml
@@ -21,7 +21,7 @@ serde_json = { workspace = true }
 thiserror = { workspace = true }
 rmcp = { version = "3.5", default-features = false, features = ["server", "macros", "transport-io"] }
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "io-std", "sync", "net", "io-util", "time"] }
-base64 = "0.22"
+base64 = "0.23"
 schemars = "1"
 getrandom = { workspace = true }
 cap-std = "4"
diff --git a/crates/automation/src/server.rs b/crates/automation/src/server.rs
index f5ccef00c7..61a6454e79 100644
--- a/crates/automation/src/server.rs
+++ b/crates/automation/src/server.rs
@@ -329,7 +329,7 @@ pub struct MenuParams {
 pub struct UiSetParams {
     /// Fields for the control method `ui.set`: tool, panels, dock, dockTabs, dockWidth, colorPanel
     /// ({background: bool} picks which swatch the Color panel edits), maskTarget,
-    /// vectorMaskTarget, selectionMode, zoom, center, rotation (view angle in degrees), fit, theme (pro, proMedium, studio,
+    /// vectorMaskTarget, filterMaskTarget (paint the active smart object's filter mask), selectionMode, zoom, center, rotation (view angle in degrees), fit, theme (pro, proMedium, studio,
     /// studioLight, classic, solarizedDark, adwaita, adwaitaDark, breezeLight, breezeDark, softLight, softDark), brushSection, brushTab,
     /// brushesView, brushPicker ([x, y] opens the Brush Preset picker there, null closes it),
     /// brushPickerName, brushPickerStroke, brushPickerTip (the picker card's parts, at least one
@@ -350,8 +350,14 @@ pub struct UiSetParams {
     /// "mode"), kinds (a list of layer kinds), name (matches part of the layer name) and mode (a
     /// blend mode name) for the Layers panel filter). strokeTrace (true, false, "stderr" or "off":
     /// the stroke latency trace at runtime; a CSV file is set at launch with --stroke-trace, not
-    /// over this channel). updatesOpen (bool, the Help › Check for Updates window). Other fields
-    /// are an error.
+    /// over this channel). updatesOpen (bool, the Help › Check for Updates window).
+    /// histogramPanel (an object patching view ("compact", "expanded" or "allChannels"), channel
+    /// ("composite", "red", "green", "blue", "cyan", "magenta", "yellow", "black", "a", "b",
+    /// "luminosity" or "colors"), showChannelsInColor, showStatistics and source ("entireImage",
+    /// "selectedLayer" or "adjustmentComposite") for the Histogram panel), histogramRange ([from,
+    /// to] levels 0..255 whose Count and Percentile the panel shows, or null) and histogramRefresh
+    /// (true: an Uncached Refresh); `ui.inspect` reports them and the statistics under
+    /// `histogram`. Other fields are an error.
     pub fields: Value,
 }
 
diff --git a/crates/automation/src/workspace.rs b/crates/automation/src/workspace.rs
index e8566b439e..12e7329180 100644
--- a/crates/automation/src/workspace.rs
+++ b/crates/automation/src/workspace.rs
@@ -806,6 +806,21 @@ mod tests {
         assert!(authorize_desktop_engine_step("file.saveACopy", &serde_json::json!({})).is_err());
     }
 
+    // Regression test for #3763: `edit.installedProfiles` scans the OS and user ICC folders but
+    // takes no path parameter, so automation let it through until it was listed as ambient.
+    #[test]
+    fn installed_profiles_listing_is_refused_for_automation() {
+        for params in [serde_json::json!({}), serde_json::json!({"class": "output", "colorSpace": "cmyk"})] {
+            assert!(authorize_engine_command("edit.installedProfiles", &params).is_err(), "authorize_engine_command allowed it with {params}");
+            assert!(authorize_desktop_engine_command("edit.installedProfiles", &params).is_err(), "authorize_desktop_engine_command allowed it with {params}");
+            assert!(authorize_engine_step("edit.installedProfiles", &params).is_err(), "authorize_engine_step allowed it with {params}");
+        }
+        // The sandboxed session refuses it before the engine scans any folder.
+        let mut headless = crate::Headless::new();
+        let refused = headless.command_run("edit.installedProfiles", serde_json::json!({})).unwrap_err();
+        assert!(refused.to_string().contains("ambient filesystem paths"), "{refused}");
+    }
+
     #[test]
     fn apply_data_set_is_judged_by_the_values_it_applies() {
         let mut headless = crate::Headless::new();
diff --git a/crates/automation/tests/it/smart_filter_authorization.rs b/crates/automation/tests/it/smart_filter_authorization.rs
index 594832c41d..0a39df85f5 100644
--- a/crates/automation/tests/it/smart_filter_authorization.rs
+++ b/crates/automation/tests/it/smart_filter_authorization.rs
@@ -1,94 +1,15 @@
 //! Stored smart-filter parameters must not grant automation ambient filesystem access.
-use std::path::{Path, PathBuf};
-use std::sync::{
-    Arc,
-    atomic::{AtomicU64, Ordering},
-};
+use std::path::Path;
+use std::sync::Arc;
 
-use photocraft_automation::{AuthorizedWorkspace, Headless, workspace::authorize_desktop_engine_step};
-use photocraft_doc::{Document, LayerContent, LayerId};
+#[path = "../support/smart_filter_fixture.rs"]
+mod fixture;
+
+use fixture::{Fixture, assert_denied, cube, path_params};
+use photocraft_automation::{Headless, workspace::authorize_desktop_engine_step};
+use photocraft_doc::LayerContent;
 use photocraft_engine::{Session, actions_cmds::Action, jobs::Started, smart_cmds};
-use serde_json::{Value, json};
-
-struct Fixture(PathBuf);
-
-impl Fixture {
-    fn new() -> Self {
-        static NEXT: AtomicU64 = AtomicU64::new(0);
-        let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
-        let base = std::env::temp_dir().join(format!("pc-filter-auth-{}-{stamp}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
-        std::fs::create_dir(&base).unwrap();
-        std::fs::create_dir(base.join("workspace")).unwrap();
-        std::fs::create_dir(base.join("outside")).unwrap();
-        let f = Self(base);
-        std::fs::write(f.root().join("stripes.png"), png(|x| if (x / 2) % 2 == 0 { 0 } else { 255 })).unwrap();
-        std::fs::write(f.outside("black.png"), png(|_| 0)).unwrap();
-        std::fs::write(f.outside("white.png"), png(|_| 255)).unwrap();
-        std::fs::write(f.outside("black.cube"), cube(0)).unwrap();
-        std::fs::write(f.outside("white.cube"), cube(1)).unwrap();
-        f
-    }
-
-    fn root(&self) -> PathBuf {
-        self.0.join("workspace")
-    }
-    fn outside(&self, name: &str) -> PathBuf {
-        self.0.join("outside").join(name)
-    }
-    fn headless(&self) -> Headless {
-        Headless::with_workspace(AuthorizedWorkspace::new(Some(&self.root()), Some(&self.root())).unwrap())
-    }
-    fn setup(&self, lookup: bool) -> (Headless, LayerId) {
-        let mut h = self.headless();
-        h.handle("doc.new", json!({"width": 32, "height": 32, "background": "#808080"})).unwrap();
-        h.handle("doc.new", json!({"width": 32, "height": 32})).unwrap();
-        let layer = LayerId(h.handle("doc.place", json!({"path": "stripes.png"})).unwrap()["layer"].as_u64().unwrap());
-        let (id, params) = if lookup {
-            ("image.adjustments.colorLookup", json!({"layer": layer.0, "lut": "none"}))
-        } else {
-            ("filter.distort.displace", json!({"layer": layer.0, "mapDocument": 0, "horizontal": 50, "vertical": 0}))
-        };
-        h.session.execute(id, params).unwrap();
-        (h, layer)
-    }
-    fn saved_filter(&self, lookup: bool) -> (Document, LayerId) {
-        let (h, layer) = self.setup(lookup);
-        let mut doc = (*h.session.active().unwrap().doc).clone();
-        let LayerContent::Smart(sm) = &mut doc.layer_mut(layer).unwrap().content else { panic!("smart object") };
-        sm.smart_filters[0].params = path_params(lookup, &self.outside(if lookup { "white.cube" } else { "white.png" }));
-        let bytes = photocraft_format::save_to_bytes(&doc, &Default::default()).unwrap();
-        std::fs::write(self.root().join("stored.pcraft"), bytes).unwrap();
-        (doc, layer)
-    }
-}
-impl Drop for Fixture {
-    fn drop(&mut self) {
-        let _ = std::fs::remove_dir_all(&self.0);
-    }
-}
-
-fn png(value: impl Fn(u32) -> u8) -> Vec<u8> {
-    let mut pixels = Vec::new();
-    for _ in 0..32 {
-        for x in 0..32 {
-            pixels.extend([value(x); 3]);
-        }
-    }
-    let image = photocraft_codecs::Image::from_u8(32, 32, photocraft_codecs::ChannelLayout::Rgb, pixels).unwrap();
-    photocraft_codecs::encode(&image, photocraft_codecs::Format::Png, &Default::default()).unwrap()
-}
-fn cube(value: u8) -> String {
-    format!("LUT_3D_SIZE 2\n{}", format!("{value} {value} {value}\n").repeat(8))
-}
-fn path_params(lookup: bool, path: &Path) -> Value {
-    if lookup { json!({"file": path}) } else { json!({"mapPath": path, "mapDocument": null}) }
-}
-fn assert_denied<T: std::fmt::Debug>(result: Result<T, impl std::fmt::Display>) {
-    match result {
-        Err(error) => assert!(error.to_string().contains("ambient filesystem"), "{error}"),
-        Ok(value) => panic!("ambient file access was accepted: {value:?}"),
-    }
-}
+use serde_json::json;
 
 #[test]
 fn parameter_edits_reject_outside_images_and_luts_without_changing_the_document() {
@@ -243,21 +164,6 @@ fn a_refresh_outside_command_execution_surfaces_the_denial_instead_of_rendering_
     }
 }
 
-#[test]
-fn an_ambient_map_or_lut_never_renders_unfiltered_pixels_into_the_stack_cache() {
-    // The denial path must fail the render before any stage is cached process-wide.
-    for lookup in [false, true] {
-        let f = Fixture::new();
-        let (doc, layer) = f.saved_filter(lookup);
-        let mut s = Session::new();
-        s.add_document(doc, None);
-        s.authorize = Some(authorize_desktop_engine_step);
-        let bytes = smart_cmds::stack_cache_bytes();
-        assert_denied(s.execute("layer.smartFilter.setVisible", json!({"layer": layer.0, "visible": true})));
-        assert_eq!(bytes, smart_cmds::stack_cache_bytes(), "a denied render cached no stage");
-    }
-}
-
 /// Choosing another Displace map through `setParams` embeds it (#7423), so the new map is read
 /// before the edit: a path outside the workspace is refused before that read, and the filter
 /// keeps the map it had.
diff --git a/crates/automation/tests/smart_filter_stack_cache.rs b/crates/automation/tests/smart_filter_stack_cache.rs
new file mode 100644
index 0000000000..f7698a4db1
--- /dev/null
+++ b/crates/automation/tests/smart_filter_stack_cache.rs
@@ -0,0 +1,25 @@
+//! One integration-test process keeps the global smart filter stage cache isolated from the
+//! parallel tests in `tests/it`, so a denied render can be shown to have cached nothing.
+use photocraft_automation::workspace::authorize_desktop_engine_step;
+use photocraft_engine::{Session, smart_cmds};
+use serde_json::json;
+
+#[path = "support/smart_filter_fixture.rs"]
+mod fixture;
+
+use fixture::{Fixture, assert_denied};
+
+#[test]
+fn an_ambient_map_or_lut_never_renders_unfiltered_pixels_into_the_stack_cache() {
+    // The denial path must fail the render before any stage is cached process-wide.
+    for lookup in [false, true] {
+        let f = Fixture::new();
+        let (doc, layer) = f.saved_filter(lookup);
+        let mut s = Session::new();
+        s.add_document(doc, None);
+        s.authorize = Some(authorize_desktop_engine_step);
+        let bytes = smart_cmds::stack_cache_bytes();
+        assert_denied(s.execute("layer.smartFilter.setVisible", json!({"layer": layer.0, "visible": true})));
+        assert_eq!(bytes, smart_cmds::stack_cache_bytes(), "a denied render cached no stage");
+    }
+}
diff --git a/crates/automation/tests/support/smart_filter_fixture.rs b/crates/automation/tests/support/smart_filter_fixture.rs
new file mode 100644
index 0000000000..26d5cab27b
--- /dev/null
+++ b/crates/automation/tests/support/smart_filter_fixture.rs
@@ -0,0 +1,89 @@
+//! The smart filter authorization tests' fixture: a workspace with a striped image to place and
+//! maps and LUTs outside it (`#[path]`-included by `it/smart_filter_authorization.rs` and
+//! `smart_filter_stack_cache.rs`).
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use photocraft_automation::{AuthorizedWorkspace, Headless};
+use photocraft_doc::{Document, LayerContent, LayerId};
+use serde_json::{Value, json};
+
+pub struct Fixture(PathBuf);
+
+impl Fixture {
+    pub fn new() -> Self {
+        static NEXT: AtomicU64 = AtomicU64::new(0);
+        let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+        let base = std::env::temp_dir().join(format!("pc-filter-auth-{}-{stamp}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir(&base).unwrap();
+        std::fs::create_dir(base.join("workspace")).unwrap();
+        std::fs::create_dir(base.join("outside")).unwrap();
+        let f = Self(base);
+        std::fs::write(f.root().join("stripes.png"), png(|x| if (x / 2) % 2 == 0 { 0 } else { 255 })).unwrap();
+        std::fs::write(f.outside("black.png"), png(|_| 0)).unwrap();
+        std::fs::write(f.outside("white.png"), png(|_| 255)).unwrap();
+        std::fs::write(f.outside("black.cube"), cube(0)).unwrap();
+        std::fs::write(f.outside("white.cube"), cube(1)).unwrap();
+        f
+    }
+
+    pub fn root(&self) -> PathBuf {
+        self.0.join("workspace")
+    }
+    pub fn outside(&self, name: &str) -> PathBuf {
+        self.0.join("outside").join(name)
+    }
+    pub fn headless(&self) -> Headless {
+        Headless::with_workspace(AuthorizedWorkspace::new(Some(&self.root()), Some(&self.root())).unwrap())
+    }
+    pub fn setup(&self, lookup: bool) -> (Headless, LayerId) {
+        let mut h = self.headless();
+        h.handle("doc.new", json!({"width": 32, "height": 32, "background": "#808080"})).unwrap();
+        h.handle("doc.new", json!({"width": 32, "height": 32})).unwrap();
+        let layer = LayerId(h.handle("doc.place", json!({"path": "stripes.png"})).unwrap()["layer"].as_u64().unwrap());
+        let (id, params) = if lookup {
+            ("image.adjustments.colorLookup", json!({"layer": layer.0, "lut": "none"}))
+        } else {
+            ("filter.distort.displace", json!({"layer": layer.0, "mapDocument": 0, "horizontal": 50, "vertical": 0}))
+        };
+        h.session.execute(id, params).unwrap();
+        (h, layer)
+    }
+    pub fn saved_filter(&self, lookup: bool) -> (Document, LayerId) {
+        let (h, layer) = self.setup(lookup);
+        let mut doc = (*h.session.active().unwrap().doc).clone();
+        let LayerContent::Smart(sm) = &mut doc.layer_mut(layer).unwrap().content else { panic!("smart object") };
+        sm.smart_filters[0].params = path_params(lookup, &self.outside(if lookup { "white.cube" } else { "white.png" }));
+        let bytes = photocraft_format::save_to_bytes(&doc, &Default::default()).unwrap();
+        std::fs::write(self.root().join("stored.pcraft"), bytes).unwrap();
+        (doc, layer)
+    }
+}
+impl Drop for Fixture {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+pub fn png(value: impl Fn(u32) -> u8) -> Vec<u8> {
+    let mut pixels = Vec::new();
+    for _ in 0..32 {
+        for x in 0..32 {
+            pixels.extend([value(x); 3]);
+        }
+    }
+    let image = photocraft_codecs::Image::from_u8(32, 32, photocraft_codecs::ChannelLayout::Rgb, pixels).unwrap();
+    photocraft_codecs::encode(&image, photocraft_codecs::Format::Png, &Default::default()).unwrap()
+}
+pub fn cube(value: u8) -> String {
+    format!("LUT_3D_SIZE 2\n{}", format!("{value} {value} {value}\n").repeat(8))
+}
+pub fn path_params(lookup: bool, path: &Path) -> Value {
+    if lookup { json!({"file": path}) } else { json!({"mapPath": path, "mapDocument": null}) }
+}
+pub fn assert_denied<T: std::fmt::Debug>(result: Result<T, impl std::fmt::Display>) {
+    match result {
+        Err(error) => assert!(error.to_string().contains("ambient filesystem"), "{error}"),
+        Ok(value) => panic!("ambient file access was accepted: {value:?}"),
+    }
+}
diff --git a/crates/cms/src/lutfile.rs b/crates/cms/src/lutfile.rs
index dbe6281d8f..6a85f53908 100644
--- a/crates/cms/src/lutfile.rs
+++ b/crates/cms/src/lutfile.rs
@@ -90,7 +90,7 @@ impl LutFile {
 /// Parses a LUT, picking the format from `file_name`'s extension (falls back to sniffing).
 pub fn parse(file_name: &str, bytes: &[u8]) -> Result<LutFile, LutError> {
     let lower = file_name.to_ascii_lowercase();
-    let text = String::from_utf8_lossy(bytes);
+    let text = decode_text(bytes);
     if lower.ends_with(".3dl") {
         parse_3dl(&text)
     } else if lower.ends_with(".look") || text.trim_start().starts_with('<') {
@@ -100,6 +100,19 @@ pub fn parse(file_name: &str, bytes: &[u8]) -> Result<LutFile, LutError> {
     }
 }
 
+/// UTF-16 with a byte-order mark (Photoshop loads such `.look` files, #9118), else UTF-8.
+fn decode_text(bytes: &[u8]) -> std::borrow::Cow<'_, str> {
+    let utf16 = |rest: &[u8], from: fn([u8; 2]) -> u16| {
+        let units: Vec<u16> = rest.as_chunks::<2>().0.iter().map(|&c| from(c)).collect();
+        String::from_utf16_lossy(&units).into()
+    };
+    match bytes {
+        [0xFF, 0xFE, rest @ ..] => utf16(rest, u16::from_le_bytes),
+        [0xFE, 0xFF, rest @ ..] => utf16(rest, u16::from_be_bytes),
+        _ => String::from_utf8_lossy(bytes),
+    }
+}
+
 /// Adobe / Resolve `.cube`. 1D LUTs (`LUT_1D_SIZE`) are expanded to a 33³ table.
 pub fn parse_cube(text: &str) -> Result<LutFile, LutError> {
     let mut title = String::new();
@@ -179,12 +192,15 @@ pub fn parse_cube(text: &str) -> Result<LutFile, LutError> {
 }
 
 /// Lustre `.3dl`: an optional shaper line of input values, then integer RGB rows with **blue**
-/// varying fastest; the output bit depth is inferred from the largest value.
+/// varying fastest; the output bit depth is inferred from the largest value, and is at least 12
+/// bits in a file without a header.
 pub fn parse_3dl(text: &str) -> Result<LutFile, LutError> {
     let mut rows: Vec<[f64; 3]> = Vec::new();
+    let mut header = false;
     for line in text.lines() {
         let line = line.split('#').next().unwrap_or("").trim();
         if line.is_empty() || line.starts_with(|c: char| c.is_ascii_alphabetic()) {
+            header |= !line.is_empty();
             continue;
         }
         let v: Vec<f64> = line.split_whitespace().filter_map(|s| s.parse().ok()).collect();
@@ -198,7 +214,9 @@ pub fn parse_3dl(text: &str) -> Result<LutFile, LutError> {
         return err(format!("{} rows is not a cube", rows.len()));
     }
     let max = rows.iter().flatten().fold(0.0f64, |a, &b| a.max(b));
-    let scale = if max <= 1.0 { 1.0 } else { [1023.0, 4095.0, 16383.0, 65535.0].into_iter().find(|&s| max <= s).unwrap_or(max) };
+    // Photoshop 27.11 reads a headerless table peaking at 255 or 1023 on the 12-bit scale (#9121).
+    let depths: &[f64] = if header { &[1023.0, 4095.0, 16383.0, 65535.0] } else { &[4095.0, 16383.0, 65535.0] };
+    let scale = if max <= 1.0 { 1.0 } else { depths.iter().copied().find(|&s| max <= s).unwrap_or(max) };
     let mut data = vec![0.0f32; n * n * n * 3];
     for (i, row) in rows.iter().enumerate() {
         let (r, g, b) = (i / (n * n), (i / n) % n, i % n);
@@ -213,6 +231,15 @@ pub fn parse_3dl(text: &str) -> Result<LutFile, LutError> {
 /// SpeedGrade `.look`: `<size>` and a hex `<data>` string of little-endian float32 RGB triplets
 /// (red fastest).
 pub fn parse_look(text: &str) -> Result<LutFile, LutError> {
+    // Comments may hold tag-like text, so drop them before looking for tags (#9109).
+    let mut clean = String::with_capacity(text.len());
+    let mut rest = text;
+    while let Some(i) = rest.find("<!--") {
+        clean.push_str(&rest[..i]);
+        rest = rest[i + 4..].find("-->").map_or("", |e| &rest[i + 4 + e + 3..]);
+    }
+    clean.push_str(rest);
+    let text = clean.as_str();
     let tag = |name: &str| -> Option<String> {
         let open = format!("<{name}>");
         let start = text.find(&open)? + open.len();
@@ -440,6 +467,25 @@ DOMAIN_MAX 0.5 1 1
         assert!(parse_cube(&text).is_err());
     }
 
+    #[test]
+    fn three_dl_without_a_header_reads_low_nodes_as_12_bit() {
+        let table = |peak: u32| -> String {
+            let mut text = String::from("0 1023\n");
+            for i in 0..8 {
+                let on = |bit: u32| if i & bit != 0 { peak } else { 0 };
+                text.push_str(&format!("{} {} {}\n", on(4), on(2), on(1)));
+            }
+            text
+        };
+        for peak in [255, 1023, 4095] {
+            let white = parse_3dl(&table(peak)).unwrap().data[21..24].to_vec();
+            assert_eq!(white, [peak as f32 / 4095.0; 3], "peak {peak}");
+        }
+        // A header keeps the inferred 10-bit depth.
+        let white = parse_3dl(&format!("3DMESH\nMesh 1 10\n{}", table(1023))).unwrap().data[21..24].to_vec();
+        assert_eq!(white, [1.0; 3]);
+    }
+
     #[test]
     fn three_dl_blue_fastest_and_bit_depth() {
         let mut text = String::from("0 1023\n");
@@ -463,6 +509,29 @@ DOMAIN_MAX 0.5 1 1
         assert_eq!(parse("a.look", xml.as_bytes()).unwrap().data, id.data);
     }
 
+    #[test]
+    fn look_reads_utf16_with_either_byte_order() {
+        let id = LutFile::identity(2);
+        let hex: String = id.data.iter().flat_map(|v| v.to_le_bytes()).map(|b| format!("{b:02X}")).collect();
+        let xml = format!("<?xml version=\"1.0\" encoding=\"UTF-16\"?><look><LUT><size>\"2\"</size><data>\"{hex}\"</data></LUT></look>");
+        let le: Vec<u8> = [0xFF, 0xFE].into_iter().chain(xml.encode_utf16().flat_map(u16::to_le_bytes)).collect();
+        let be: Vec<u8> = [0xFE, 0xFF].into_iter().chain(xml.encode_utf16().flat_map(u16::to_be_bytes)).collect();
+        assert_eq!(parse("a.look", &le).unwrap().data, id.data);
+        assert_eq!(parse("a.look", &be).unwrap().data, id.data);
+    }
+
+    #[test]
+    fn look_ignores_tags_inside_xml_comments() {
+        let hex = |l: &LutFile| -> String { l.data.iter().flat_map(|v| v.to_le_bytes()).map(|b| format!("{b:02X}")).collect() };
+        let inverse = LutFile::from_fn("", 2, |[r, g, b]| [1.0 - r, 1.0 - g, 1.0 - b]);
+        let xml = format!(
+            "<look><!-- <size>\"3\"</size><data>\"{}\"</data> --><LUT><size>\"2\"</size><data>\"{}\"</data></LUT><!-- unterminated <data>00",
+            hex(&LutFile::identity(2)),
+            hex(&inverse)
+        );
+        assert_eq!(parse("commented.look", xml.as_bytes()).unwrap().data, inverse.data);
+    }
+
     #[test]
     fn look_rgb_and_rgba_allow_whitespace_in_hex_data() {
         let id = LutFile::identity(2);
diff --git a/crates/cms/src/transform.rs b/crates/cms/src/transform.rs
index 3ce59687a7..5cd6c65c57 100644
--- a/crates/cms/src/transform.rs
+++ b/crates/cms/src/transform.rs
@@ -2,7 +2,7 @@
 //! compensation, soft-proofing chains, and fast lookup-table evaluation of pixel buffers.
 
 use std::collections::HashMap;
-use std::sync::{Arc, Mutex, OnceLock};
+use std::sync::{Arc, Mutex, OnceLock, PoisonError};
 
 use crate::clut::{Clut, MAX_CHANNELS};
 use crate::curve::Curve;
@@ -718,14 +718,14 @@ pub fn cached(src: &Profile, dst: &Profile, opts: TransformOptions) -> Result<Ar
     let key = (src.content_hash(), dst.content_hash(), opts);
     let (src_bytes, dst_bytes) = (src.to_bytes(), dst.to_bytes());
     let cache = CACHE.get_or_init(Default::default);
-    let hit = cache.lock().unwrap_or_else(|e| e.into_inner()).get(&key).map(|e| (e.src == src_bytes && e.dst == dst_bytes).then(|| e.transform.clone()));
+    let hit = cache.lock().unwrap_or_else(PoisonError::into_inner).get(&key).map(|e| (e.src == src_bytes && e.dst == dst_bytes).then(|| e.transform.clone()));
     match hit {
         Some(Some(t)) => return Ok(t),
         Some(None) => return Ok(Arc::new(Transform::with_options(src, dst, opts)?)),
         None => {}
     }
     let t = Arc::new(Transform::with_options(src, dst, opts)?);
-    let mut c = cache.lock().unwrap_or_else(|e| e.into_inner());
+    let mut c = cache.lock().unwrap_or_else(PoisonError::into_inner);
     if c.len() > 64 {
         c.clear();
     }
diff --git a/crates/codecs/Cargo.toml b/crates/codecs/Cargo.toml
index 25f3f09be0..062f7c4f98 100644
--- a/crates/codecs/Cargo.toml
+++ b/crates/codecs/Cargo.toml
@@ -31,6 +31,8 @@ image-webp = "0.2"
 zune-jpeg = "0.5"
 zune-core = "0.5"
 jpeg-encoder = "0.6"
+# 12-bit and arithmetic-coded JPEG, which zune-jpeg does not decode.
+craft-jpeg.workspace = true
 photocraft-heif = { path = "../heif", optional = true }
 
 # Orientation is applied a band of rows per task on native; wasm stays single-threaded.
diff --git a/crates/codecs/README.md b/crates/codecs/README.md
index c191cc40b2..29d4d1234d 100644
--- a/crates/codecs/README.md
+++ b/crates/codecs/README.md
@@ -49,7 +49,7 @@ let out = encode(&img, Format::Tiff, &EncodeOptions::default())?;
 | DPX | yes | yes | U8, U16 (10/12-bit code values read and written exactly through U16) | Gray, RGB, RGBA | yes | no | no | no | no | DPX header fields only (creator, project, copyright, creation time, transfer, colorimetric, frame position, frame rate, time code) | no | built in |
 | Cineon | yes | yes | U16 (10-bit code values read and written exactly through U16) | Gray, RGB | no | no | no | no | no | no | no | built in |
 | DICOM | yes | **no** | U8, U16 | Gray, RGB | no | no | no | no | no | no | n/a | built in |
-| Amiga IFF (ILBM/PBM) | yes | **no** | U8 | RGB, RGBA | yes | no | no | no | no | no | n/a | built in |
+| Amiga IFF (ILBM/PBM) | yes | yes (24-bit ILBM) | U8 | RGB, RGBA | yes (1-bit mask plane on write) | no | no | no | no | no | no | built in |
 | AVIF | **no** | only with feature `avif` | U8 | RGB, RGBA | yes | no | no | no | no | no | yes | `image` + `ravif` |
 | HEIF/HEIC | with feature `heif` | **no** | U8, U16 (10/12-bit decodes to U16) | RGB, RGBA | yes (auxiliary alpha) | yes (`colr` prof) | yes | yes | no | no | n/a | `heic-rs` |
 
@@ -134,12 +134,17 @@ embedded table (and a PNG's transparent entry) so `photocraft-io` can open them
   interpretations return `Unsupported`/`Malformed`. There is no DICOM writer
   (`ASYMMETRIC_EXCEPTIONS`).
 
-* **Amiga IFF (read-only).** `FORM ... ILBM` stores interleaved 1–8 bitplanes;
+* **Amiga IFF.** `FORM ... ILBM` stores interleaved 1–8 bitplanes;
   `FORM ... PBM ` stores 8-bit chunky palette indices with even-padded rows. Both support
   stored and ByteRun1 compression, a `CMAP` palette (grey ramp when absent, black for missing
-  entries), and transparent-colour masking. ILBM also supports a separate mask plane. HAM/EHB
-  viewport modes, PBM mask planes, other bit depths and compressions return
-  `CodecError::Unsupported`. There is no IFF writer; save as PNG.
+  entries), and transparent-color masking. ILBM also supports a separate mask plane and
+  24-bitplane RGB ("deep" ILBM: 8 planes each of red, green and blue, least significant bit
+  first, no palette). HAM/EHB viewport modes, PBM mask planes, a transparent color in a
+  24-bitplane file, other bit depths and compressions return `CodecError::Unsupported`.
+  Writing produces a 24-bitplane ILBM, ByteRun1 compressed one plane row at a time, at most
+  65535 × 65535 pixels. An image with alpha gets a mask plane (masking 1): alpha of 128 or more
+  is opaque, and `AlphaBinarized` is raised when any pixel is not fully opaque. Gray is
+  expanded to RGB, and 16-bit and float images are reduced to 8 bits.
 
 * **Camera raw files** (DNG, CR2, NEF, ARW… which are TIFF-structured) are recognised and refused
   with `CodecError::Unsupported`: they are sensor data, not flat images. `photocraft-raw` decodes
@@ -219,8 +224,14 @@ embedded table (and a PNG's transparent entry) so `photocraft-io` can open them
     planar configuration 1 or 2.
   * Supports 1, 2 and 4-bit gray, 8/16/32/64-bit integers (32 and 64-bit are reduced to U16),
     F16, F32 and F64 (converted to F32), WhiteIsZero (#691: the tones are no longer inverted),
-    palette images (opened as RGB), associated alpha (made straight) and extra samples (dropped
-    unless the first is alpha).
+    palette images (opened as RGB) and associated alpha (made straight).
+  * Extra samples: the first alpha sample (ExtraSamples 1 or 2, wherever it sits) is the image's
+    alpha. Every other extra sample, such as a spot colour or a further alpha channel
+    (ExtraSamples 0), comes back in `Metadata::extra_samples`: one plane per sample in the
+    image's sample type, with its ExtraSamples value as `kind` (a reserved value above 2 reads as
+    0). At most `MAX_EXTRA_SAMPLES` (16) are kept, and they count against `Limits::max_alloc` with
+    the image: when the image fits but its extra samples don't, it opens without them and carries
+    `DecodeWarning::ExtraSamplesDropped`.
   * Every directory is reachable: `tiff_info` lists the main IFD chain and its SubIFDs (tag 330)
     with each page's size, kind (page, reduced-resolution copy, mask) and storage, walked with a
     seen-set, a depth limit and a 10 000-directory cap; `decode_tiff_page` opens any of them.
@@ -234,7 +245,11 @@ embedded table (and a PNG's transparent entry) so `photocraft-io` can open them
   * YCbCr, CIE Lab, signed integers and compressions that the `tiff` crate lacks (CCITT,
     JPEG-in-TIFF) return `Unsupported`.
 * **TIFF encode** writes classic TIFF, or BigTIFF when `EncodeOptions::tiff_bigtiff` is set or
-  the file could pass 4 GiB.
+  the file could pass 4 GiB. `Metadata::extra_samples` (up to 16) are written after the colour
+  and alpha samples, with their `kind` in the ExtraSamples tag (a reserved `kind` above 2 is
+  written as 0). Each plane must be exactly
+  `width × height × sample.bytes()` bytes; a plane of any other length, and more than 16 planes,
+  are encode errors rather than silently truncated or reinterpreted.
 * **EXR**
   * Multi-part files (a Maya/Arnold render writes one part per AOV) open the part that
     looks most like a colour image — RGBA beats RGB beats YA beats a single channel, so a
diff --git a/crates/codecs/src/codecs/iff.rs b/crates/codecs/src/codecs/iff.rs
index cae046f3b7..4997817ca9 100644
--- a/crates/codecs/src/codecs/iff.rs
+++ b/crates/codecs/src/codecs/iff.rs
@@ -1,13 +1,18 @@
-//! Amiga IFF/ILBM reader (EA "Interchange File Format", "InterLeaved BitMap" and the chunky
-//! "PBM " variant). Written from the published IFF/ILBM layout: a `FORM` chunk of four-byte
+//! Amiga IFF/ILBM reader and writer (EA "Interchange File Format", "InterLeaved BitMap" and the
+//! chunky "PBM " variant). Written from the published IFF/ILBM layout: a `FORM` chunk of four-byte
 //! chunks (`BMHD` bitmap header, `CMAP` palette, `CAMG` Amiga viewport mode, `BODY` pixel data).
-//! Read-only: modern saves should use PNG.
 //!
-//! Supported: 1–8 bitplanes with a palette (or a grey ramp when there is none), masking 0/1/2,
-//! and both stored (0) and ByteRun1/PackBits (1) compression. Anything else is a clear
-//! `Unsupported`/`Malformed` error, never a panic.
+//! Read: 1–8 bitplanes with a palette (or a gray ramp when there is none) with masking 0/1/2, and
+//! 24-bitplane "deep" ILBMs (8 planes each of red, green and blue, least significant bit first,
+//! no palette) with masking 0/1, both stored (0) and ByteRun1/PackBits (1) compressed. Anything
+//! else is a clear `Unsupported`/`Malformed` error, never a panic.
+//!
+//! Write: a 24-bitplane ILBM, ByteRun1 compressed one plane row at a time, with a mask plane
+//! (masking 1) when the image has alpha. The mask plane is one bit per pixel: alpha of 128 or
+//! more is opaque.
 
 use crate::error::CodecError;
+use crate::fidelity::Plan;
 use crate::format::Format;
 use crate::image::{ChannelLayout, Image, SampleType};
 use crate::options::Limits;
@@ -37,6 +42,9 @@ pub(crate) fn looks_like_iff(b: &[u8]) -> bool {
     b.get(0..4) == Some(b"FORM") && matches!(b.get(8..12), Some(b"ILBM" | b"PBM "))
 }
 
+/// Bitplanes of a "deep" ILBM: red, green and blue, 8 each, least significant bit first.
+const DEEP_PLANES: u8 = 24;
+
 /// The bitmap header fields decoding needs.
 struct Header {
     width: u32,
@@ -88,12 +96,15 @@ fn parse_header(b: &[u8], chunky: bool) -> Result<Header, CodecError> {
     if width == 0 || height == 0 {
         return Err(bad("zero-sized bitmap"));
     }
-    if !(1..=8).contains(&planes) {
-        return Err(unsupported(format!("{planes} bitplanes (1–8, with a palette)")));
+    if !(1..=8).contains(&planes) && planes != DEEP_PLANES {
+        return Err(unsupported(format!("{planes} bitplanes (1–8 with a palette, or 24)")));
     }
     if masking > 2 {
         return Err(unsupported(format!("masking {masking}")));
     }
+    if planes == DEEP_PLANES && masking == 2 {
+        return Err(unsupported("a transparent color in a 24-bitplane ILBM"));
+    }
     if compression > 1 {
         return Err(unsupported(format!("compression {compression} (only stored and ByteRun1)")));
     }
@@ -201,7 +212,7 @@ pub(crate) fn decode(b: &[u8], limits: &Limits) -> Result<Image, CodecError> {
             } else {
                 (0..planes).filter(|&p| bit_at(&stored, (y * rows_planes + p) * plane_row, x)).fold(0usize, |acc, p| acc | (1 << p))
             };
-            let c = palette(index);
+            let c = if h.planes == DEEP_PLANES { [index as u8, (index >> 8) as u8, (index >> 16) as u8] } else { palette(index) };
             out.extend_from_slice(&c);
             if h.masking != 0 {
                 let opaque = if h.masking == 1 { bit_at(&stored, (y * rows_planes + planes) * plane_row, x) } else { index != usize::from(h.transparent) };
@@ -217,6 +228,104 @@ fn bit_at(stored: &[u8], base: usize, x: usize) -> bool {
     stored.get(base + x / 8).is_some_and(|byte| byte & (0x80 >> (x % 8)) != 0)
 }
 
+/// ByteRun1 / PackBits encode of one plane row, appended to `out`: three or more equal bytes
+/// become a repeat (at most 128), everything else literal runs (at most 128 bytes).
+fn pack_byte_run1(row: &[u8], out: &mut Vec<u8>) {
+    let mut i = 0usize;
+    while let Some(&value) = row.get(i) {
+        let repeat = row[i..].iter().take(128).take_while(|&&b| b == value).count();
+        if repeat >= 3 {
+            out.push((1 - repeat as i32) as i8 as u8);
+            out.push(value);
+            i += repeat;
+            continue;
+        }
+        let start = i;
+        while i < row.len() && i - start < 128 {
+            if row.get(i..i + 3).is_some_and(|r| r[0] == r[1] && r[1] == r[2]) {
+                break;
+            }
+            i += 1;
+        }
+        out.push((i - start - 1) as u8);
+        out.extend_from_slice(&row[start..i]);
+    }
+}
+
+fn push_chunk(out: &mut Vec<u8>, id: &[u8; 4], data: &[u8]) -> Result<(), CodecError> {
+    let len = u32::try_from(data.len()).map_err(|_| CodecError::encode(F, "chunk too large for an IFF file (4 GiB)"))?;
+    out.extend_from_slice(id);
+    out.extend_from_slice(&len.to_be_bytes());
+    out.extend_from_slice(data);
+    // Chunks are padded to an even length.
+    if data.len() % 2 == 1 {
+        out.push(0);
+    }
+    Ok(())
+}
+
+/// Writes a 24-bitplane `FORM ILBM`: `BMHD` then a ByteRun1-compressed `BODY`, each row stored as
+/// the red, green and blue planes (least significant bit first) and, for RGBA, a mask plane.
+pub(crate) fn encode(src: &Image, plan: Plan) -> Result<Vec<u8>, CodecError> {
+    let enc = |msg: String| CodecError::encode(F, msg);
+    let img = src.converted(plan.layout, plan.sample);
+    let masked = match img.layout() {
+        ChannelLayout::Rgb => false,
+        ChannelLayout::Rgba => true,
+        l => return Err(enc(format!("IFF/ILBM cannot store {l:?}"))),
+    };
+    if img.sample_type() != SampleType::U8 {
+        return Err(enc(format!("IFF/ILBM cannot store {:?} samples", img.sample_type())));
+    }
+    let (w, h) = img.dimensions();
+    let (Ok(w16), Ok(h16)) = (u16::try_from(w), u16::try_from(h)) else {
+        return Err(enc("IFF/ILBM stores at most 65535 × 65535 pixels".into()));
+    };
+    let (w, ch) = (w as usize, img.layout().channels());
+    let data = img.data();
+    let row_len = w.checked_mul(ch).ok_or_else(|| enc("image too large".into()))?;
+    if data.len() != row_len.checked_mul(h as usize).ok_or_else(|| enc("image too large".into()))? {
+        return Err(enc("the image has the wrong number of samples".into()));
+    }
+    let planes = usize::from(DEEP_PLANES) + usize::from(masked);
+    let mut plane_row = vec![0u8; w.div_ceil(16) * 2];
+    let mut body = Vec::new();
+    for px in data.chunks_exact(row_len.max(1)) {
+        for plane in 0..planes {
+            plane_row.fill(0);
+            for (x, p) in px.chunks_exact(ch).enumerate() {
+                let on = if plane == usize::from(DEEP_PLANES) { p[3] >= 128 } else { (p[plane / 8] >> (plane % 8)) & 1 == 1 };
+                if on {
+                    plane_row[x / 8] |= 0x80 >> (x % 8);
+                }
+            }
+            pack_byte_run1(&plane_row, &mut body);
+        }
+    }
+
+    let mut bmhd = Vec::with_capacity(20);
+    bmhd.extend_from_slice(&w16.to_be_bytes());
+    bmhd.extend_from_slice(&h16.to_be_bytes());
+    bmhd.extend_from_slice(&[0, 0, 0, 0]); // x/y origin
+    bmhd.push(DEEP_PLANES);
+    bmhd.push(u8::from(masked)); // masking: 1 = a mask plane follows the color planes
+    bmhd.push(1); // ByteRun1
+    bmhd.push(0); // pad
+    bmhd.extend_from_slice(&[0, 0]); // transparent color (unused)
+    bmhd.extend_from_slice(&[1, 1]); // square pixels
+    bmhd.extend_from_slice(&w16.to_be_bytes()); // page size
+    bmhd.extend_from_slice(&h16.to_be_bytes());
+
+    let mut out = b"FORM".to_vec();
+    out.extend_from_slice(&[0; 4]); // patched below
+    out.extend_from_slice(b"ILBM");
+    push_chunk(&mut out, b"BMHD", &bmhd)?;
+    push_chunk(&mut out, b"BODY", &body)?;
+    let form_len = u32::try_from(out.len() - 8).map_err(|_| enc("image too large for an IFF file (4 GiB)".into()))?;
+    out[4..8].copy_from_slice(&form_len.to_be_bytes());
+    Ok(out)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -339,6 +448,87 @@ mod tests {
         assert_eq!(decode(&b, &Limits::default()).unwrap().data(), &[0, 0, 0]);
     }
 
+    fn plan(layout: ChannelLayout) -> Plan {
+        Plan { layout, sample: SampleType::U8 }
+    }
+
+    #[test]
+    fn reads_a_stored_24_plane_bitmap() {
+        // 2×1: pixel 0 = (1, 0, 128), pixel 1 = (0, 255, 0). Each plane row is 2 bytes; red bit 0
+        // has pixel 0 set, green bits 0–7 have pixel 1 set, blue bit 7 has pixel 0 set.
+        let mut body = Vec::new();
+        for plane in 0..24 {
+            let byte = match plane {
+                0 | 23 => 0x80,
+                8..=15 => 0x40,
+                _ => 0,
+            };
+            body.extend_from_slice(&[byte, 0]);
+        }
+        let b = ilbm(2, 1, 24, &[], 0, &body);
+        let img = decode(&b, &Limits::default()).unwrap();
+        assert_eq!((img.width(), img.height(), img.layout()), (2, 1, ChannelLayout::Rgb));
+        assert_eq!(img.data(), &[1, 0, 128, 0, 255, 0]);
+    }
+
+    #[test]
+    fn writes_24_plane_byte_run1_that_reads_back_exactly() {
+        // 37 pixels wide: three plane-row words, the last one partly padding.
+        let (w, h) = (37u32, 3u32);
+        let data: Vec<u8> = (0..w * h * 3).map(|i| (i * 7 % 256) as u8).collect();
+        let img = Image::from_u8(w, h, ChannelLayout::Rgb, data.clone()).unwrap();
+        let bytes = encode(&img, plan(ChannelLayout::Rgb)).unwrap();
+        assert!(looks_like_iff(&bytes));
+        assert_eq!(be32(&bytes, 4).unwrap() as usize, bytes.len() - 8, "FORM length");
+        let h = parse_header(&bytes, false).unwrap();
+        assert_eq!((h.width, h.height, h.planes, h.masking, h.compression), (37, 3, 24, 0, 1));
+        assert!(chunks(&bytes).all(|c| &c.id != b"CMAP"), "a deep ILBM has no palette");
+        let back = decode(&bytes, &Limits::default()).unwrap();
+        assert_eq!(back.layout(), ChannelLayout::Rgb);
+        assert_eq!(back.data(), &data[..]);
+    }
+
+    #[test]
+    fn alpha_is_written_as_a_mask_plane() {
+        let data = [10, 20, 30, 0, 40, 50, 60, 127, 70, 80, 90, 128, 1, 2, 3, 255];
+        let img = Image::from_u8(4, 1, ChannelLayout::Rgba, data.to_vec()).unwrap();
+        let bytes = encode(&img, plan(ChannelLayout::Rgba)).unwrap();
+        assert_eq!(parse_header(&bytes, false).unwrap().masking, 1);
+        let back = decode(&bytes, &Limits::default()).unwrap();
+        assert_eq!(back.layout(), ChannelLayout::Rgba);
+        assert_eq!(back.data(), &[10, 20, 30, 0, 40, 50, 60, 0, 70, 80, 90, 255, 1, 2, 3, 255]);
+    }
+
+    #[test]
+    fn byte_run1_round_trips_runs_literals_and_long_rows() {
+        let mut rows: Vec<Vec<u8>> = vec![vec![], vec![5], vec![5, 5], vec![5, 5, 5], vec![1, 2, 2, 2, 3], vec![9; 300]];
+        rows.push((0..300).map(|i| (i % 251) as u8).collect());
+        rows.push([vec![1, 2], vec![7; 129], vec![3]].concat());
+        for row in rows {
+            let mut packed = Vec::new();
+            pack_byte_run1(&row, &mut packed);
+            let mut back = vec![0; row.len()];
+            assert_eq!(unpack_byte_run1(&packed, &mut back).unwrap(), packed.len(), "{row:?}");
+            assert_eq!(back, row);
+        }
+        // A long repeat packs into two-byte runs.
+        let mut packed = Vec::new();
+        pack_byte_run1(&[0; 256], &mut packed);
+        assert_eq!(packed, [0x81, 0, 0x81, 0]);
+    }
+
+    #[test]
+    fn rejects_what_ilbm_cannot_store() {
+        let gray = Image::from_u8(1, 1, ChannelLayout::Gray, vec![0]).unwrap();
+        assert!(encode(&gray, plan(ChannelLayout::Gray)).is_err());
+        let wide = Image::from_u8(65536, 1, ChannelLayout::Rgb, vec![0; 65536 * 3]).unwrap();
+        assert!(encode(&wide, plan(ChannelLayout::Rgb)).is_err());
+        // A transparent color index has no meaning without a palette.
+        let mut b = ilbm(1, 1, 24, &[], 0, &[0; 48]);
+        b[29] = 2;
+        assert!(matches!(decode(&b, &Limits::default()), Err(CodecError::Unsupported { .. })));
+    }
+
     #[test]
     fn hostile_input_errors_not_panics() {
         // Truncations of a valid file never panic.
diff --git a/crates/codecs/src/codecs/jpeg.rs b/crates/codecs/src/codecs/jpeg.rs
index 14d8f8ffec..3e533ccd08 100644
--- a/crates/codecs/src/codecs/jpeg.rs
+++ b/crates/codecs/src/codecs/jpeg.rs
@@ -1,4 +1,5 @@
-//! JPEG: decode via `zune-jpeg` (gray, YCbCr, CMYK, YCCK), encode via
+//! JPEG: decode via `zune-jpeg` (gray, YCbCr, CMYK, YCCK; arithmetic-coded and 12-bit files
+//! via [`craft_jpeg`]), encode via
 //! `jpeg-encoder` (gray, RGB, CMYK). Metadata (APP0 JFIF density, APP1
 //! EXIF/XMP, APP2 multi-segment ICC, APP13 Photoshop resources, APP14 Adobe) is
 //! parsed by our own marker scanner so behaviour does not depend on decoder internals.
@@ -190,6 +191,47 @@ fn err(e: impl std::fmt::Display) -> CodecError {
     CodecError::malformed(F, e)
 }
 
+/// Whether `craft-jpeg` (rather than `zune-jpeg`) decodes the file: arithmetic coding
+/// (SOF9–SOF11) or a DCT frame whose precision isn't 8 bits (#4934, #5003). Lossless (SOF3) and
+/// 12-bit progressive Huffman (SOF2) go there too: craft-jpeg reports them unsupported, where
+/// zune-jpeg's failure would read as a damaged file.
+fn uses_craft_jpeg(bytes: &[u8]) -> bool {
+    match craft_jpeg::frame(bytes) {
+        Some(f) if (0xC9..=0xCB).contains(&f.marker) || f.marker == 0xC3 => true,
+        Some(f) if matches!(f.marker, 0xC0..=0xC2) => f.precision != 8,
+        _ => false,
+    }
+}
+
+fn craft_jpeg_error(e: craft_jpeg::Error) -> CodecError {
+    match e {
+        craft_jpeg::Error::Malformed(m) => err(m),
+        craft_jpeg::Error::Unsupported(m) => CodecError::unsupported(F, m),
+        craft_jpeg::Error::LimitExceeded(m) => CodecError::LimitExceeded(m),
+        e => err(e),
+    }
+}
+
+/// Decode a file [`uses_craft_jpeg`] routes away from `zune-jpeg`; `damaged` says entropy-coded
+/// data was cut short or corrupt.
+fn decode_craft_jpeg(bytes: &[u8], limits: &Limits, adobe_transform: Option<u8>) -> Result<(Image, bool), CodecError> {
+    let mut lim = craft_jpeg::Limits::default();
+    lim.max_pixels = limits.max_pixels;
+    lim.max_alloc = limits.max_alloc;
+    let d = craft_jpeg::decode(bytes, &lim, adobe_transform).map_err(craft_jpeg_error)?;
+    let layout = match d.components {
+        1 => ChannelLayout::Gray,
+        3 => ChannelLayout::Rgb,
+        4 => ChannelLayout::Cmyk,
+        n => return Err(err(format!("{n} components"))),
+    };
+    let img = match d.samples {
+        craft_jpeg::Samples::U8(px) => Image::from_raw(d.width, d.height, layout, SampleType::U8, px)?,
+        craft_jpeg::Samples::U16(px) => Image::from_u16(d.width, d.height, layout, &px)?,
+    };
+    Ok((img, d.damaged))
+}
+
 /// Most pixels one byte of truncated scan data may account for. Even a flat image costs a few
 /// bits per 8×8 block, and truncated photographs are far above this.
 const MAX_TRUNCATED_PIXELS_PER_BYTE: u64 = 2048;
@@ -203,6 +245,25 @@ pub(crate) fn decode(bytes: &[u8], limits: &Limits) -> Result<Image, CodecError>
     if let Some((w, h, nc)) = meta.frame {
         limits.check_bytes(w, h, u64::from(nc.max(1)))?;
     }
+    if uses_craft_jpeg(bytes) {
+        // craft-jpeg sizes its buffers from the frame header before it reads a scan.
+        if scan_bytes == 0 {
+            return Err(err("the file has no scan data"));
+        }
+        if let Some((w, h, _)) = meta.frame
+            && end == DataEnd::Truncated
+            && u64::from(w) * u64::from(h) / MAX_TRUNCATED_PIXELS_PER_BYTE > scan_bytes
+        {
+            return Err(err("the truncated scan is too short for the frame it declares"));
+        }
+        let (mut img, damaged) = decode_craft_jpeg(bytes, limits, meta.adobe_transform)?;
+        img.icc = meta.icc;
+        img.meta = Metadata { exif: meta.exif, xmp: meta.xmp, dpi: meta.dpi, photoshop_resources: meta.photoshop, ..Default::default() };
+        if end == DataEnd::Truncated || damaged {
+            img.warnings.push(DecodeWarning::Truncated { format: F });
+        }
+        return Ok(img);
+    }
     let options = DecoderOptions::default().set_strict_mode(false).set_max_width(65535).set_max_height(65535);
     let mut dec = zune_jpeg::JpegDecoder::new_with_options(ZCursor::new(bytes), options);
     dec.decode_headers().map_err(err)?;
@@ -553,4 +614,178 @@ mod tests {
         assert!(has_jfif_app0(&bytes));
         assert_eq!(scan_metadata(&bytes).dpi, Some((96.0, 96.0)));
     }
+
+    // --- Arithmetic-coded and 12-bit files, decoded by craft-jpeg ---
+
+    fn segment(out: &mut Vec<u8>, marker: u8, body: &[u8]) {
+        out.extend_from_slice(&[0xFF, marker]);
+        out.extend_from_slice(&((body.len() + 2) as u16).to_be_bytes());
+        out.extend_from_slice(body);
+    }
+
+    /// One 8×8 gray block, quantizer 1, with entropy-coded scan data `data`.
+    fn gray_block(sof: u8, precision: u8, dht: Option<&[u8]>, data: &[u8]) -> Vec<u8> {
+        let mut s = vec![0xFF, 0xD8];
+        let mut dqt = vec![0u8];
+        dqt.extend([1u8; 64]);
+        segment(&mut s, 0xDB, &dqt);
+        segment(&mut s, sof, &[precision, 0, 8, 0, 8, 1, 1, 0x11, 0]);
+        if let Some(dht) = dht {
+            segment(&mut s, 0xC4, dht);
+        }
+        segment(&mut s, 0xDA, &[1, 1, 0x00, 0, 63, 0]);
+        s.extend_from_slice(data);
+        s.extend([0xFF, 0xD9]);
+        s
+    }
+
+    /// SOF9 with only a DC coefficient (from a T.81 arithmetic encoder): 8-bit DC 200 → sample
+    /// 200 / 8 + 128 = 153; 12-bit DC 1000 → 1000 / 8 + 2048 = 2173.
+    fn arithmetic_block(precision: u8) -> Vec<u8> {
+        let data: &[u8] = if precision == 8 { &[210, 217, 68, 0] } else { &[210, 234, 134, 0] };
+        gray_block(0xC9, precision, None, data)
+    }
+
+    /// A 12-bit SOF1 stream: one DC coefficient. The DC table has one code (`0`, category 13),
+    /// the AC table one (`0`, end of block). DC = 7616 → sample 7616 / 8 + 2048 = 3000.
+    fn twelve_bit_huffman_block() -> Vec<u8> {
+        let mut dht = vec![0x00, 1];
+        dht.extend([0u8; 15]);
+        dht.push(13);
+        dht.extend([0x10, 1]);
+        dht.extend([0u8; 15]);
+        dht.push(0x00);
+        // Bits: `0`, 7616 in 13 bits, `0`, one pad `1`.
+        let word: u16 = (7616 << 2) | 1;
+        gray_block(0xC1, 12, Some(&dht), &word.to_be_bytes())
+    }
+
+    fn twelve_bit(v: f32) -> u16 {
+        (v * 65535.0 / 4095.0).round() as u16
+    }
+
+    #[test]
+    fn routing() {
+        assert!(!uses_craft_jpeg(&[0xFF, 0xD8, 0xFF, 0xC0, 0, 11, 8, 0, 8, 0, 8, 1, 1, 0x11, 0]));
+        assert!(!uses_craft_jpeg(&[0xFF, 0xD8, 0xFF, 0xC1, 0, 11, 8, 0, 8, 0, 8, 1, 1, 0x11, 0]));
+        assert!(uses_craft_jpeg(&[0xFF, 0xD8, 0xFF, 0xC9, 0, 11, 8, 0, 8, 0, 8, 1, 1, 0x11, 0]));
+        assert!(uses_craft_jpeg(&[0xFF, 0xD8, 0xFF, 0xC1, 0, 11, 12, 0, 8, 0, 8, 1, 1, 0x11, 0]));
+        assert!(uses_craft_jpeg(&[0xFF, 0xD8, 0xFF, 0xC0, 0, 11, 12, 0, 8, 0, 8, 1, 1, 0x11, 0]));
+        assert!(!uses_craft_jpeg(&[0xFF, 0xD8]));
+        assert!(!uses_craft_jpeg(&[0xFF, 0xD8, 0xFF, 0xC2, 0, 11, 8, 0, 8, 0, 8, 1, 1, 0x11, 0]));
+        assert!(uses_craft_jpeg(&[0xFF, 0xD8, 0xFF, 0xC2, 0, 11, 12, 0, 8, 0, 8, 1, 1, 0x11, 0]));
+        assert!(uses_craft_jpeg(&[0xFF, 0xD8, 0xFF, 0xC3, 0, 11, 8, 0, 8, 0, 8, 1, 1, 0x11, 0]));
+    }
+
+    #[test]
+    fn lossless_and_twelve_bit_progressive_are_unsupported_not_damaged() {
+        for marker in [0xC3, 0xC2] {
+            let mut bytes = vec![0xFF, 0xD8, 0xFF, marker, 0, 11, 12, 0, 8, 0, 8, 1, 1, 0x11, 0];
+            bytes.extend_from_slice(&[0xFF, 0xDA, 0, 8, 1, 1, 0, 0, 0x3F, 0, 0x12, 0x34, 0xFF, 0xD9]);
+            let e = crate::decode(&bytes).unwrap_err();
+            assert!(matches!(e, CodecError::Unsupported { .. }), "{marker:#x}: {e:?}");
+        }
+    }
+
+    #[test]
+    fn a_twelve_bit_frame_without_scan_data_is_refused_before_decoding() {
+        let mut bytes = vec![0xFF, 0xD8, 0xFF, 0xC1, 0, 11, 12, 0x40, 0, 0x40, 0, 1, 1, 0x11, 0];
+        bytes.extend_from_slice(&[0xFF, 0xDA, 0, 8, 1, 1, 0, 0, 0x3F, 0, 0xFF, 0xD9]);
+        let e = crate::decode(&bytes).unwrap_err();
+        assert!(e.to_string().contains("no scan data"), "{e}");
+    }
+
+    #[test]
+    fn arithmetic_eight_bit_block_is_eight_bit() {
+        let img = crate::decode(&arithmetic_block(8)).unwrap();
+        assert_eq!((img.dimensions(), img.sample_type(), img.layout()), ((8, 8), SampleType::U8, ChannelLayout::Gray));
+        assert!(img.data().iter().all(|&v| v.abs_diff(153) <= 1), "{:?}", &img.data()[..4]);
+        assert!(img.warnings.is_empty());
+    }
+
+    #[test]
+    fn arithmetic_twelve_bit_block_is_sixteen_bit() {
+        let img = crate::decode(&arithmetic_block(12)).unwrap();
+        assert_eq!((img.dimensions(), img.sample_type(), img.layout()), ((8, 8), SampleType::U16, ChannelLayout::Gray));
+        let want = twelve_bit(2173.0);
+        assert!(img.to_u16_samples().unwrap().iter().all(|&v| v.abs_diff(want) <= 1));
+    }
+
+    #[test]
+    fn twelve_bit_huffman_block_decodes_to_sixteen_bit() {
+        let img = crate::decode(&twelve_bit_huffman_block()).unwrap();
+        assert_eq!((img.dimensions(), img.sample_type()), ((8, 8), SampleType::U16));
+        let want = twelve_bit(3000.0);
+        let px = img.to_u16_samples().unwrap();
+        assert!(px.iter().all(|&v| v.abs_diff(want) <= 1), "{:?} vs {want}", &px[..4]);
+        assert!(img.warnings.is_empty());
+    }
+
+    #[test]
+    fn twelve_bit_jpeg_keeps_its_photoshop_resources() {
+        // An APP13 `8BIM` block (paths, Photoshop settings) right after SOI, as on the zune-jpeg path.
+        let resources = b"8BIM\x04\x04\0\0\0\0\0\0".to_vec();
+        let mut app13 = PHOTOSHOP_HEADER.to_vec();
+        app13.extend_from_slice(&resources);
+        let stream = twelve_bit_huffman_block();
+        let mut with = stream[..2].to_vec();
+        segment(&mut with, 0xED, &app13);
+        with.extend_from_slice(&stream[2..]);
+        assert!(uses_craft_jpeg(&with));
+        let img = crate::decode(&with).unwrap();
+        assert_eq!(img.meta.photoshop_resources.as_deref(), Some(resources.as_slice()));
+    }
+
+    /// Where the entropy-coded data of the last scan starts.
+    fn last_scan_data(s: &[u8]) -> usize {
+        let sos = s.windows(2).rposition(|p| p == [0xFF, 0xDA]).unwrap();
+        sos + 2 + usize::from(u16::from_be_bytes([s[sos + 2], s[sos + 3]]))
+    }
+
+    /// A 12-bit scan whose entropy data runs out, EOI kept, is never a clean image.
+    #[test]
+    fn twelve_bit_scan_out_of_data_is_not_clean() {
+        let full = twelve_bit_huffman_block();
+        let data = last_scan_data(&full);
+        for keep in 0..2 {
+            let mut s = full[..data + keep].to_vec();
+            s.extend([0xFF, 0xD9]);
+            if let Ok(img) = crate::decode(&s) {
+                assert!(!img.warnings.is_empty(), "keep {keep}: clean decode of missing data");
+            }
+        }
+    }
+
+    /// A multi-MCU SOF1 12-bit scan cut in half, EOI kept, decodes with the Truncated warning; a
+    /// truncated scan too short for its frame is refused, as on the zune-jpeg path.
+    #[test]
+    fn damaged_or_truncated_twelve_bit_scan() {
+        let (w, h) = (64usize, 64usize);
+        let rgb: Vec<u8> = (0..w * h).flat_map(|i| [(i % w * 4) as u8, (i / w * 4) as u8, (i * 7) as u8]).collect();
+        let mut out = Vec::new();
+        jpeg_encoder::Encoder::new(&mut out, 90).encode(&rgb, w as u16, h as u16, jpeg_encoder::ColorType::Rgb).unwrap();
+        // Relabel the baseline frame as 12-bit SOF1: the Huffman data still parses, as different values.
+        let sof = out.windows(2).position(|p| p == [0xFF, 0xC0]).unwrap();
+        out[sof + 1] = 0xC1;
+        out[sof + 4] = 12;
+        let data = last_scan_data(&out);
+        let end = out.len() - 2;
+        let mut cut = out[..data + (end - data) / 2].to_vec();
+        if cut.last() == Some(&0xFF) {
+            cut.pop();
+        }
+        cut.extend([0xFF, 0xD9]);
+        let img = crate::decode(&out).unwrap();
+        assert_eq!(img.sample_type(), SampleType::U16);
+        assert!(img.warnings.is_empty(), "{:?}", img.warnings);
+        let img = crate::decode(&cut).unwrap();
+        assert_eq!(img.warnings, vec![DecodeWarning::Truncated { format: Format::Jpeg }]);
+        // Without EOI the same cut is a truncated file; under a 20000×20000 frame it is refused.
+        cut.truncate(cut.len() - 2);
+        assert_eq!(data_end(&cut).0, DataEnd::Truncated);
+        assert!(crate::decode(&cut).is_ok());
+        cut[sof + 5..sof + 9].copy_from_slice(&[0x4E, 0x20, 0x4E, 0x20]);
+        let e = crate::decode(&cut).unwrap_err();
+        assert!(e.to_string().contains("too short for the frame it declares"), "{e}");
+    }
 }
diff --git a/crates/codecs/src/codecs/png.rs b/crates/codecs/src/codecs/png.rs
index 085246b3f1..7fbbbc69db 100644
--- a/crates/codecs/src/codecs/png.rs
+++ b/crates/codecs/src/codecs/png.rs
@@ -140,7 +140,7 @@ pub fn stereo(bytes: &[u8]) -> Option<PngStereo> {
         }
         let Ok(length) = usize::try_from(length) else { break };
         let Some(data) = tail.get(..length) else { break };
-        let Some((checksum, next)) = tail.get(length..).and_then(|t| t.split_first_chunk::<4>()) else { break };
+        let Some((checksum, next)) = tail.get(length..).and_then(<[u8]>::split_first_chunk::<4>) else { break };
         rest = next;
         if kind == b"IEND" {
             break;
@@ -194,7 +194,7 @@ fn read_text_metadata(bytes: &[u8], mut remaining: usize, meta: &mut Metadata) -
         }
         let Ok(length) = usize::try_from(length) else { break };
         let Some(data) = tail.get(..length) else { break };
-        let Some((checksum, next)) = tail.get(length..).and_then(|t| t.split_first_chunk::<4>()) else { break };
+        let Some((checksum, next)) = tail.get(length..).and_then(<[u8]>::split_first_chunk::<4>) else { break };
         rest = next;
         if kind == b"IEND" {
             break;
diff --git a/crates/codecs/src/codecs/tiff.rs b/crates/codecs/src/codecs/tiff.rs
index 9528fec9c8..dbe44f2427 100644
--- a/crates/codecs/src/codecs/tiff.rs
+++ b/crates/codecs/src/codecs/tiff.rs
@@ -249,7 +249,9 @@ pub(crate) fn decode_page(bytes: &[u8], page: Option<usize>, limits: &Limits) ->
         .ok_or_else(|| CodecError::InvalidImage(format!("TIFF page {index} does not exist (the file has {} directories)", info.pages.len())))?;
     let dir = file.ifd(p.ifd_offset).ok_or_else(|| err("image directory cut off"))?;
     let mut img = decode_ifd(&file, &dir, limits)?;
+    let extra_samples = std::mem::take(&mut img.meta.extra_samples);
     img.meta = metadata(&file, &dir, &mut img.icc);
+    img.meta.extra_samples = extra_samples;
     let pages = info.page_count();
     if pages > 1 {
         img.warnings.push(DecodeWarning::MorePages { total: info.complete.then_some(u32::try_from(pages).unwrap_or(u32::MAX)) });
@@ -423,6 +425,8 @@ struct Layout {
     palette: Option<Vec<[u16; 3]>>,
     /// Upper bound for one chunk's scratch buffer.
     scratch_cap: usize,
+    /// File sample indices that are neither colour nor the chosen alpha (spot / extra alpha).
+    extra_at: Vec<usize>,
 }
 
 impl Layout {
@@ -436,6 +440,9 @@ impl Layout {
     fn out_row(&self) -> usize {
         self.w * self.out_channels() * self.out.bytes()
     }
+    fn extra_row(&self) -> usize {
+        self.w.saturating_mul(self.extra_at.len()).saturating_mul(self.out.bytes())
+    }
     /// A chunky strip already in the output's layout: decoded in place.
     fn direct(&self) -> bool {
         self.copyable() && self.across == 1
@@ -543,13 +550,16 @@ fn decode_ifd(f: &File<'_>, dir: &Ifd, limits: &Limits) -> Result<Image, CodecEr
     // returns the alpha only when it is the first extra sample: otherwise it is asked for every
     // sample (as multiband gray) and the colour and alpha samples are picked here. An alpha
     // position past the samples the file has is ignored.
-    let color = match photometric {
+    let color: usize = match photometric {
         2 | 8 | 9 => 3,
         5 => 4,
         _ => 1,
     };
-    let alpha_at = extra.iter().position(|&e| e == 1 || e == 2).filter(|&a| (color + a as u64) < spp);
-    let all_samples = palette.is_none() && matches!(photometric, 2 | 5 | 8 | 9) && alpha_at.is_some_and(|a| a > 0);
+    let alpha_at = extra.iter().position(|&e| e == 1 || e == 2).filter(|&a| (color as u64).saturating_add(a as u64) < spp);
+    // Samples the colour model does not keep. RGB, CMYK and Lab only hand back every sample when
+    // asked (photometric patched to black-is-zero below); gray already comes back as multiband.
+    let unused = !extra.is_empty() && (spp as usize) > color.saturating_add(usize::from(alpha_at.is_some()));
+    let all_samples = palette.is_none() && matches!(photometric, 2 | 5 | 8 | 9) && (alpha_at.is_some_and(|a| a > 0) || (!planar && unused));
     let mut patches: Vec<(u64, Vec<u8>)> = Vec::new();
     let encode_u = |v: u64, len: usize| -> Vec<u8> {
         let b = if f.le { v.to_le_bytes() } else { v.to_be_bytes() };
@@ -592,7 +602,31 @@ fn decode_ifd(f: &File<'_>, dir: &Ifd, limits: &Limits) -> Result<Image, CodecEr
         _ if palette.is_some() => (ChannelLayout::Rgb, 1),
         tiff::ColorType::Gray(_) => (ChannelLayout::Gray, 1),
         tiff::ColorType::Multiband { num_samples, .. } if all_samples => {
-            (if photometric == 5 { ChannelLayout::CmykA } else { ChannelLayout::Rgba }, usize::from(num_samples))
+            // Lab reads as RGB here and is relabelled below.
+            let layout = match photometric {
+                2 | 8 | 9 => {
+                    if alpha_at.is_some() {
+                        ChannelLayout::Rgba
+                    } else {
+                        ChannelLayout::Rgb
+                    }
+                }
+                5 => {
+                    if alpha_at.is_some() {
+                        ChannelLayout::CmykA
+                    } else {
+                        ChannelLayout::Cmyk
+                    }
+                }
+                _ => {
+                    if gray_alpha {
+                        ChannelLayout::GrayA
+                    } else {
+                        ChannelLayout::Gray
+                    }
+                }
+            };
+            (layout, usize::from(num_samples))
         }
         tiff::ColorType::Multiband { num_samples, .. } if photometric <= 1 => {
             (if gray_alpha { ChannelLayout::GrayA } else { ChannelLayout::Gray }, usize::from(num_samples))
@@ -661,7 +695,8 @@ fn decode_ifd(f: &File<'_>, dir: &Ifd, limits: &Limits) -> Result<Image, CodecEr
         .and_then(|s| s.checked_mul(src.bytes()))
         .ok_or_else(|| CodecError::LimitExceeded("tile size".into()))?;
     let scratch_cap = chunk_bytes.saturating_mul(2).max(64 << 20).min(limits.alloc_usize());
-    let lay = Layout {
+    let (extra_at, extras_over_limit) = extra_sample_indices(spp as usize, color, alpha_at, out_layout.has_alpha());
+    let mut lay = Layout {
         w: wu,
         src,
         out,
@@ -677,7 +712,19 @@ fn decode_ifd(f: &File<'_>, dir: &Ifd, limits: &Limits) -> Result<Image, CodecEr
         premultiplied: out_layout.has_alpha() && alpha_at.and_then(|a| extra.get(a)) == Some(&1),
         palette,
         scratch_cap,
+        extra_at,
     };
+    // Extra samples share the allocation budget with the image: their interleaved buffer and the
+    // planes split from it are held next to the image, so both count against `max_alloc`. When
+    // they don't fit, the image still opens (it passed its own check above) without them.
+    let mut extras_dropped = 0;
+    if !lay.extra_at.is_empty() {
+        let per_pixel = out_layout.channels().saturating_add(lay.extra_at.len().saturating_mul(2)).saturating_mul(out.bytes());
+        if limits.check_bytes(w, h, per_pixel as u64).is_err() {
+            extras_dropped = u32::try_from(lay.extra_at.len()).unwrap_or(u32::MAX);
+            lay.extra_at.clear();
+        }
+    }
 
     // The output, allocated once and fallibly.
     let out_row = lay.out_row();
@@ -685,7 +732,11 @@ fn decode_ifd(f: &File<'_>, dir: &Ifd, limits: &Limits) -> Result<Image, CodecEr
     let mut data = zeroed(len)?;
     let band_bytes = out_row.checked_mul(ch.min(hu)).ok_or_else(|| CodecError::LimitExceeded("band size".into()))?;
 
-    let tally = decode_bands(&lay, &mut data, band_bytes, &mut dec, &open)?;
+    let extra_row = lay.extra_row();
+    let extra_len = extra_row.checked_mul(hu).ok_or_else(|| CodecError::LimitExceeded("extra samples".into()))?;
+    let mut extra_data = if lay.extra_at.is_empty() { Vec::new() } else { zeroed(extra_len)? };
+    let extra_band = extra_row.saturating_mul(ch.min(hu));
+    let tally = decode_bands(&lay, &mut data, band_bytes, extra_data.as_mut_slice(), extra_band, &mut dec, &open)?;
     if tally.decoded == 0 && tally.missing > 0 {
         return Err(err("the image data is missing (cut off or past the end of the file)"));
     }
@@ -693,6 +744,22 @@ fn decode_ifd(f: &File<'_>, dir: &Ifd, limits: &Limits) -> Result<Image, CodecEr
         convert_ab(&mut data, out_layout.channels(), out, photometric == 8, false);
     }
     let mut img = Image::from_raw(w, h, out_layout, out, data)?;
+    if !lay.extra_at.is_empty() {
+        // TIFF 6.0 defines ExtraSamples 0, 1 and 2 only; a reserved value reads as unspecified,
+        // so a save never writes it back.
+        let kind_of = |si: usize| match si.checked_sub(color).and_then(|k| extra.get(k)).copied() {
+            Some(v @ 0..=2) => v as u16,
+            _ => 0,
+        };
+        img.meta.extra_samples = split_extra_samples(&extra_data, wu, hu, &lay.extra_at, out, kind_of)?;
+    }
+    if extras_over_limit > 0 {
+        let count = u32::try_from(extras_over_limit).unwrap_or(u32::MAX);
+        img.warnings.push(DecodeWarning::ExtraSamplesOverLimit { format: F, count });
+    }
+    if extras_dropped > 0 {
+        img.warnings.push(DecodeWarning::ExtraSamplesDropped { format: F, count: extras_dropped });
+    }
     if tally.missing > 0 {
         img.warnings.push(DecodeWarning::Truncated { format: F });
     }
@@ -728,6 +795,55 @@ fn convert_ab(data: &mut [u8], channels: usize, sample: SampleType, signed: bool
     }
 }
 
+/// File sample indices that are not a colour channel and not the one alpha sample, capped at
+/// [`crate::MAX_EXTRA_SAMPLES`], and how many past the cap were left out.
+fn extra_sample_indices(spp: usize, color: usize, alpha_at: Option<usize>, has_alpha: bool) -> (Vec<usize>, usize) {
+    let mut used = vec![false; spp];
+    for i in 0..color.min(spp) {
+        if let Some(slot) = used.get_mut(i) {
+            *slot = true;
+        }
+    }
+    if has_alpha {
+        let a = alpha_at.map(|k| color.saturating_add(k)).unwrap_or(color);
+        if let Some(slot) = used.get_mut(a) {
+            *slot = true;
+        }
+    }
+    let mut all: Vec<usize> = used.into_iter().enumerate().filter(|(_, on)| !*on).map(|(i, _)| i).collect();
+    let over = all.len().saturating_sub(crate::MAX_EXTRA_SAMPLES);
+    all.truncate(crate::MAX_EXTRA_SAMPLES);
+    (all, over)
+}
+
+/// Interleaved extra samples (`extra_at.len()` per pixel) → one plane per sample. Each plane is
+/// allocated fallibly (the caller has checked their total against the limits).
+fn split_extra_samples(
+    buf: &[u8],
+    w: usize,
+    h: usize,
+    at: &[usize],
+    sample: SampleType,
+    mut kind_of: impl FnMut(usize) -> u16,
+) -> Result<Vec<crate::ExtraSample>, CodecError> {
+    let b = sample.bytes();
+    let n = w.saturating_mul(h);
+    let spp = at.len();
+    let mut out = Vec::with_capacity(spp);
+    for (ei, &si) in at.iter().enumerate() {
+        let mut data = zeroed(n.saturating_mul(b))?;
+        for i in 0..n {
+            let src = (i.saturating_mul(spp).saturating_add(ei)).saturating_mul(b);
+            let dst = i.saturating_mul(b);
+            if let (Some(s), Some(d)) = (buf.get(src..src.saturating_add(b)), data.get_mut(dst..dst.saturating_add(b))) {
+                d.copy_from_slice(s);
+            }
+        }
+        out.push(crate::ExtraSample { kind: kind_of(si), data });
+    }
+    Ok(out)
+}
+
 /// A zero-filled buffer, allocated fallibly. On native targets the zeroing (and the first
 /// touch of every page, which dominates on a fresh multi-hundred-megabyte buffer) is spread over
 /// all cores.
@@ -760,20 +876,43 @@ impl std::ops::Add for Tally {
 }
 
 /// Decodes every band into `data`, in parallel on native targets (one decoder and scratch
-/// buffer per worker).
+/// buffer per worker). `extra` receives samples that are not part of the colour image, one
+/// band of rows at a time, when it is non-empty.
 #[cfg(not(target_arch = "wasm32"))]
-fn decode_bands<'a, O>(lay: &Layout, data: &mut [u8], band_bytes: usize, _first: &mut Decoder<Patched<'a>>, open: &O) -> Result<Tally, CodecError>
+fn decode_bands<'a, O>(
+    lay: &Layout,
+    data: &mut [u8],
+    band_bytes: usize,
+    extra: &mut [u8],
+    extra_band: usize,
+    _first: &mut Decoder<Patched<'a>>,
+    open: &O,
+) -> Result<Tally, CodecError>
 where
     O: Fn() -> Result<Decoder<Patched<'a>>, CodecError> + Sync,
 {
     use rayon::prelude::*;
+    if extra.is_empty() {
+        return data
+            .par_chunks_mut(band_bytes.max(1))
+            .enumerate()
+            .map_init(
+                || open().map(|d| (d, Vec::new())).map_err(|e| e.to_string()),
+                |worker, (b, band)| {
+                    let (dec, scratch) = worker.as_mut().map_err(|e| err(e.clone()))?;
+                    decode_band(lay, dec, scratch, b, band, None)
+                },
+            )
+            .try_reduce(Tally::default, |a, b| Ok(a + b));
+    }
     data.par_chunks_mut(band_bytes.max(1))
+        .zip(extra.par_chunks_mut(extra_band.max(1)))
         .enumerate()
         .map_init(
             || open().map(|d| (d, Vec::new())).map_err(|e| e.to_string()),
-            |worker, (b, band)| {
+            |worker, (b, (band, extra_band))| {
                 let (dec, scratch) = worker.as_mut().map_err(|e| err(e.clone()))?;
-                decode_band(lay, dec, scratch, b, band)
+                decode_band(lay, dec, scratch, b, band, Some(extra_band))
             },
         )
         .try_reduce(Tally::default, |a, b| Ok(a + b))
@@ -781,20 +920,41 @@ where
 
 /// Decodes every band into `data`, one after the other.
 #[cfg(target_arch = "wasm32")]
-fn decode_bands<'a, O>(lay: &Layout, data: &mut [u8], band_bytes: usize, first: &mut Decoder<Patched<'a>>, _open: &O) -> Result<Tally, CodecError>
+fn decode_bands<'a, O>(
+    lay: &Layout,
+    data: &mut [u8],
+    band_bytes: usize,
+    extra: &mut [u8],
+    extra_band: usize,
+    first: &mut Decoder<Patched<'a>>,
+    _open: &O,
+) -> Result<Tally, CodecError>
 where
     O: Fn() -> Result<Decoder<Patched<'a>>, CodecError> + Sync,
 {
     let mut scratch = Vec::new();
     let mut tally = Tally::default();
-    for (b, band) in data.chunks_mut(band_bytes.max(1)).enumerate() {
-        tally = tally + decode_band(lay, first, &mut scratch, b, band)?;
+    if extra.is_empty() {
+        for (b, band) in data.chunks_mut(band_bytes.max(1)).enumerate() {
+            tally = tally + decode_band(lay, first, &mut scratch, b, band, None)?;
+        }
+        return Ok(tally);
+    }
+    for (b, (band, extra_band)) in data.chunks_mut(band_bytes.max(1)).zip(extra.chunks_mut(extra_band.max(1))).enumerate() {
+        tally = tally + decode_band(lay, first, &mut scratch, b, band, Some(extra_band))?;
     }
     Ok(tally)
 }
 
 /// Decodes band `b` (one strip, or one row of tiles, in every plane) into its output rows.
-fn decode_band(lay: &Layout, dec: &mut Decoder<Patched<'_>>, scratch: &mut Vec<u8>, b: usize, band: &mut [u8]) -> Result<Tally, CodecError> {
+fn decode_band(
+    lay: &Layout,
+    dec: &mut Decoder<Patched<'_>>,
+    scratch: &mut Vec<u8>,
+    b: usize,
+    band: &mut [u8],
+    mut extra: Option<&mut [u8]>,
+) -> Result<Tally, CodecError> {
     let out_row = lay.out_row();
     let rows = band.len() / out_row.max(1);
     let px = lay.out_channels() * lay.out.bytes();
@@ -836,16 +996,95 @@ fn decode_band(lay: &Layout, dec: &mut Decoder<Patched<'_>>, scratch: &mut Vec<u
             }
             let x0 = col * lay.cw;
             let n = lay.cw.min(lay.w.saturating_sub(x0));
-            for (src_row, dst_row) in buf.chunks_exact(stride).zip(band.chunks_exact_mut(out_row)).take(rows) {
+            for (ri, (src_row, dst_row)) in buf.chunks_exact(stride).zip(band.chunks_exact_mut(out_row)).take(rows).enumerate() {
                 let Some(dst) = dst_row.get_mut(x0 * px..(x0 + n) * px) else { continue };
                 convert_row(lay, src_row, dst, n, plane);
+                if !lay.planar && plane == 0 && !lay.extra_at.is_empty() {
+                    let erow = lay.extra_row();
+                    if let Some(extra) = extra.as_deref_mut()
+                        && let Some(er) = extra.get_mut(ri.saturating_mul(erow)..ri.saturating_mul(erow).saturating_add(erow))
+                    {
+                        deposit_extras(lay, src_row, er, n, x0);
+                    }
+                }
             }
         }
     }
+    if lay.planar && !lay.extra_at.is_empty() {
+        read_planar_extras(lay, dec, scratch, b, rows, extra, &mut tally)?;
+    }
     finish_band(lay, band);
     Ok(tally)
 }
 
+/// Copies the non-colour samples of a chunky row into the extra-sample band.
+fn deposit_extras(lay: &Layout, src: &[u8], dst: &mut [u8], n: usize, x0: usize) {
+    let ech = lay.extra_at.len();
+    if ech == 0 {
+        return;
+    }
+    let px = ech * lay.out.bytes();
+    let Some(dst) = dst.get_mut(x0.saturating_mul(px)..(x0.saturating_add(n)).saturating_mul(px)) else { return };
+    for (ei, &si) in lay.extra_at.iter().enumerate() {
+        transfer(lay.src, src, lay.chunk_spp, si, dst, lay.out, ech, ei, n);
+    }
+}
+
+/// Planar files store each extra sample as its own plane. Read those planes into `extra`.
+fn read_planar_extras(
+    lay: &Layout,
+    dec: &mut Decoder<Patched<'_>>,
+    scratch: &mut Vec<u8>,
+    b: usize,
+    rows: usize,
+    extra: Option<&mut [u8]>,
+    tally: &mut Tally,
+) -> Result<(), CodecError> {
+    let Some(extra) = extra else { return Ok(()) };
+    let ech = lay.extra_at.len();
+    let erow = lay.extra_row();
+    if ech == 0 || erow == 0 {
+        return Ok(());
+    }
+    for (ei, &file_plane) in lay.extra_at.iter().enumerate() {
+        for col in 0..lay.across {
+            let chunk = file_plane
+                .checked_mul(lay.chunks_per_plane)
+                .and_then(|c| c.checked_add(b.checked_mul(lay.across)?))
+                .and_then(|c| c.checked_add(col))
+                .and_then(|c| u32::try_from(c).ok())
+                .ok_or_else(|| err("chunk index out of range"))?;
+            let pref = dec.image_chunk_buffer_layout(chunk).map_err(map_err)?;
+            let stride = pref.row_stride.map(|s| s.get()).ok_or_else(|| err("empty chunk row"))?;
+            if pref.len > lay.scratch_cap {
+                return Err(CodecError::LimitExceeded(format!("a {} byte strip or tile", pref.len)));
+            }
+            if scratch.len() < pref.len {
+                scratch.resize(pref.len, 0);
+            }
+            let buf = scratch.get_mut(..pref.len).ok_or_else(|| err("scratch buffer"))?;
+            match dec.read_chunk_bytes(chunk, buf) {
+                Ok(()) => tally.decoded += 1,
+                Err(e) if is_eof(&e) => {
+                    tally.missing += 1;
+                    continue;
+                }
+                Err(e) => return Err(map_err(e)),
+            }
+            let x0 = col * lay.cw;
+            let n = lay.cw.min(lay.w.saturating_sub(x0));
+            for (ri, src_row) in buf.chunks_exact(stride).take(rows).enumerate() {
+                let start = ri.saturating_mul(erow);
+                let Some(er) = extra.get_mut(start..start.saturating_add(erow)) else { continue };
+                let px = ech * lay.out.bytes();
+                let Some(dst) = er.get_mut(x0.saturating_mul(px)..(x0.saturating_add(n)).saturating_mul(px)) else { continue };
+                transfer(lay.src, src_row, 1, 0, dst, lay.out, ech, ei, n);
+            }
+        }
+    }
+    Ok(())
+}
+
 /// Converts `n` pixels of one decoded chunk row into output pixels (`plane` for planar data).
 fn convert_row(lay: &Layout, src: &[u8], dst: &mut [u8], n: usize, plane: usize) {
     let och = lay.out_channels();
@@ -1072,6 +1311,230 @@ custom_colortype!(Lab16, u16, PI::CIELab, &[16; 3], &[SampleFormat::Uint; 3], in
 custom_colortype!(LabA8, u8, PI::CIELab, &[8; 4], &[SampleFormat::Uint; 4], int);
 custom_colortype!(LabA16, u16, PI::CIELab, &[16; 4], &[SampleFormat::Uint; 4], int);
 
+// Colour types with 1..=MAX_EXTRA_SAMPLES trailing extra samples (spot channels, extra alpha).
+// One generic type per (sample, photometric, bit depth, total sample count) instead of a
+// hand-written type for every layout. `N` is the total sample count, not the extra count.
+const fn extra_photo(v: u16) -> PhotometricInterpretation {
+    match v {
+        1 => PhotometricInterpretation::BlackIsZero,
+        2 => PhotometricInterpretation::RGB,
+        5 => PhotometricInterpretation::CMYK,
+        8 => PhotometricInterpretation::CIELab,
+        _ => PhotometricInterpretation::RGB,
+    }
+}
+
+trait ExtraKind: Copy + TiffValue + 'static {
+    const FORMAT: SampleFormat;
+    fn predict(row: &[Self], out: &mut Vec<Self>, samples: usize);
+}
+
+impl ExtraKind for u8 {
+    const FORMAT: SampleFormat = SampleFormat::Uint;
+    fn predict(row: &[Self], out: &mut Vec<Self>, samples: usize) {
+        let n = samples.min(row.len());
+        out.extend_from_slice(&row[..n]);
+        out.extend(row.iter().zip(&row[n..]).map(|(prev, current)| current.wrapping_sub(*prev)));
+    }
+}
+
+impl ExtraKind for u16 {
+    const FORMAT: SampleFormat = SampleFormat::Uint;
+    fn predict(row: &[Self], out: &mut Vec<Self>, samples: usize) {
+        let n = samples.min(row.len());
+        out.extend_from_slice(&row[..n]);
+        out.extend(row.iter().zip(&row[n..]).map(|(prev, current)| current.wrapping_sub(*prev)));
+    }
+}
+
+impl ExtraKind for f32 {
+    const FORMAT: SampleFormat = SampleFormat::IEEEFP;
+    fn predict(row: &[Self], out: &mut Vec<Self>, _samples: usize) {
+        out.extend_from_slice(row);
+    }
+}
+
+struct Extras<T, const PHOTO: u16, const BITS: u16, const N: usize>(std::marker::PhantomData<T>);
+
+impl<T, const PHOTO: u16, const BITS: u16, const N: usize> TiffColorType for Extras<T, PHOTO, BITS, N>
+where
+    T: ExtraKind,
+{
+    type Inner = T;
+    const TIFF_VALUE: PhotometricInterpretation = extra_photo(PHOTO);
+    const BITS_PER_SAMPLE: &'static [u16] = &[BITS; N];
+    const SAMPLE_FORMAT: &'static [SampleFormat] = &[T::FORMAT; N];
+    fn horizontal_predict(row: &[Self::Inner], result: &mut Vec<Self::Inner>) {
+        T::predict(row, result, N);
+    }
+}
+
+macro_rules! write_extras {
+    ($n:expr, $enc:expr, $w:expr, $h:expr, $data:expr, $tags:expr, $sample:ty, $photo:literal, $bits:literal, $base:literal) => {
+        match $n {
+            1 => write_one::<Extras<$sample, $photo, $bits, { $base + 1 }>, K>($enc, $w, $h, $data, $tags),
+            2 => write_one::<Extras<$sample, $photo, $bits, { $base + 2 }>, K>($enc, $w, $h, $data, $tags),
+            3 => write_one::<Extras<$sample, $photo, $bits, { $base + 3 }>, K>($enc, $w, $h, $data, $tags),
+            4 => write_one::<Extras<$sample, $photo, $bits, { $base + 4 }>, K>($enc, $w, $h, $data, $tags),
+            5 => write_one::<Extras<$sample, $photo, $bits, { $base + 5 }>, K>($enc, $w, $h, $data, $tags),
+            6 => write_one::<Extras<$sample, $photo, $bits, { $base + 6 }>, K>($enc, $w, $h, $data, $tags),
+            7 => write_one::<Extras<$sample, $photo, $bits, { $base + 7 }>, K>($enc, $w, $h, $data, $tags),
+            8 => write_one::<Extras<$sample, $photo, $bits, { $base + 8 }>, K>($enc, $w, $h, $data, $tags),
+            9 => write_one::<Extras<$sample, $photo, $bits, { $base + 9 }>, K>($enc, $w, $h, $data, $tags),
+            10 => write_one::<Extras<$sample, $photo, $bits, { $base + 10 }>, K>($enc, $w, $h, $data, $tags),
+            11 => write_one::<Extras<$sample, $photo, $bits, { $base + 11 }>, K>($enc, $w, $h, $data, $tags),
+            12 => write_one::<Extras<$sample, $photo, $bits, { $base + 12 }>, K>($enc, $w, $h, $data, $tags),
+            13 => write_one::<Extras<$sample, $photo, $bits, { $base + 13 }>, K>($enc, $w, $h, $data, $tags),
+            14 => write_one::<Extras<$sample, $photo, $bits, { $base + 14 }>, K>($enc, $w, $h, $data, $tags),
+            15 => write_one::<Extras<$sample, $photo, $bits, { $base + 15 }>, K>($enc, $w, $h, $data, $tags),
+            16 => write_one::<Extras<$sample, $photo, $bits, { $base + 16 }>, K>($enc, $w, $h, $data, $tags),
+            other => Err(io::Error::new(io::ErrorKind::InvalidInput, format!("unsupported extra samples ({other})")).into()),
+        }
+    };
+}
+
+/// An empty buffer with room for `len` elements, allocated fallibly: a save too large for memory
+/// is an error, not an abort.
+fn try_with_capacity<T>(len: usize) -> io::Result<Vec<T>> {
+    let mut v = Vec::new();
+    v.try_reserve_exact(len).map_err(|_| io::Error::new(io::ErrorKind::OutOfMemory, format!("cannot allocate {len} samples for the extra samples")))?;
+    Ok(v)
+}
+
+fn bytes_as_u16(b: &[u8]) -> io::Result<Vec<u16>> {
+    let chunks = b.as_chunks::<2>().0;
+    let mut v = try_with_capacity(chunks.len())?;
+    v.extend(chunks.iter().map(|c| u16::from_ne_bytes(*c)));
+    Ok(v)
+}
+
+fn bytes_as_f32(b: &[u8]) -> io::Result<Vec<f32>> {
+    let chunks = b.as_chunks::<4>().0;
+    let mut v = try_with_capacity(chunks.len())?;
+    v.extend(chunks.iter().map(|c| f32::from_ne_bytes(*c)));
+    Ok(v)
+}
+
+/// Interleaves colour (and alpha) samples with [`Metadata::extra_samples`].
+fn interleave_extras(img: &Image) -> Result<Vec<u8>, String> {
+    let (w, h) = img.dimensions();
+    let n = (w as usize).checked_mul(h as usize).ok_or_else(|| "image size overflows".to_string())?;
+    let sb = img.sample_type().bytes();
+    let ch = img.layout().channels();
+    let extras = &img.meta.extra_samples;
+    let total = ch.checked_add(extras.len()).ok_or_else(|| "too many samples".to_string())?;
+    let px = total.checked_mul(sb).ok_or_else(|| "sample size overflows".to_string())?;
+    let len = n.checked_mul(px).ok_or_else(|| "image size overflows".to_string())?;
+    let mut out = try_with_capacity::<u8>(len).map_err(|e| e.to_string())?;
+    out.resize(len, 0);
+    let base = img.data();
+    let base_px = ch.saturating_mul(sb);
+    for i in 0..n {
+        let src = i.saturating_mul(base_px);
+        let dst = i.saturating_mul(px);
+        let Some(s) = base.get(src..src.saturating_add(base_px)) else {
+            return Err("image buffer is shorter than its dimensions".into());
+        };
+        let Some(d) = out.get_mut(dst..dst.saturating_add(base_px)) else {
+            return Err("extra-sample buffer is short".into());
+        };
+        d.copy_from_slice(s);
+        for (k, e) in extras.iter().enumerate() {
+            let es = i.saturating_mul(sb);
+            let ed = dst.saturating_add(base_px).saturating_add(k.saturating_mul(sb));
+            let Some(s) = e.data.get(es..es.saturating_add(sb)) else {
+                return Err(format!("extra sample {k} is shorter than the image"));
+            };
+            let Some(d) = out.get_mut(ed..ed.saturating_add(sb)) else {
+                return Err("extra-sample buffer is short".into());
+            };
+            d.copy_from_slice(s);
+        }
+    }
+    Ok(out)
+}
+
+fn write_with_extras<K: TiffKind>(enc: &mut TiffEncoder<&mut Cursor<Vec<u8>>, K>, img: &Image, tags: &TagSet<'_>) -> tiff::TiffResult<()> {
+    use ChannelLayout as L;
+    use SampleType as S;
+    let (w, h) = img.dimensions();
+    let n = img.meta.extra_samples.len();
+    if img.layout().is_lab() {
+        let file = lab_file(img);
+        let bytes = interleave_extras(&file).map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
+        return match (file.layout(), file.sample_type()) {
+            (L::Lab, S::U8) => write_extras!(n, enc, w, h, &bytes, tags, u8, 8, 8, 3),
+            (L::Lab, _) => {
+                let v = bytes_as_u16(&bytes)?;
+                write_extras!(n, enc, w, h, &v, tags, u16, 8, 16, 3)
+            }
+            (_, S::U8) => write_extras!(n, enc, w, h, &bytes, tags, u8, 8, 8, 4),
+            _ => {
+                let v = bytes_as_u16(&bytes)?;
+                write_extras!(n, enc, w, h, &v, tags, u16, 8, 16, 4)
+            }
+        };
+    }
+    let bytes = interleave_extras(img).map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
+    match (img.layout(), img.sample_type()) {
+        (L::Gray, S::U8) => write_extras!(n, enc, w, h, &bytes, tags, u8, 1, 8, 1),
+        (L::Gray, S::U16) => {
+            let v = bytes_as_u16(&bytes)?;
+            write_extras!(n, enc, w, h, &v, tags, u16, 1, 16, 1)
+        }
+        (L::Gray, S::F32) => {
+            let v = bytes_as_f32(&bytes)?;
+            write_extras!(n, enc, w, h, &v, tags, f32, 1, 32, 1)
+        }
+        (L::GrayA, S::U8) => write_extras!(n, enc, w, h, &bytes, tags, u8, 1, 8, 2),
+        (L::GrayA, S::U16) => {
+            let v = bytes_as_u16(&bytes)?;
+            write_extras!(n, enc, w, h, &v, tags, u16, 1, 16, 2)
+        }
+        (L::GrayA, S::F32) => {
+            let v = bytes_as_f32(&bytes)?;
+            write_extras!(n, enc, w, h, &v, tags, f32, 1, 32, 2)
+        }
+        (L::Rgb, S::U8) => write_extras!(n, enc, w, h, &bytes, tags, u8, 2, 8, 3),
+        (L::Rgb, S::U16) => {
+            let v = bytes_as_u16(&bytes)?;
+            write_extras!(n, enc, w, h, &v, tags, u16, 2, 16, 3)
+        }
+        (L::Rgb, S::F32) => {
+            let v = bytes_as_f32(&bytes)?;
+            write_extras!(n, enc, w, h, &v, tags, f32, 2, 32, 3)
+        }
+        (L::Rgba, S::U8) => write_extras!(n, enc, w, h, &bytes, tags, u8, 2, 8, 4),
+        (L::Rgba, S::U16) => {
+            let v = bytes_as_u16(&bytes)?;
+            write_extras!(n, enc, w, h, &v, tags, u16, 2, 16, 4)
+        }
+        (L::Rgba, S::F32) => {
+            let v = bytes_as_f32(&bytes)?;
+            write_extras!(n, enc, w, h, &v, tags, f32, 2, 32, 4)
+        }
+        (L::Cmyk, S::U8) => write_extras!(n, enc, w, h, &bytes, tags, u8, 5, 8, 4),
+        (L::Cmyk, S::U16) => {
+            let v = bytes_as_u16(&bytes)?;
+            write_extras!(n, enc, w, h, &v, tags, u16, 5, 16, 4)
+        }
+        (L::Cmyk, S::F32) => {
+            let v = bytes_as_f32(&bytes)?;
+            write_extras!(n, enc, w, h, &v, tags, f32, 5, 32, 4)
+        }
+        (L::CmykA, S::U8) => write_extras!(n, enc, w, h, &bytes, tags, u8, 5, 8, 5),
+        (L::CmykA, S::U16) => {
+            let v = bytes_as_u16(&bytes)?;
+            write_extras!(n, enc, w, h, &v, tags, u16, 5, 16, 5)
+        }
+        (L::CmykA, S::F32) => {
+            let v = bytes_as_f32(&bytes)?;
+            write_extras!(n, enc, w, h, &v, tags, f32, 5, 32, 5)
+        }
+        _ => Err(io::Error::new(io::ErrorKind::InvalidInput, format!("unsupported extra samples ({n})")).into()),
+    }
+}
+
 struct TagSet<'a> {
     icc: Option<&'a [u8]>,
     /// The EXIF block's directories and IFD0 tags, written as the TIFF's own.
@@ -1079,7 +1542,8 @@ struct TagSet<'a> {
     xmp: Option<&'a [u8]>,
     dpi: Option<(f32, f32)>,
     text: Vec<(Tag, &'a str)>,
-    alpha: bool,
+    /// ExtraSamples tag, including the unassociated-alpha marker when the image has alpha.
+    extra_samples: &'a [u16],
     photoshop_resources: Option<&'a [u8]>,
     photoshop_layers: Option<&'a [u8]>,
 }
@@ -1109,9 +1573,8 @@ where
         im.y_resolution(Rational { n: (y * 1000.0).round() as u32, d: 1000 });
     }
     let d = im.encoder();
-    if tags.alpha {
-        // 2 = unassociated alpha
-        d.write_tag(Tag::ExtraSamples, &[2u16][..])?;
+    if !tags.extra_samples.is_empty() {
+        d.write_tag(Tag::ExtraSamples, tags.extra_samples)?;
     }
     if let Some(icc) = tags.icc {
         d.write_tag(Tag::IccProfile, Undefined(icc))?;
@@ -1142,10 +1605,24 @@ where
     im.write_data(data)
 }
 
+/// A Lab image as CIELab stores it: a* and b* signed, 8 or 16 bits (CIELab has no float form:
+/// 32-bit Lab is written with 16 bits). Extra samples follow the new sample type.
+fn lab_file(img: &Image) -> Image {
+    let sample = if img.sample_type() == SampleType::U8 { SampleType::U8 } else { SampleType::U16 };
+    // `convert` brings the extra samples to the new sample type with the image.
+    let mut file = img.convert(img.layout(), sample);
+    let channels = file.layout().channels();
+    convert_ab(file.data_mut(), channels, sample, true, true);
+    file
+}
+
 /// Writes the image with the colour type matching its layout and sample type.
 fn write_image<K: TiffKind>(enc: &mut TiffEncoder<&mut Cursor<Vec<u8>>, K>, img: &Image, tags: &TagSet<'_>) -> tiff::TiffResult<()> {
     use ChannelLayout as L;
     use SampleType as S;
+    if !img.meta.extra_samples.is_empty() {
+        return write_with_extras::<K>(enc, img, tags);
+    }
     let (w, h) = img.dimensions();
     let u16s = || img.to_u16_samples().unwrap_or_default();
     let f32s = || img.to_f32_samples().unwrap_or_default();
@@ -1170,13 +1647,9 @@ fn write_image<K: TiffKind>(enc: &mut TiffEncoder<&mut Cursor<Vec<u8>>, K>, img:
         (L::CmykA, S::U16) => write_one::<CmykA16, K>(enc, w, h, &u16s(), tags),
         (L::CmykA, S::F32) => write_one::<CmykA32F, K>(enc, w, h, &f32s(), tags),
         (L::Lab | L::LabA, _) => {
-            // CIELab has no float form: 32-bit Lab is written with 16 bits.
-            let sample = if img.sample_type() == S::U8 { S::U8 } else { S::U16 };
-            let mut file = img.convert(img.layout(), sample);
-            let channels = file.layout().channels();
-            convert_ab(file.data_mut(), channels, sample, true, true);
+            let file = lab_file(img);
             let u16s = || file.to_u16_samples().unwrap_or_default();
-            match (file.layout(), sample) {
+            match (file.layout(), file.sample_type()) {
                 (L::Lab, S::U8) => write_one::<Lab8, K>(enc, w, h, file.data(), tags),
                 (L::Lab, _) => write_one::<Lab16, K>(enc, w, h, &u16s(), tags),
                 (_, S::U8) => write_one::<LabA8, K>(enc, w, h, file.data(), tags),
@@ -1198,11 +1671,48 @@ fn estimated_size(img: &Image, tags: &TagSet<'_>) -> u64 {
         + tags.exif.iter().flat_map(|e| e.ifd0.iter().chain(&e.exif).chain(&e.gps)).map(|f| f.value.len() as u64 + 12).sum::<u64>();
     // Strip tables: one offset and one count per strip of about 1 MB.
     let tables = (img.data().len() as u64 / (1 << 20) + 1) * 16;
-    (img.data().len() as u64).saturating_add(payloads).saturating_add(text).saturating_add(tables).saturating_add(1 << 20)
+    let extras: u64 = img.meta.extra_samples.iter().map(|e| e.data.len() as u64).sum();
+    (img.data().len() as u64).saturating_add(extras).saturating_add(payloads).saturating_add(text).saturating_add(tables).saturating_add(1 << 20)
+}
+
+/// The byte length of one extra-sample plane: one sample per pixel of `img`, in its sample type.
+/// `None` when the pixel count overflows a `usize` (no such image buffer can exist).
+fn extra_plane_len(img: &Image) -> Option<usize> {
+    let (w, h) = img.dimensions();
+    (w as usize).checked_mul(h as usize)?.checked_mul(img.sample_type().bytes())
+}
+
+/// Every extra plane must hold exactly one sample per pixel of `img`, in its sample type.
+///
+/// The writer copies one sample per pixel out of each plane, so a plane of any other length
+/// would be silently truncated (long) or read past its end (short). A sample-type conversion
+/// reinterprets the bytes in the new width instead, so an unchecked plane would also change
+/// meaning rather than fail. Refuse the image instead of writing either.
+fn check_extra_planes(img: &Image) -> Result<(), CodecError> {
+    let (w, h) = img.dimensions();
+    let sample = img.sample_type();
+    let plane_len = extra_plane_len(img).ok_or_else(|| CodecError::encode(F, format!("the extra-sample size of a {w}x{h} image overflows")))?;
+    for (k, e) in img.meta.extra_samples.iter().enumerate() {
+        if e.data.len() != plane_len {
+            return Err(CodecError::encode(
+                F,
+                format!("extra sample {k} is {} bytes; a {w}x{h} {sample:?} image needs exactly {plane_len} (one sample per pixel)", e.data.len()),
+            ));
+        }
+    }
+    Ok(())
 }
 
 pub(crate) fn encode(src: &Image, plan: Plan, opts: &EncodeOptions) -> Result<Vec<u8>, CodecError> {
-    let img = src.converted(plan.layout, plan.sample);
+    // Check the source planes before `converted`, which brings them to the plan's sample type
+    // with the image but deliberately leaves a wrong-sized plane alone: past that point a bad
+    // plane would be reinterpreted in the new width rather than rejected.
+    check_extra_planes(src)?;
+    // `converted` brings the extra samples to the plan's sample type with the image.
+    encode_ready(&src.converted(plan.layout, plan.sample), opts)
+}
+
+fn encode_ready(img: &Image, opts: &EncodeOptions) -> Result<Vec<u8>, CodecError> {
     let compression = match opts.tiff_compression {
         TiffCompression::None => tiff::encoder::Compression::Uncompressed,
         TiffCompression::Lzw => tiff::encoder::Compression::Lzw,
@@ -1226,13 +1736,29 @@ pub(crate) fn encode(src: &Image, plan: Plan, opts: &EncodeOptions) -> Result<Ve
     };
     // TIFF writes no Orientation tag (= 1): keep the XMP from contradicting it.
     let xmp = if opts.embed_metadata { img.meta.xmp.as_deref().map(|x| crate::resolution::export_xmp(x, img.meta.dpi)) } else { None };
+    if img.meta.extra_samples.len() > crate::MAX_EXTRA_SAMPLES {
+        return Err(CodecError::encode(F, format!("TIFF stores at most {} extra samples", crate::MAX_EXTRA_SAMPLES)));
+    }
+    // Validate again in the sample type the planes now hold: `Image::convert` takes a plane's
+    // bytes before it rebuilds them, so one it could not rebuild would arrive here empty. The Lab
+    // path's later re-type through `lab_file` converts a plane only when its length already
+    // matches the image, which this guarantees.
+    check_extra_planes(img)?;
+    let mut kinds = Vec::with_capacity(img.meta.extra_samples.len().saturating_add(1));
+    if img.layout().has_alpha() {
+        kinds.push(2);
+    }
+    // TIFF 6.0 reserves ExtraSamples values above 2: those are written as 0 (unspecified).
+    for e in &img.meta.extra_samples {
+        kinds.push(if e.kind <= 2 { e.kind } else { 0 });
+    }
     let tags = TagSet {
         icc: if opts.embed_icc { img.icc.as_deref() } else { None },
         exif: if opts.embed_metadata { img.meta.exif.as_deref().and_then(|e| tiff_exif::read(crate::orientation::tiff_body(e))) } else { None },
         xmp: xmp.as_deref().map(str::as_bytes),
         dpi: if opts.embed_metadata { img.meta.dpi.filter(|d| d.0 > 0.0 && d.1 > 0.0) } else { None },
         text,
-        alpha: img.layout().has_alpha(),
+        extra_samples: &kinds,
         // Document content, not metadata: written whenever present.
         photoshop_resources: img.meta.photoshop_resources.as_deref().filter(|r| !r.is_empty()),
         photoshop_layers: img.meta.photoshop_layers.as_deref().filter(|l| !l.is_empty()),
@@ -1245,17 +1771,48 @@ pub(crate) fn encode(src: &Image, plan: Plan, opts: &EncodeOptions) -> Result<Ve
         let mut cursor = Cursor::new(Vec::new());
         if big {
             let mut enc = TiffEncoder::new_big(&mut cursor)?.with_compression(compression).with_predictor(predictor);
-            write_image::<TiffKindBig>(&mut enc, &img, &tags)?;
+            write_image::<TiffKindBig>(&mut enc, img, &tags)?;
         } else {
             let mut enc = TiffEncoder::new(&mut cursor)?.with_compression(compression).with_predictor(predictor);
-            write_image::<TiffKindStandard>(&mut enc, &img, &tags)?;
+            write_image::<TiffKindStandard>(&mut enc, img, &tags)?;
         }
         Ok(cursor.into_inner())
     };
-    let big = opts.tiff_bigtiff || estimated_size(&img, &tags) > CLASSIC_LIMIT;
+    let big = opts.tiff_bigtiff || estimated_size(img, &tags) > CLASSIC_LIMIT;
     match write(big) {
         Ok(v) => Ok(v),
         Err(tiff::TiffError::IntSizeError) if !big => write(true).map_err(|e| CodecError::encode(F, e)),
         Err(e) => Err(CodecError::encode(F, e)),
     }
 }
+
+#[cfg(test)]
+mod bits_len {
+    use super::Extras;
+    use tiff::encoder::colortype::ColorType as TiffColorType;
+
+    #[test]
+    fn const_generic_sample_tables_have_one_entry_per_sample() {
+        // A repeat expression in an associated const (`&[BITS; N]`) has, on some compilers,
+        // promoted to a slice shorter than `N`. The encoder sizes every strip from that length.
+        assert_eq!(<Extras<u8, 2, 8, 4> as TiffColorType>::BITS_PER_SAMPLE.len(), 4, "{:?}", <Extras<u8, 2, 8, 4> as TiffColorType>::BITS_PER_SAMPLE);
+        assert_eq!(<Extras<u8, 2, 8, 5> as TiffColorType>::BITS_PER_SAMPLE.len(), 5);
+        assert_eq!(<Extras<u8, 2, 8, 19> as TiffColorType>::BITS_PER_SAMPLE.len(), 19);
+        assert_eq!(<Extras<u16, 5, 16, 6> as TiffColorType>::SAMPLE_FORMAT.len(), 6);
+    }
+}
+
+#[cfg(test)]
+mod extra_sample_buffers {
+    use super::try_with_capacity;
+
+    /// The extra-sample writer's buffers are allocated fallibly: a size no allocation can serve
+    /// is an out-of-memory error the save reports, not an abort.
+    #[test]
+    fn an_impossible_buffer_is_an_error() {
+        let err = try_with_capacity::<u8>(usize::MAX).unwrap_err();
+        assert_eq!(err.kind(), std::io::ErrorKind::OutOfMemory);
+        assert!(try_with_capacity::<u16>(usize::MAX / 2).is_err());
+        assert!(try_with_capacity::<f32>(64).is_ok_and(|v| v.is_empty() && v.capacity() >= 64));
+    }
+}
diff --git a/crates/codecs/src/fidelity.rs b/crates/codecs/src/fidelity.rs
index c9bce9671e..984f2ac455 100644
--- a/crates/codecs/src/fidelity.rs
+++ b/crates/codecs/src/fidelity.rs
@@ -31,7 +31,7 @@ pub enum FidelityWarning {
     RangeClipped,
     /// Non-opaque alpha will be discarded.
     AlphaDiscarded,
-    /// Alpha will be reduced to fully transparent / fully opaque (GIF).
+    /// Alpha will be reduced to fully transparent / fully opaque (GIF, DDS BC1, IFF).
     AlphaBinarized,
     /// CMYK data will be converted (naively, not colour-managed) to another model.
     CmykConverted {
@@ -227,7 +227,8 @@ pub fn fidelity_warnings_with(image: &Image, format: Format, opts: &EncodeOption
     if sl.has_alpha() && !p.layout.has_alpha() && image.has_translucency() {
         w.push(W::AlphaDiscarded);
     }
-    let binary_alpha = format == Format::Gif || (format == Format::Dds && opts.dds.compression == DdsCompression::Bc1);
+    // An IFF/ILBM mask plane holds one bit per pixel.
+    let binary_alpha = matches!(format, Format::Gif | Format::Iff) || (format == Format::Dds && opts.dds.compression == DdsCompression::Bc1);
     if binary_alpha && p.layout.has_alpha() && image.has_translucency() {
         w.push(W::AlphaBinarized);
     }
diff --git a/crates/codecs/src/format.rs b/crates/codecs/src/format.rs
index a333106ab2..54f3ecd64e 100644
--- a/crates/codecs/src/format.rs
+++ b/crates/codecs/src/format.rs
@@ -38,7 +38,7 @@ pub enum Format {
     Cineon,
     /// DICOM single-frame images (uncompressed): read-only.
     Dicom,
-    /// Amiga IFF/ILBM (`FORM ... ILBM`): planar bitplanes with a palette, read-only.
+    /// Amiga IFF/ILBM (`FORM ... ILBM`): planar bitplanes with a palette or 24-bit RGB.
     Iff,
 }
 
@@ -72,7 +72,6 @@ pub struct FormatCaps {
 /// The test-suite asserts that every other enabled format is read+write.
 pub const ASYMMETRIC_EXCEPTIONS: &[(Format, &str)] = &[
     (Format::Xpm, "XPM is a legacy Unix icon interchange format. Reading existing XPM icons is supported; writing modern image assets should use PNG instead."),
-    (Format::Iff, "Amiga IFF/ILBM is supported for opening legacy Amiga artwork; this crate has no IFF writer, so save as PNG instead."),
     (
         Format::Dicom,
         "DICOM single-frame images are imported for medical review; this crate has no DICOM writer, so save an imported frame as TIFF or PNG instead.",
@@ -226,7 +225,7 @@ impl Format {
     /// Maximum encodable dimensions, if the format has a hard limit.
     pub fn max_dimensions(self) -> Option<(u32, u32)> {
         match self {
-            Format::Jpeg | Format::Gif => Some((65535, 65535)),
+            Format::Jpeg | Format::Gif | Format::Iff => Some((65535, 65535)),
             Format::WebP => Some((16384, 16384)),
             Format::Ico => Some((256, 256)),
             _ => None,
@@ -279,7 +278,7 @@ pub fn caps(format: Format) -> FormatCaps {
         Format::Dpx => FormatCaps { depths: &[S::U8, S::U16], layouts: &[L::Gray, L::Rgb, L::Rgba], text: true, ..base },
         Format::Cineon => FormatCaps { depths: &[S::U16], layouts: &[L::Gray, L::Rgb], alpha: false, ..base },
         Format::Dicom => FormatCaps { read: true, write: false, depths: &[S::U8, S::U16], layouts: &[L::Gray, L::Rgb], alpha: false, ..base },
-        Format::Iff => FormatCaps { read: true, write: false, depths: &[S::U8], layouts: &[L::Rgb, L::Rgba], alpha: true, ..base },
+        Format::Iff => FormatCaps { depths: &[S::U8], layouts: &[L::Rgb, L::Rgba], alpha: true, ..base },
     }
 }
 
diff --git a/crates/codecs/src/image.rs b/crates/codecs/src/image.rs
index adc737fee8..aba9e3b2f0 100644
--- a/crates/codecs/src/image.rs
+++ b/crates/codecs/src/image.rs
@@ -145,6 +145,24 @@ pub struct Metadata {
     /// Photoshop layer data (TIFF tag 37724 `ImageSourceData`): a layered TIFF's layers. Kept
     /// opaque here; `photocraft-io` reads and writes it through `photocraft-psd`.
     pub photoshop_layers: Option<Vec<u8>>,
+    /// Samples per pixel beyond the colour channels and the one alpha sample. TIFF extra
+    /// samples (spot colours, extra alpha channels) the pixel layout does not hold. Each entry
+    /// is one sample per pixel, native endian, in the image's [`SampleType`], row-major.
+    pub extra_samples: Vec<ExtraSample>,
+}
+
+/// How many extra TIFF samples an encoded file may carry. Decoders keep at most this many.
+/// Sixteen covers a UV-DTF stack (white, varnish, gloss, primer, and further spots) without
+/// approaching the PSD 56-channel limit.
+pub const MAX_EXTRA_SAMPLES: usize = 16;
+
+/// One TIFF extra sample (a spot channel or an alpha channel that is not the image alpha).
+#[derive(Debug, Clone, PartialEq)]
+pub struct ExtraSample {
+    /// TIFF ExtraSamples value: 0 unspecified, 1 associated alpha, 2 unassociated alpha.
+    pub kind: u16,
+    /// One sample per pixel, native endian, same sample type as the image.
+    pub data: Vec<u8>,
 }
 
 impl Metadata {
@@ -155,6 +173,7 @@ impl Metadata {
             && self.text.is_empty()
             && self.photoshop_resources.is_none()
             && self.photoshop_layers.is_none()
+            && self.extra_samples.is_empty()
     }
 }
 
@@ -181,6 +200,12 @@ pub enum DecodeWarning {
     /// A DPX element's transfer characteristic and colorimetric specification (SMPTE 268M codes,
     /// 255 when undefined). The code values are imported as stored, without a colour transform.
     DpxEncoding { transfer: u8, colorimetric: u8 },
+    /// The file's `count` extra samples (spot or extra alpha channels) did not fit the allocation
+    /// limit next to the image, so only the image was decoded.
+    ExtraSamplesDropped { format: Format, count: u32 },
+    /// The file has `count` extra samples past the first [`MAX_EXTRA_SAMPLES`], which are all a
+    /// decoder keeps; those past the cap were not imported.
+    ExtraSamplesOverLimit { format: Format, count: u32 },
 }
 
 /// The SMPTE 268M name of a transfer characteristic or colorimetric code.
@@ -231,6 +256,20 @@ impl fmt::Display for DecodeWarning {
                 dpx_code_name(*transfer),
                 dpx_code_name(*colorimetric)
             ),
+            DecodeWarning::ExtraSamplesDropped { format, count } => write!(
+                f,
+                "{count} extra {} file channel{} (spot or alpha) did not fit in memory and {} not imported",
+                format.name(),
+                if *count == 1 { "" } else { "s" },
+                if *count == 1 { "was" } else { "were" }
+            ),
+            DecodeWarning::ExtraSamplesOverLimit { format, count } => write!(
+                f,
+                "{count} extra {} file channel{} (spot or alpha) past the first {MAX_EXTRA_SAMPLES} {} not imported",
+                format.name(),
+                if *count == 1 { "" } else { "s" },
+                if *count == 1 { "was" } else { "were" }
+            ),
         }
     }
 }
@@ -642,6 +681,17 @@ impl Image {
             let values = convert_layout(&src, self.layout, layout);
             quantize(&values, sample)
         };
+        let mut meta = self.meta.clone();
+        if sample != self.sample {
+            // Extra samples are stored in the image's sample type, so they convert with it. A
+            // plane of the wrong size is left as it is: importers drop it with a warning.
+            let plane_len = (self.width as usize).saturating_mul(self.height as usize).saturating_mul(self.sample.bytes());
+            for e in meta.extra_samples.iter_mut().filter(|e| e.data.len() == plane_len) {
+                if let Ok(plane) = Image::from_raw(self.width, self.height, ChannelLayout::Gray, self.sample, std::mem::take(&mut e.data)) {
+                    e.data = plane.convert(ChannelLayout::Gray, sample).data;
+                }
+            }
+        }
         Image {
             width: self.width,
             height: self.height,
@@ -650,7 +700,7 @@ impl Image {
             data,
             icc: if layout.same_model(self.layout) { self.icc.clone() } else { None },
             cicp: if layout.same_model(self.layout) { self.cicp } else { None },
-            meta: self.meta.clone(),
+            meta,
             warnings: self.warnings.clone(),
         }
     }
diff --git a/crates/codecs/src/lib.rs b/crates/codecs/src/lib.rs
index cbfc550355..1ae285e7ce 100644
--- a/crates/codecs/src/lib.rs
+++ b/crates/codecs/src/lib.rs
@@ -37,7 +37,8 @@ pub use crate::exif_color::{EXIF_COLOR_SPACE_SRGB, exif_color_space};
 pub use crate::fidelity::{FidelityWarning, fidelity_warnings, fidelity_warnings_with};
 pub use crate::format::{ASYMMETRIC_EXCEPTIONS, Format, FormatCaps, caps, detect, from_extension};
 pub use crate::image::{
-    ChannelLayout, CryptomatteBuffer, CryptomatteLayer, DecodeWarning, DeepChannel, DeepImage, ExrChannelInfo, ExrPartInfo, Image, Metadata, SampleType,
+    ChannelLayout, CryptomatteBuffer, CryptomatteLayer, DecodeWarning, DeepChannel, DeepImage, ExrChannelInfo, ExrPartInfo, ExtraSample, Image,
+    MAX_EXTRA_SAMPLES, Metadata, SampleType,
 };
 pub use crate::options::{
     DdsCompression, DdsOptions, DecodeOptions, DpxBits, EncodeOptions, ExrCompression, JpegFormat, Limits, PngCompression, PngStereo, TiffCompression,
@@ -303,7 +304,7 @@ pub fn encode(image: &Image, format: Format, opts: &EncodeOptions) -> Result<Vec
         Format::Dpx => dpx::encode(image, plan, opts),
         Format::Cineon => dpx::encode_cineon(image, plan),
         Format::Dicom => Err(CodecError::unsupported(format, "DICOM is import-only; save as TIFF or PNG instead")),
-        Format::Iff => Err(CodecError::unsupported(format, "IFF/ILBM is import-only; save as PNG instead")),
+        Format::Iff => iff::encode(image, plan),
         Format::OpenExr => exr::encode(image, plan, opts),
         Format::Heif => Err(CodecError::unsupported(format, "encoding is not available in this build")),
         Format::Gif | Format::Bmp | Format::Tga | Format::Ico | Format::Qoi | Format::Hdr | Format::Avif => via_image::encode(format, image, plan, opts),
diff --git a/crates/codecs/src/orientation.rs b/crates/codecs/src/orientation.rs
index 3d10d5ddea..7f31a6b271 100644
--- a/crates/codecs/src/orientation.rs
+++ b/crates/codecs/src/orientation.rs
@@ -331,6 +331,12 @@ impl Image {
         }
         let data = orient_bytes(self.data(), bpp, o, (w, h), ow)?;
         let mut meta = self.meta.clone();
+        // Extra samples (a TIFF's alpha and spot planes, one sample a pixel) turn with the image.
+        // A plane of the wrong size is left as it is: importers drop it with a warning.
+        let plane_len = w.saturating_mul(h).saturating_mul(sample.bytes());
+        for e in meta.extra_samples.iter_mut().filter(|e| e.data.len() == plane_len) {
+            e.data = orient_bytes(&e.data, sample.bytes(), o, (w, h), ow)?;
+        }
         if let Some(e) = &mut meta.exif
             && let Cow::Owned(fixed) = upright_exif(e)
         {
diff --git a/crates/codecs/tests/it/detect_caps.rs b/crates/codecs/tests/it/detect_caps.rs
index 8db608de12..f91cacf42c 100644
--- a/crates/codecs/tests/it/detect_caps.rs
+++ b/crates/codecs/tests/it/detect_caps.rs
@@ -61,6 +61,7 @@ fn default_build_formats_all_symmetric() {
         Format::Fits,
         Format::Dpx,
         Format::Cineon,
+        Format::Iff,
     ];
     for f in expected {
         assert!(caps(f).read && caps(f).write, "{f:?}");
@@ -208,10 +209,11 @@ fn detect_magic_iff() {
     assert_eq!(detect(b"FORM\0\0\0\x14PBM "), Some(Format::Iff));
     assert_eq!(from_extension("art.LBM"), Some(Format::Iff));
     assert_eq!(from_extension("art.ilbm"), Some(Format::Iff));
-    assert!(caps(Format::Iff).read && !caps(Format::Iff).write, "IFF is read-only");
+    assert!(caps(Format::Iff).read && caps(Format::Iff).write, "IFF is read and written");
     assert!(caps(Format::Iff).alpha);
     assert!(caps(Format::Iff).layouts.contains(&photocraft_codecs::ChannelLayout::Rgba));
-    assert!(ASYMMETRIC_EXCEPTIONS.iter().any(|(f, _)| *f == Format::Iff));
+    assert!(!ASYMMETRIC_EXCEPTIONS.iter().any(|(f, _)| *f == Format::Iff));
+    assert_eq!(Format::Iff.max_dimensions(), Some((65535, 65535)));
     // A bare FORM without a bitmap type is not IFF.
     assert_eq!(detect(b"FORM\0\0\0\x14AIFF"), None);
     assert!(decode_as(Format::Iff, b"FORM\0\0\0\x14ILBM").is_err());
diff --git a/crates/codecs/tests/it/fidelity.rs b/crates/codecs/tests/it/fidelity.rs
index fa77a8d47a..8ca821e000 100644
--- a/crates/codecs/tests/it/fidelity.rs
+++ b/crates/codecs/tests/it/fidelity.rs
@@ -156,6 +156,13 @@ fn gif_quantizes_and_binarizes() {
     assert!(!w.contains(&W::LossyCompression));
 }
 #[test]
+fn iff_binarizes_alpha_and_reduces_16_bit() {
+    assert_eq!(warns(&test_image(ChannelLayout::Rgba, SampleType::U8), Format::Iff), vec![W::AlphaBinarized]);
+    let w = warns(&test_image(ChannelLayout::Rgb, SampleType::U16), Format::Iff);
+    assert!(w.contains(&W::DepthReduced { from: SampleType::U16, to: SampleType::U8 }));
+    assert!(warns(&test_image(ChannelLayout::Rgb, SampleType::U8), Format::Iff).is_empty());
+}
+#[test]
 fn hdr_is_lossy() {
     assert!(warns(&test_image(ChannelLayout::Rgb, SampleType::F32), Format::Hdr).contains(&W::LossyCompression));
 }
diff --git a/crates/codecs/tests/it/orientation.rs b/crates/codecs/tests/it/orientation.rs
index 26eeae030c..4bb7ca7662 100644
--- a/crates/codecs/tests/it/orientation.rs
+++ b/crates/codecs/tests/it/orientation.rs
@@ -211,6 +211,25 @@ fn png_opens_upright_for_every_orientation() {
     }
 }
 
+/// Extra samples (a TIFF's alpha and spot planes) turn with the image, so a channel stays
+/// aligned with the pixels for every orientation.
+#[test]
+fn extra_samples_turn_with_the_image() {
+    let (w, h) = (4, 7);
+    let up = exact_scene(w, h);
+    let up_extra: Vec<u8> = up.iter().map(|v| 255 - v).collect();
+    for o in 1..=8u16 {
+        let (s, sw, sh) = stored(&up, w, h, o);
+        let (s_extra, _, _) = stored(&up_extra, w, h, o);
+        let mut img = gray(sw, sh, s);
+        img.meta.extra_samples = vec![ExtraSample { kind: 0, data: s_extra }];
+        let turned = img.oriented(o).unwrap();
+        assert_eq!(turned.data(), &up[..], "o={o}");
+        assert_eq!(turned.meta.extra_samples.len(), 1, "o={o}");
+        assert_eq!(turned.meta.extra_samples[0].data, up_extra, "o={o}");
+    }
+}
+
 #[test]
 fn tiff_opens_upright_for_every_orientation() {
     let (w, h) = (4, 7);
diff --git a/crates/codecs/tests/it/tiff_lab.rs b/crates/codecs/tests/it/tiff_lab.rs
index 7076633ef5..9e41ef80b2 100644
--- a/crates/codecs/tests/it/tiff_lab.rs
+++ b/crates/codecs/tests/it/tiff_lab.rs
@@ -74,3 +74,36 @@ fn lab_converts_to_rgb_for_other_formats() {
     assert_eq!(&p[4..7], &[255, 255, 255], "white");
     assert!(p[0] > 180 && p[1] < 120 && p[2] > 140, "L 50, a 50, b −30 is a magenta-ish purple: {:?}", &p[..3]);
 }
+
+#[test]
+fn lab_keeps_extra_samples() {
+    // A spot plate next to Lab: written as CIELab plus one unspecified extra sample, and read
+    // back as Lab with the spot (not as LabA).
+    for (layout, sample) in [(ChannelLayout::Lab, SampleType::U8), (ChannelLayout::LabA, SampleType::U16)] {
+        let px: Vec<f32> =
+            [lab(50.0, 50.0, -30.0), lab(100.0, 0.0, 0.0)].iter().flat_map(|p| p.iter().copied().chain(layout.has_alpha().then_some(0.5))).collect();
+        let mut img = Image::from_normalized(2, 1, layout, sample, &px).unwrap();
+        let spot: Vec<u8> = (0..2 * sample.bytes()).map(|i| (i * 37 + 5) as u8).collect();
+        img.meta.extra_samples = vec![ExtraSample { kind: 0, data: spot.clone() }];
+        let file = uncompressed(&img);
+        if layout == ChannelLayout::Lab {
+            assert!(find(&file, &[128, 50, (-30i8) as u8, spot[0], 255, 0, 0, spot[1]]).is_some(), "CIELab samples with the spot");
+        }
+        let back = decode(&file).unwrap();
+        assert_eq!((back.layout(), back.sample_type()), (layout, sample));
+        let (a, b) = (img.to_normalized(), back.to_normalized());
+        assert!(a.iter().zip(&b).all(|(x, y)| (x - y).abs() <= 1.5 / 65535.0), "{layout:?}: {a:?} {b:?}");
+        assert_eq!(back.meta.extra_samples, vec![ExtraSample { kind: 0, data: spot }], "{layout:?}");
+    }
+}
+
+#[test]
+fn float_lab_writes_its_extra_samples_with_16_bits() {
+    let px: Vec<f32> = [lab(50.0, 50.0, -30.0), lab(100.0, 0.0, 0.0)].concat();
+    let mut img = Image::from_normalized(2, 1, ChannelLayout::Lab, SampleType::F32, &px).unwrap();
+    img.meta.extra_samples = vec![ExtraSample { kind: 0, data: [0.25f32, 1.0].iter().flat_map(|v| v.to_ne_bytes()).collect() }];
+    let back = decode(&uncompressed(&img)).unwrap();
+    assert_eq!((back.layout(), back.sample_type()), (ChannelLayout::Lab, SampleType::U16));
+    let spot: Vec<u8> = [16384u16, 65535].iter().flat_map(|v| v.to_ne_bytes()).collect();
+    assert_eq!(back.meta.extra_samples, vec![ExtraSample { kind: 0, data: spot }]);
+}
diff --git a/crates/codecs/tests/it/tiff_pages.rs b/crates/codecs/tests/it/tiff_pages.rs
index db432abe51..6996f83ae8 100644
--- a/crates/codecs/tests/it/tiff_pages.rs
+++ b/crates/codecs/tests/it/tiff_pages.rs
@@ -128,13 +128,16 @@ fn planar_strips_at_every_depth() {
     }
 }
 
+/// Extra samples that are not the alpha (ExtraSamples 0: a spot colour or an extra channel) are
+/// not part of the image: they come back in `meta.extra_samples`, one plane each.
 #[test]
-fn extra_samples_that_are_not_alpha_are_dropped() {
+fn extra_samples_that_are_not_alpha_are_kept_apart() {
     let (w, h) = (5usize, 3usize);
     let t = truth(w * h * 5, 4);
     let rgb_of = |spp: usize, keep: usize| -> Vec<u8> { t.u8s[..w * h * spp].chunks(spp).flat_map(|p| p[..keep].to_vec()).collect() };
+    let extra = |spp: usize, at: usize| vec![ExtraSample { kind: 0, data: t.u8s[..w * h * spp].chunks(spp).map(|p| p[at]).collect() }];
     for planar in [false, true] {
-        // RGB + one unspecified extra sample: RGB.
+        // RGB + one unspecified extra sample: RGB, and the sample as an extra plane.
         let px = &t.u8s[..w * h * 4];
         let chunks = if planar { planar_strips(px, w, h, 4, 1, 2) } else { px.chunks(w * 4 * 2).map(<[u8]>::to_vec).collect() };
         let mut d = Dir { entries: base(w as u32, h as u32, 8, 4, 2), chunks, tiled: false }.tag(278, LONG, &[2]).tag(338, SHORT, &[0]);
@@ -144,7 +147,8 @@ fn extra_samples_that_are_not_alpha_are_dropped() {
         let img = decode_ok(&build(true, false, &[d], &[0]).bytes);
         assert_eq!(img.layout(), ChannelLayout::Rgb);
         assert_eq!(img.data(), &rgb_of(4, 3)[..], "planar {planar}");
-        // RGB + alpha + an unspecified extra sample: RGBA.
+        assert_eq!(img.meta.extra_samples, extra(4, 3), "planar {planar}");
+        // RGB + alpha + an unspecified extra sample: RGBA and one extra plane.
         let px = &t.u8s[..w * h * 5];
         let chunks = if planar { planar_strips(px, w, h, 5, 1, 2) } else { px.chunks(w * 5 * 2).map(<[u8]>::to_vec).collect() };
         let mut d = Dir { entries: base(w as u32, h as u32, 8, 5, 2), chunks, tiled: false }.tag(278, LONG, &[2]).tag(338, SHORT, &[2, 0]);
@@ -154,18 +158,48 @@ fn extra_samples_that_are_not_alpha_are_dropped() {
         let img = decode_ok(&build(false, true, &[d], &[0]).bytes);
         assert_eq!(img.layout(), ChannelLayout::Rgba);
         assert_eq!(img.data(), &rgb_of(5, 4)[..], "planar {planar}");
+        assert_eq!(img.meta.extra_samples, extra(5, 4), "planar {planar}");
     }
-    // Gray + alpha + extra: gray and alpha; gray + an unspecified extra: gray.
+    // Gray + alpha + extra: gray and alpha; gray + an unspecified extra: gray. Each keeps the
+    // extra sample as a plane.
     let px = &t.u8s[..w * h * 3];
     let d = strips(w as u32, h as u32, 8, 3, 1, 3, px).tag(338, SHORT, &[2, 0]);
     let img = decode_ok(&build(true, false, &[d], &[0]).bytes);
     assert_eq!(img.layout(), ChannelLayout::GrayA);
     assert_eq!(img.data(), &rgb_of(3, 2)[..]);
+    assert_eq!(img.meta.extra_samples, extra(3, 2));
     let px = &t.u8s[..w * h * 2];
     let d = strips(w as u32, h as u32, 8, 2, 1, 3, px).tag(338, SHORT, &[0]);
     let img = decode_ok(&build(true, false, &[d], &[0]).bytes);
     assert_eq!(img.layout(), ChannelLayout::Gray);
     assert_eq!(img.data(), &rgb_of(2, 1)[..]);
+    assert_eq!(img.meta.extra_samples, extra(2, 1));
+}
+
+/// A file may hold more extra samples than the `MAX_EXTRA_SAMPLES` a decode keeps (up to 64
+/// samples a pixel open): the first ones open, and a warning counts those left out, so nothing
+/// is lost without notice.
+#[test]
+fn extra_samples_past_the_cap_are_reported() {
+    let (w, h) = (3usize, 2usize);
+    const EXTRAS: usize = MAX_EXTRA_SAMPLES + 4;
+    let spp = 3 + EXTRAS;
+    let px: Vec<u8> = (0..w * h * spp).map(|i| (i % spp) as u8).collect();
+    let d = strips(w as u32, h as u32, 8, spp as u16, 2, h as u32, &px).tag(338, SHORT, &[0; EXTRAS]);
+    let img = decode_ok(&build(true, false, &[d], &[0]).bytes);
+    assert_eq!(img.layout(), ChannelLayout::Rgb);
+    assert_eq!(img.meta.extra_samples.len(), MAX_EXTRA_SAMPLES);
+    assert_eq!(img.meta.extra_samples.last().map(|e| e.data[0]), Some((3 + MAX_EXTRA_SAMPLES - 1) as u8));
+    assert_eq!(img.warnings, vec![DecodeWarning::ExtraSamplesOverLimit { format: Format::Tiff, count: 4 }]);
+    let text = img.warnings[0].to_string();
+    assert!(text.contains("4 extra TIFF file channels") && text.contains("past the first 16"), "{text}");
+    // At the cap exactly, nothing is left out.
+    let spp = 3 + MAX_EXTRA_SAMPLES;
+    let px: Vec<u8> = (0..w * h * spp).map(|i| (i % spp) as u8).collect();
+    let d = strips(w as u32, h as u32, 8, spp as u16, 2, h as u32, &px).tag(338, SHORT, &[0; MAX_EXTRA_SAMPLES]);
+    let img = decode_ok(&build(true, false, &[d], &[0]).bytes);
+    assert_eq!(img.meta.extra_samples.len(), MAX_EXTRA_SAMPLES);
+    assert!(img.warnings.is_empty(), "{:?}", img.warnings);
 }
 
 #[test]
diff --git a/crates/codecs/tests/it/tiff_photoshop.rs b/crates/codecs/tests/it/tiff_photoshop.rs
index 238710b68c..c72294923f 100644
--- a/crates/codecs/tests/it/tiff_photoshop.rs
+++ b/crates/codecs/tests/it/tiff_photoshop.rs
@@ -41,6 +41,268 @@ fn tags_round_trip_through_the_encoder() {
     }
 }
 
+#[test]
+fn extra_samples_round_trip() {
+    for (layout, sample) in [
+        (ChannelLayout::Rgb, SampleType::U8),
+        (ChannelLayout::Rgba, SampleType::U8),
+        (ChannelLayout::Gray, SampleType::U16),
+        (ChannelLayout::Cmyk, SampleType::F32),
+    ] {
+        let mut img = synth(4, 3, layout, sample, 2, 0.4);
+        let n = 4 * 3;
+        let b = sample.bytes();
+        let data: Vec<u8> = (0..n * b).map(|i| (i * 17) as u8).collect();
+        img.meta.extra_samples = vec![ExtraSample { kind: 0, data: data.clone() }];
+        let bytes = encode(&img, Format::Tiff, &EncodeOptions::default()).unwrap();
+        let back = decode(&bytes).unwrap();
+        assert_eq!(back.layout(), layout, "{layout:?} {sample:?}");
+        assert_eq!(back.data(), img.data(), "{layout:?} {sample:?}");
+        assert_eq!(back.meta.extra_samples.len(), 1, "{layout:?} {sample:?}");
+        assert_eq!(back.meta.extra_samples[0].kind, 0, "{layout:?} {sample:?}");
+        assert_eq!(back.meta.extra_samples[0].data, data, "{layout:?} {sample:?}");
+    }
+}
+
+/// Tall enough that the default strip size (about 1 MB) cannot hold every row, so a writer
+/// that only fills the first strip, or predicts across the wrong sample count, cannot hide.
+/// The spot plane is checked with the `tiff` crate, not PhotoCraft's decoder.
+#[test]
+fn multi_strip_spot_round_trip_and_dump() {
+    let w = 800u32;
+    let h = 400u32;
+    let n = (w as usize) * (h as usize);
+    for (layout, channels) in [(ChannelLayout::Rgb, 3usize), (ChannelLayout::Rgba, 4usize)] {
+        let mut px = vec![0u8; n * channels];
+        let mut spot = vec![0u8; n];
+        for y in 0..h as usize {
+            for x in 0..w as usize {
+                let i = y * w as usize + x;
+                px[i * channels] = (x % 251) as u8;
+                px[i * channels + 1] = (y % 251) as u8;
+                px[i * channels + 2] = 40;
+                if channels == 4 {
+                    px[i * channels + 3] = if x > 20 && x < 780 && y > 10 && y + 10 < h as usize { 255 } else { 0 };
+                }
+                spot[i] = ((x * 3 + y * 17) % 251) as u8;
+            }
+        }
+        let mut img = Image::from_u8(w, h, layout, px).unwrap();
+        img.meta.extra_samples = vec![ExtraSample { kind: 0, data: spot.clone() }];
+        for compression in [TiffCompression::None, TiffCompression::Deflate, TiffCompression::Lzw, TiffCompression::PackBits] {
+            let bytes = encode(&img, Format::Tiff, &EncodeOptions { tiff_compression: compression, ..Default::default() }).unwrap();
+            let label = format!("{layout:?} {compression:?}");
+            let back = decode(&bytes).unwrap();
+            assert_eq!(back.meta.extra_samples.len(), 1, "{label}");
+            assert_eq!(back.meta.extra_samples[0].data, spot, "own decoder {label}");
+            assert_eq!(back.data(), img.data(), "own decoder rgb {label}");
+            let mut dec = tiff::decoder::Decoder::new(std::io::Cursor::new(bytes.as_slice())).unwrap();
+            let spp: u16 = dec.get_tag_unsigned(tiff::tags::Tag::SamplesPerPixel).unwrap();
+            let bps = dec.get_tag_u16_vec(tiff::tags::Tag::BitsPerSample).unwrap();
+            let extra = dec.get_tag_u16_vec(tiff::tags::Tag::ExtraSamples).unwrap();
+            let rows = dec.find_tag_unsigned::<u32>(tiff::tags::Tag::RowsPerStrip).unwrap();
+            assert_eq!(bps.len(), spp as usize, "{label}");
+            assert_eq!(spp as usize, channels + 1, "{label}");
+            assert_eq!(*extra.last().unwrap(), 0, "{label} spot ExtraSamples {extra:?}");
+            assert!(rows.is_some_and(|r| r < h) || compression == TiffCompression::PackBits, "{label} rows {rows:?}");
+            let patched = min_is_black(&bytes);
+            let mut indep = tiff::decoder::Decoder::new(std::io::Cursor::new(patched.as_slice())).unwrap();
+            let tiff::decoder::DecodingResult::U8(samples) = indep.read_image().unwrap() else { panic!("{label} not u8") };
+            let spp = spp as usize;
+            assert_eq!(samples.len(), n * spp, "{label}");
+            let mut bad = 0usize;
+            let mut first = None;
+            for (i, want) in spot.iter().enumerate() {
+                let got = samples.get(i * spp + spp - 1).copied();
+                if got != Some(*want) {
+                    bad += 1;
+                    first.get_or_insert((i, got));
+                }
+            }
+            assert_eq!(bad, 0, "{label} independent reader, first {first:?}");
+        }
+    }
+}
+
+/// Retag photometric interpretation 262 as MinIsBlack so `tiff`'s decoder returns every sample.
+fn min_is_black(src: &[u8]) -> Vec<u8> {
+    let mut bytes = src.to_vec();
+    let le = bytes.first().copied() == Some(b'I');
+    let ru16 = |b: &[u8], i: usize| -> Option<u16> {
+        let s = b.get(i..i + 2)?;
+        Some(if le { u16::from_le_bytes([s[0], s[1]]) } else { u16::from_be_bytes([s[0], s[1]]) })
+    };
+    let ru32 = |b: &[u8], i: usize| -> Option<u32> {
+        let s = b.get(i..i + 4)?;
+        Some(if le { u32::from_le_bytes(s.try_into().ok()?) } else { u32::from_be_bytes(s.try_into().ok()?) })
+    };
+    let Some(ifd) = ru32(&bytes, 4) else { return bytes };
+    let Some(n) = ru16(&bytes, ifd as usize) else { return bytes };
+    for e in 0..n as usize {
+        let at = ifd as usize + 2 + e * 12;
+        if ru16(&bytes, at) == Some(262) {
+            let value = if le { 1u16.to_le_bytes() } else { 1u16.to_be_bytes() };
+            if let Some(slot) = bytes.get_mut(at + 8..at + 10) {
+                slot.copy_from_slice(&value);
+            }
+            break;
+        }
+    }
+    bytes
+}
+
+#[test]
+fn more_than_sixteen_extra_samples_is_refused() {
+    let mut img = synth(2, 2, ChannelLayout::Rgb, SampleType::U8, 1, 0.0);
+    img.meta.extra_samples = (0..MAX_EXTRA_SAMPLES + 1).map(|_| ExtraSample { kind: 0, data: vec![0; 4] }).collect();
+    assert!(encode(&img, Format::Tiff, &EncodeOptions::default()).is_err());
+}
+
+#[test]
+fn sixteen_extra_samples_round_trip() {
+    for (layout, sample, base) in [
+        (ChannelLayout::Rgb, SampleType::U8, 3usize),
+        (ChannelLayout::Rgba, SampleType::U8, 4),
+        (ChannelLayout::Gray, SampleType::U16, 1),
+        (ChannelLayout::Cmyk, SampleType::F32, 4),
+    ] {
+        let mut img = synth(2, 2, layout, sample, 1, 0.0);
+        let n = 2 * 2 * sample.bytes();
+        img.meta.extra_samples = (0..MAX_EXTRA_SAMPLES).map(|k| ExtraSample { kind: 0, data: vec![k as u8; n] }).collect();
+        let bytes = encode(&img, Format::Tiff, &EncodeOptions::default()).unwrap();
+        let back = decode(&bytes).unwrap();
+        assert_eq!(back.layout(), layout, "{layout:?} {sample:?} base {base}");
+        assert_eq!(back.data(), img.data(), "{layout:?}");
+        assert_eq!(back.meta.extra_samples.len(), MAX_EXTRA_SAMPLES, "{layout:?}");
+        assert_eq!(back.meta.extra_samples[7].kind, 0, "{layout:?}");
+        assert_eq!(back.meta.extra_samples[15].data, vec![15; n], "{layout:?}");
+    }
+}
+
+/// An extra plane holds exactly one sample per pixel of the image's sample type. A plane of any
+/// other length is refused rather than written: the writer copies one sample per pixel, so a
+/// longer plane would lose its tail and a shorter one would run out mid-image.
+#[test]
+fn wrong_sized_extra_planes_are_refused() {
+    let (w, h) = (2u32, 1u32);
+    for (label, plane) in [("too long", vec![10u8, 20, 30]), ("too short", vec![10u8]), ("empty", Vec::new())] {
+        let mut img = synth(w, h, ChannelLayout::Rgb, SampleType::U8, 1, 0.0);
+        img.meta.extra_samples = vec![ExtraSample { kind: 0, data: plane.clone() }];
+        let err = encode(&img, Format::Tiff, &EncodeOptions::default()).unwrap_err();
+        assert!(matches!(err, CodecError::Encode { .. }), "{label}: {err}");
+        assert!(err.to_string().contains("extra sample 0") && err.to_string().contains("exactly 2"), "{label}: {err}");
+    }
+    // The exact length still writes, and comes back unchanged.
+    let plane = vec![10u8, 20];
+    let mut img = synth(w, h, ChannelLayout::Rgb, SampleType::U8, 1, 0.0);
+    img.meta.extra_samples = vec![ExtraSample { kind: 0, data: plane.clone() }];
+    let back = decode(&encode(&img, Format::Tiff, &EncodeOptions::default()).unwrap()).unwrap();
+    assert_eq!(back.meta.extra_samples, vec![ExtraSample { kind: 0, data: plane }]);
+}
+
+/// The sample-type conversion an encode performs must not launder a wrong-sized plane: float Lab
+/// is stored as CIELab at 16 bits, and `Image::convert` leaves a plane whose length does not match
+/// the image alone, so a 7- or 9-byte plane for two pixels would otherwise reach the writer
+/// reinterpreted at the new width.
+#[test]
+fn a_wrong_sized_plane_is_refused_before_a_sample_type_conversion() {
+    let (w, h) = (2u32, 1u32);
+    // Two pixels at 32-bit float are 8 bytes; the file's 16-bit samples are 4.
+    for (label, len) in [("short", 7usize), ("long", 9)] {
+        let mut img = synth(w, h, ChannelLayout::Lab, SampleType::F32, 1, 0.0);
+        img.meta.extra_samples = vec![ExtraSample { kind: 0, data: vec![0; len] }];
+        let err = encode(&img, Format::Tiff, &EncodeOptions::default()).unwrap_err();
+        assert!(matches!(err, CodecError::Encode { .. }), "{label}: {err}");
+        assert!(err.to_string().contains("exactly 8"), "{label}: {err}");
+    }
+}
+
+/// Extra samples count against `max_alloc` with the image (their interleaved buffer and the
+/// planes split from it): a budget that holds the RGB image but not sixteen extra planes opens
+/// the image without them, with a warning, instead of allocating past it.
+#[test]
+fn extra_samples_count_against_the_allocation_limit() {
+    // Big enough for several strips (about 1 MB each): one strip of all 19 samples fits the budget
+    // of the image alone, as in real files.
+    let (w, h) = (1024u32, 1024u32);
+    let n = (w * h) as usize;
+    let mut img = synth(w, h, ChannelLayout::Rgb, SampleType::U8, 1, 0.0);
+    img.meta.extra_samples = (0..MAX_EXTRA_SAMPLES).map(|k| ExtraSample { kind: 0, data: vec![k as u8; n] }).collect();
+    let bytes = encode(&img, Format::Tiff, &EncodeOptions::default()).unwrap();
+    let with = |max_alloc: u64| decode_with(&bytes, &DecodeOptions { limits: Limits { max_alloc, ..Limits::default() }, ..DecodeOptions::default() });
+    // RGB is 3 bytes a pixel; the extra samples add 2 x 16 more.
+    let image_only = 3 * n as u64;
+    let with_extras = (3 + 2 * MAX_EXTRA_SAMPLES as u64) * n as u64;
+    let back = with(with_extras).expect("everything fits");
+    assert_eq!(back.meta.extra_samples.len(), MAX_EXTRA_SAMPLES);
+    assert!(back.warnings.is_empty());
+    // The image fits, its extra samples don't: it opens as before they were read, with a warning.
+    for max_alloc in [image_only, with_extras - 1] {
+        let only = with(max_alloc).expect("the image alone fits");
+        assert!(only.meta.extra_samples.is_empty());
+        assert_eq!(only.warnings, vec![DecodeWarning::ExtraSamplesDropped { format: Format::Tiff, count: MAX_EXTRA_SAMPLES as u32 }]);
+        assert_eq!(only.data(), back.data());
+    }
+    assert!(matches!(with(image_only - 1), Err(CodecError::LimitExceeded(_))), "the image itself must still fit");
+}
+
+/// The value field of a little-endian classic TIFF's ExtraSamples entry (tag 338, SHORT) holding
+/// two values, so they sit in the entry itself.
+fn extra_samples_values(bytes: &mut [u8]) -> &mut [u8] {
+    assert_eq!(&bytes[..4], b"II*\0");
+    let entry = [0x52, 0x01, 3, 0, 2, 0, 0, 0];
+    let at = bytes.windows(8).position(|w| w == entry).expect("an ExtraSamples entry with two values");
+    &mut bytes[at + 8..at + 12]
+}
+
+/// ExtraSamples values above 2 are reserved (TIFF 6.0, p. 31): they read as 0 (unspecified) and
+/// are written as 0, so a save never carries a reserved value.
+#[test]
+fn reserved_extra_sample_kinds_read_as_unspecified() {
+    let n = 4 * 4;
+    let mut img = synth(4, 4, ChannelLayout::Rgb, SampleType::U8, 1, 0.0);
+    img.meta.extra_samples = vec![ExtraSample { kind: 0, data: vec![7; n] }, ExtraSample { kind: 0, data: vec![9; n] }];
+    let mut bytes = encode(&img, Format::Tiff, &EncodeOptions::default()).unwrap();
+    // A file from another writer with reserved values 3 and 65535.
+    let values = extra_samples_values(&mut bytes);
+    assert_eq!(values, [0, 0, 0, 0]);
+    values.copy_from_slice(&[3, 0, 0xFF, 0xFF]);
+    let back = decode(&bytes).unwrap();
+    assert_eq!(back.meta.extra_samples.iter().map(|e| e.kind).collect::<Vec<_>>(), [0, 0]);
+    assert_eq!(back.layout(), ChannelLayout::Rgb, "a reserved value is no alpha");
+    assert_eq!(back.meta.extra_samples[0].data, vec![7; n]);
+    assert_eq!(back.meta.extra_samples[1].data, vec![9; n]);
+
+    // An image that carries a reserved kind saves it as 0.
+    img.meta.extra_samples[0].kind = 3;
+    img.meta.extra_samples[1].kind = u16::MAX;
+    let mut bytes = encode(&img, Format::Tiff, &EncodeOptions::default()).unwrap();
+    assert_eq!(extra_samples_values(&mut bytes), [0, 0, 0, 0]);
+}
+
+/// Converting an image's sample type converts its extra samples with it, so they keep matching
+/// the image: a 16-bit float TIFF's spot planes survive the 32-bit float a layered import uses.
+#[test]
+fn extra_samples_follow_a_sample_type_conversion() {
+    let (w, h) = (3u32, 2u32);
+    let n = (w * h) as usize;
+    let values = [0.0f32, 0.25, 0.5, 0.75, 1.0, 0.125];
+    let half = |v: f32| f16::from_f32(v).to_bits().to_ne_bytes();
+    let rgb: Vec<u8> = (0..n * 3).flat_map(|_| half(0.5)).collect();
+    let mut img = Image::from_raw(w, h, ChannelLayout::Rgb, SampleType::F16, rgb).unwrap();
+    img.meta.extra_samples = vec![ExtraSample { kind: 0, data: values.iter().flat_map(|v| half(*v)).collect() }];
+
+    let wide = img.convert(ChannelLayout::Rgb, SampleType::F32);
+    let plane: Vec<f32> = wide.meta.extra_samples[0].data.as_chunks::<4>().0.iter().map(|c| f32::from_ne_bytes(*c)).collect();
+    assert_eq!(plane, values);
+
+    // To 8 bits, the plane quantizes exactly as a gray image of the same values does.
+    let narrow = wide.convert(ChannelLayout::Rgb, SampleType::U8);
+    let gray = Image::from_raw(w, h, ChannelLayout::Gray, SampleType::F32, wide.meta.extra_samples[0].data.clone()).unwrap();
+    assert_eq!(narrow.meta.extra_samples[0].data, gray.convert(ChannelLayout::Gray, SampleType::U8).data());
+    assert_eq!(narrow.meta.extra_samples[0].data.len(), n);
+}
+
 #[test]
 fn absent_and_empty_tags_are_not_written() {
     let mut img = synth(4, 4, ChannelLayout::Rgb, SampleType::U8, 1, 0.0);
diff --git a/crates/compose/src/lib.rs b/crates/compose/src/lib.rs
index 4786bc1912..0a3f5c4802 100644
--- a/crates/compose/src/lib.rs
+++ b/crates/compose/src/lib.rs
@@ -367,43 +367,17 @@ pub fn composite_to_surface(doc: &Document, rect: Rect, fmt: photocraft_color::P
     {
         return s;
     }
+    let space = cmyk_space(doc);
+    let to_cmyk = fmt.mode == photocraft_color::ColorMode::Cmyk && doc.mode == photocraft_color::ColorMode::Cmyk;
+    if to_cmyk && cmyk::renders_inks(doc) {
+        return composite_inks_to_surface(doc, rect, fmt, background, space.as_ref());
+    }
+    // The composite separates back to CMYK through the document's own profile, the one its
+    // pixels were read through.
     let mut s = Surface::new(fmt);
     let n = fmt.channels();
     let empty = s.default_pixel();
     let mut data = Vec::new();
-    let space = cmyk_space(doc);
-    let to_cmyk = fmt.mode == photocraft_color::ColorMode::Cmyk && doc.mode == photocraft_color::ColorMode::Cmyk;
-    if to_cmyk && cmyk::renders_inks(doc) {
-        // White paper is no ink; another background colour goes through the profile.
-        let paper = background.map(|bg| {
-            if bg == [1.0; 3] { [0.0; 4] } else { photocraft_color::convert::with_cmyk_space(space.as_ref(), || photocraft_color::convert::rgb_to_cmyk(bg)) }
-        });
-        let _ = cmyk::render_cmyk_bands(doc, rect, 0, |band| -> Result<(), ()> {
-            data.clear();
-            data.reserve(band.px.len() * n);
-            for p in &band.px {
-                if paper.is_none() && fmt.alpha && (p[4] <= 0.0 || p[4].is_nan()) && empty.len() == n {
-                    data.extend_from_slice(&empty);
-                    continue;
-                }
-                // Over the paper (fully covered pixels keep their inks exactly), or straight.
-                let ink = |c: usize| match paper {
-                    Some(bg) if p[4] < 1.0 => p[c] * p[4] + bg[c] * (1.0 - p[4]),
-                    _ => p[c],
-                };
-                data.extend((0..4).map(ink));
-                if fmt.alpha {
-                    data.push(if paper.is_some() { 1.0 } else { p[4] });
-                }
-            }
-            s.write_region(band.rect, &data);
-            Ok(())
-        });
-        s.prune();
-        return s;
-    }
-    // The composite separates back to CMYK through the document's own profile, the one its
-    // pixels were read through.
     let _ = render_bands(doc, rect, 0, |band| -> Result<(), ()> {
         let band = match background {
             Some(bg) => band.over_background(bg),
@@ -427,6 +401,51 @@ pub fn composite_to_surface(doc: &Document, rect: Rect, fmt: photocraft_color::P
     s
 }
 
+/// One CMYK pixel's output channels into `data`: its inks (over `paper` when given) and alpha.
+fn push_ink_pixel(data: &mut Vec<f32>, p: &[f32; 5], paper: Option<[f32; 4]>, fmt: photocraft_color::PixelFormat, empty: &[f32]) {
+    if paper.is_none() && fmt.alpha && (p[4] <= 0.0 || p[4].is_nan()) && empty.len() == fmt.channels() {
+        data.extend_from_slice(empty);
+        return;
+    }
+    // Over the paper (fully covered pixels keep their inks exactly), or straight.
+    let ink = |c: usize| match paper {
+        Some(bg) if p[4] < 1.0 => p[c] * p[4] + bg[c] * (1.0 - p[4]),
+        _ => p[c],
+    };
+    data.extend((0..4).map(ink));
+    if fmt.alpha {
+        data.push(if paper.is_some() { 1.0 } else { p[4] });
+    }
+}
+
+/// [`composite_to_surface`] for a CMYK document flattened to CMYK, composited in its inks.
+fn composite_inks_to_surface(
+    doc: &Document,
+    rect: Rect,
+    fmt: photocraft_color::PixelFormat,
+    background: Option<[f32; 3]>,
+    space: Option<&std::sync::Arc<photocraft_color::convert::CmykSpace>>,
+) -> Surface {
+    let mut s = Surface::new(fmt);
+    let n = fmt.channels();
+    let empty = s.default_pixel();
+    let mut data = Vec::new();
+    // White paper is no ink; another background colour goes through the profile.
+    let paper = background
+        .map(|bg| if bg == [1.0; 3] { [0.0; 4] } else { photocraft_color::convert::with_cmyk_space(space, || photocraft_color::convert::rgb_to_cmyk(bg)) });
+    let _ = cmyk::render_cmyk_bands(doc, rect, 0, |band| -> Result<(), ()> {
+        data.clear();
+        data.reserve(band.px.len() * n);
+        for p in &band.px {
+            push_ink_pixel(&mut data, p, paper, fmt, &empty);
+        }
+        s.write_region(band.rect, &data);
+        Ok(())
+    });
+    s.prune();
+    s
+}
+
 /// Composite the full canvas.
 pub fn flatten(doc: &Document) -> Buffer {
     render(doc, doc.bounds())
@@ -2334,6 +2353,41 @@ fn effect_maps(layer: &Layer, rect: Rect, cx: &Ctx) -> std::sync::Arc<effects::F
     cx.fx_maps.lock().unwrap_or_else(|e| e.into_inner()).entry(key).or_insert((maps, clipped)).0.clone()
 }
 
+fn build_fx_slot_maps(layer: &Layer, region: Rect, key: u64, cx: &Ctx, slot: &FxSlot) -> std::sync::Arc<effects::FxMaps> {
+    let shape: Vec<f32> = if region.is_empty() { Vec::new() } else { effect_shape(layer, region, cx) };
+    let maps = effects::build_maps_prepared(layer, shape, region, &cx.light, &texture_ctx(layer, region, cx), cx.patterns);
+    let mut pin = Vec::new();
+    layer_identity(layer, &mut std::collections::hash_map::DefaultHasher::new(), &mut |t| pin.push(std::sync::Arc::downgrade(t)));
+    // The maps, plus what each reserved tile address keeps allocated.
+    let bytes = maps.bytes().saturating_add(pin.len().saturating_mul(std::mem::size_of::<photocraft_raster::Tile>() + 2 * std::mem::size_of::<usize>()));
+    let maps = std::sync::Arc::new(maps);
+    if slot.set(FxEntry { maps: maps.clone(), _pin: pin, bytes }).is_ok() {
+        // Counted exactly once, by the build that filled the slot, and only while the
+        // slot is still cached (eviction may have dropped it meanwhile).
+        let mut c = fx_cache().lock().unwrap_or_else(|e| e.into_inner());
+        if c.map.get(&key).is_some_and(|s| std::sync::Arc::ptr_eq(s, slot)) {
+            c.bytes += bytes;
+        }
+    }
+    // A concurrent build that finished first wins, so every tile shares one map.
+    slot.get().map_or(maps, |e| e.maps.clone())
+}
+
+fn evict_fx_cache_over_budget(key: u64) {
+    let mut c = fx_cache().lock().unwrap_or_else(|e| e.into_inner());
+    let budget = effect_cache_budget();
+    while c.bytes > budget && c.order.len() > 1 {
+        let Some(old) = c.order.pop_front() else { break };
+        if old == key {
+            c.order.push_back(old);
+            continue;
+        }
+        if let Some(s) = c.map.remove(&old) {
+            c.bytes = c.bytes.saturating_sub(s.get().map_or(0, |e| e.bytes));
+        }
+    }
+}
+
 /// The layer's effect maps from the global cache, built on a miss.
 ///
 /// Never waits for another thread's build (#276): this can run on a Rayon worker inside a tile,
@@ -2355,40 +2409,10 @@ fn cached_effect_maps(layer: &Layer, region: Rect, key: u64, cx: &Ctx) -> std::s
     };
     let maps = match slot.get() {
         Some(e) => e.maps.clone(),
-        None => {
-            let shape: Vec<f32> = if region.is_empty() { Vec::new() } else { effect_shape(layer, region, cx) };
-            let maps = effects::build_maps_prepared(layer, shape, region, &cx.light, &texture_ctx(layer, region, cx), cx.patterns);
-            let mut pin = Vec::new();
-            layer_identity(layer, &mut std::collections::hash_map::DefaultHasher::new(), &mut |t| pin.push(std::sync::Arc::downgrade(t)));
-            // The maps, plus what each reserved tile address keeps allocated.
-            let bytes =
-                maps.bytes().saturating_add(pin.len().saturating_mul(std::mem::size_of::<photocraft_raster::Tile>() + 2 * std::mem::size_of::<usize>()));
-            let maps = std::sync::Arc::new(maps);
-            if slot.set(FxEntry { maps: maps.clone(), _pin: pin, bytes }).is_ok() {
-                // Counted exactly once, by the build that filled the slot, and only while the
-                // slot is still cached (eviction may have dropped it meanwhile).
-                let mut c = fx_cache().lock().unwrap_or_else(|e| e.into_inner());
-                if c.map.get(&key).is_some_and(|s| std::sync::Arc::ptr_eq(s, &slot)) {
-                    c.bytes += bytes;
-                }
-            }
-            // A concurrent build that finished first wins, so every tile shares one map.
-            slot.get().map_or(maps, |e| e.maps.clone())
-        }
+        None => build_fx_slot_maps(layer, region, key, cx, &slot),
     };
     // Evict the oldest entries over budget (never the one just used).
-    let mut c = fx_cache().lock().unwrap_or_else(|e| e.into_inner());
-    let budget = effect_cache_budget();
-    while c.bytes > budget && c.order.len() > 1 {
-        let Some(old) = c.order.pop_front() else { break };
-        if old == key {
-            c.order.push_back(old);
-            continue;
-        }
-        if let Some(s) = c.map.remove(&old) {
-            c.bytes = c.bytes.saturating_sub(s.get().map_or(0, |e| e.bytes));
-        }
-    }
+    evict_fx_cache_over_budget(key);
     maps
 }
 
diff --git a/crates/engine/examples/bench_art_history.rs b/crates/engine/examples/bench_art_history.rs
new file mode 100644
index 0000000000..e66949eb96
--- /dev/null
+++ b/crates/engine/examples/bench_art_history.rs
@@ -0,0 +1,60 @@
+//! 24 MP timing of Art History Brush on a representative stroke.
+//! `cargo run --release -p photocraft-engine --example bench_art_history`
+use std::time::Instant;
+
+use photocraft_engine::Session;
+use photocraft_geom::Rect;
+use serde_json::json;
+
+fn main() {
+    let (w, h) = (6016u32, 4000u32);
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": w, "height": h, "depth": 8, "mode": "rgb"})).unwrap();
+    s.edit("texture", |doc, active| {
+        let surf = doc.layer_mut(active.unwrap()).unwrap().surface_mut().unwrap();
+        let fmt = surf.format();
+        let row: Vec<f32> = (0..w)
+            .flat_map(|x| {
+                let t = (x % 256) as f32 / 255.0;
+                photocraft_raster::from_rgba(&fmt, [t, 0.35, 1.0 - t, 1.0])
+            })
+            .collect();
+        for y in 0..h as i32 {
+            surf.write_region(Rect::new(0, y, w as i32, y + 1), &row);
+        }
+        Ok(())
+    })
+    .unwrap();
+    s.execute("edit.fill", json!({"color": "#606060"})).unwrap();
+
+    let points: Vec<[i32; 2]> = (0..200).map(|i| [2800 + i, 2000]).collect();
+    let run = |s: &mut Session, style: &str| {
+        s.execute(
+            "paint.artHistoryBrush",
+            json!({
+                "points": points,
+                "size": 40,
+                "hardness": 100,
+                "area": 50,
+                "tolerance": 0,
+                "style": style,
+                "state": 0
+            }),
+        )
+        .unwrap();
+    };
+    // Warm the allocator / tile cache.
+    run(&mut s, "tightMedium");
+    s.undo();
+
+    for style in ["tightMedium", "looseCurl"] {
+        let t = Instant::now();
+        run(&mut s, style);
+        let ms = t.elapsed().as_secs_f64() * 1000.0;
+        println!(
+            "artHistoryBrush  document {w}×{h} ({:.1} MP)  stroke 200 px  size 40  area 50  style {style}  {ms:.3} ms",
+            (w as u64 * h as u64) as f64 / 1e6
+        );
+        s.undo();
+    }
+}
diff --git a/crates/engine/examples/bench_content_aware_scale.rs b/crates/engine/examples/bench_content_aware_scale.rs
new file mode 100644
index 0000000000..dd137fefd5
--- /dev/null
+++ b/crates/engine/examples/bench_content_aware_scale.rs
@@ -0,0 +1,50 @@
+//! End-to-end timing of `edit.contentAwareScale` (perf scenario P28, #211) without the UI: a
+//! synthetic 24 MP RGB photo opened from JPEG like `perf_scenarios`' (gradients, soft blobs, fine
+//! noise and a high-contrast disc), scaled to 90 % width, undone between runs.
+//! `cargo run --release -p photocraft-engine --example bench_content_aware_scale [reps] [width height]`
+use std::time::Instant;
+
+use photocraft_engine::Session;
+use serde_json::json;
+
+fn photo_jpeg(w: u32, h: u32) -> Result<Vec<u8>, String> {
+    let mut px = vec![0u8; w as usize * h as usize * 3];
+    let (cx, cy, r) = (w as f32 * 0.55, h as f32 * 0.5, w.min(h) as f32 / 3.0);
+    for (y, row) in px.chunks_mut(w as usize * 3).enumerate() {
+        for x in 0..w as usize {
+            let (fx, fy) = (x as f32 / w as f32, y as f32 / h as f32);
+            let n = ((x.wrapping_mul(73_856_093) ^ y.wrapping_mul(19_349_663)) % 997) as f32 / 997.0 - 0.5;
+            let blob = (-(((fx - 0.4) * 3.0).powi(2) + ((fy - 0.55) * 4.0).powi(2))).exp();
+            let inside = ((x as f32 - cx).powi(2) + (y as f32 - cy).powi(2)).sqrt() < r;
+            let (r0, g0, b0) = if inside { (0.85, 0.3 + 0.2 * (fx * 40.0).sin(), 0.15) } else { (0.35, 0.45, 0.55) };
+            let rgb = [r0 + 0.1 * blob + n * 0.08, g0 + 0.1 * blob + n * 0.08, b0 + 0.2 * fy + n * 0.08];
+            for (c, v) in rgb.into_iter().enumerate() {
+                row[x * 3 + c] = (v.clamp(0.0, 1.0) * 255.0 + 0.5) as u8;
+            }
+        }
+    }
+    let img =
+        photocraft_codecs::Image::from_raw(w, h, photocraft_codecs::ChannelLayout::Rgb, photocraft_codecs::SampleType::U8, px).map_err(|e| e.to_string())?;
+    photocraft_codecs::encode(&img, photocraft_codecs::Format::Jpeg, &Default::default()).map_err(|e| e.to_string())
+}
+
+fn main() -> Result<(), String> {
+    let args: Vec<String> = std::env::args().collect();
+    let num = |i: usize, d: u32| args.get(i).and_then(|v| v.parse::<u32>().ok()).unwrap_or(d);
+    let (reps, w, h) = (num(1, 3).clamp(1, 20) as usize, num(2, 6000).clamp(16, 20_000), num(3, 4000).clamp(16, 20_000));
+    let jpeg = photo_jpeg(w, h)?;
+    let doc = photocraft_io::import("photo.jpg", &jpeg).map_err(|e| e.to_string())?.document;
+    let mut s = Session::new();
+    s.open_document(doc, Some("photo.jpg".into()));
+    let mut times = Vec::with_capacity(reps);
+    for _ in 0..reps {
+        let t = Instant::now();
+        s.execute("edit.contentAwareScale", json!({"scaleX": 90, "scaleY": 100})).map_err(|e| e.to_string())?;
+        times.push(t.elapsed().as_secs_f64() * 1000.0);
+        s.execute("edit.undo", json!({})).map_err(|e| e.to_string())?;
+    }
+    times.sort_by(f64::total_cmp);
+    let (p50, max) = (times[times.len() / 2], times[times.len() - 1]);
+    println!("edit.contentAwareScale {w}x{h} to 90 % width: p50 {p50:.1} ms, max {max:.1} ms ({reps} runs)");
+    Ok(())
+}
diff --git a/crates/engine/src/artboard_cmds.rs b/crates/engine/src/artboard_cmds.rs
index d9d002ee84..5394c0193c 100644
--- a/crates/engine/src/artboard_cmds.rs
+++ b/crates/engine/src/artboard_cmds.rs
@@ -233,6 +233,23 @@ fn next_artboard_name(doc: &Document) -> String {
     (1..=names.len() + 1).map(|n| format!("Artboard {n}")).find(|n| !names.contains(&n.as_str())).unwrap_or_else(|| "Artboard".into())
 }
 
+/// File › New with Artboards (#9086): one board over the whole canvas, its background the
+/// document's (white, black, a colour or transparent), holding an empty Layer 1. As in Photoshop,
+/// there is no Background layer.
+pub fn new_artboard_document(name: String, size: Size, mode: ColorMode, depth: SampleType, background: Option<Color>) -> Document {
+    let mut doc = Document::new(name, size, mode, depth);
+    let background = match background {
+        None => ArtboardBackground::Transparent,
+        Some(c) if c == Color::WHITE => ArtboardBackground::White,
+        Some(c) if c == Color::BLACK => ArtboardBackground::Black,
+        Some(c) => ArtboardBackground::Custom(c),
+    };
+    let mut board = Layer::group("Artboard 1", vec![Layer::raster("Layer 1", doc.pixel_format())]);
+    set_artboard(&mut board, Artboard { rect: doc.bounds(), background, preset: String::new() });
+    doc.layers.push(board);
+    doc
+}
+
 fn set_artboard(l: &mut Layer, a: Artboard) {
     if let LayerContent::Group(g) = &mut l.content {
         g.artboard = Some(a);
diff --git a/crates/engine/src/artboard_cmds/tests.rs b/crates/engine/src/artboard_cmds/tests.rs
index b7ad123f9d..ad3f7a46d0 100644
--- a/crates/engine/src/artboard_cmds/tests.rs
+++ b/crates/engine/src/artboard_cmds/tests.rs
@@ -661,3 +661,32 @@ fn add_beside_duplicate_honors_panel_copy_name_preference() {
         assert_eq!(doc(&s), &before);
     }
 }
+
+/// #9086: File › New with Artboards makes one board over the canvas, its background the chosen
+/// one, holding an empty Layer 1, and no Background layer.
+#[test]
+fn new_document_with_an_artboard() {
+    for (background, want) in [
+        ("white", ArtboardBackground::White),
+        ("black", ArtboardBackground::Black),
+        ("transparent", ArtboardBackground::Transparent),
+        ("#336699", ArtboardBackground::Custom(Color::rgba(0x33 as f32 / 255.0, 0x66 as f32 / 255.0, 0x99 as f32 / 255.0, 1.0))),
+    ] {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 120, "height": 90, "background": background, "artboard": true})).unwrap();
+        let d = doc(&s);
+        assert_eq!(d.layers.len(), 1, "{background}: only the board");
+        let boards = d.artboards();
+        let [(_, _, board)] = boards.as_slice() else { panic!("{background}: one artboard, got {}", boards.len()) };
+        assert_eq!(board.rect, d.bounds());
+        assert_eq!(board.background, want, "{background}");
+        let LayerContent::Group(g) = &d.layers[0].content else { panic!("not a group") };
+        assert_eq!(g.children.iter().map(|l| l.name.as_str()).collect::<Vec<_>>(), ["Layer 1"]);
+        assert!(!d.layers.iter().any(|l| d.is_background(l.id)), "{background}: no Background layer");
+    }
+    // Without the option nothing changes; a non-boolean is refused.
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": 20, "height": 10, "artboard": false})).unwrap();
+    assert!(doc(&s).artboards().is_empty());
+    assert!(s.execute("file.new", json!({"artboard": "yes"})).is_err());
+}
diff --git a/crates/engine/src/atn_cmds.rs b/crates/engine/src/atn_cmds.rs
index 6f43e5ef70..244c21479a 100644
--- a/crates/engine/src/atn_cmds.rs
+++ b/crates/engine/src/atn_cmds.rs
@@ -3948,9 +3948,9 @@ pub struct Skipped {
 fn export_item(id: &str, params: &Value, set: &str) -> Option<AtnItem> {
     if id == PHOTOSHOP_STEP {
         let event = jstr(params, "event")?;
-        let event = match jstr(params, "eventKind") {
-            Some("code") => AtnEvent::Code(event.as_bytes().try_into().ok()?),
-            Some("name") => AtnEvent::name(event),
+        let event = match params.get("eventKind") {
+            Some(Value::String(kind)) if kind == "code" => AtnEvent::Code(event.as_bytes().try_into().ok()?),
+            Some(Value::String(kind)) if kind == "name" => AtnEvent::name(event),
             Some(_) => return None,
             // Older PhotoCraft action data did not retain the event kind. Keep its previous
             // best-effort export behavior for compatibility.
diff --git a/crates/engine/src/atn_cmds/tests.rs b/crates/engine/src/atn_cmds/tests.rs
index 2b967f8c9d..afd3895393 100644
--- a/crates/engine/src/atn_cmds/tests.rs
+++ b/crates/engine/src/atn_cmds/tests.rs
@@ -986,6 +986,12 @@ fn save_preserves_the_kind_of_unsupported_atn_events() {
         round_trip.actions[0].items.iter().map(|item| item.event.clone()).collect::<Vec<_>>(),
         [AtnEvent::Name(b"make".to_vec()), AtnEvent::Code(*b"Qwer")]
     );
+
+    // Legacy steps may omit eventKind, but an explicitly malformed value must not be treated
+    // as if it were absent.
+    assert!(export_item(PHOTOSHOP_STEP, &json!({"event": "make", "eventKind": null}), "S").is_none());
+    assert!(export_item(PHOTOSHOP_STEP, &json!({"event": "make", "eventKind": 4}), "S").is_none());
+    assert_eq!(export_item(PHOTOSHOP_STEP, &json!({"event": "make"}), "S").unwrap().event, AtnEvent::Code(*b"make"));
 }
 
 /// #6745: the events of a Photoshop 2026 retouching set (ID-photo background swap, whitening,
diff --git a/crates/engine/src/brush_cmds.rs b/crates/engine/src/brush_cmds.rs
index feb238cf40..49d55f3e09 100644
--- a/crates/engine/src/brush_cmds.rs
+++ b/crates/engine/src/brush_cmds.rs
@@ -8,7 +8,7 @@
 
 use photocraft_doc::LayerContent;
 use photocraft_geom::Rect;
-use photocraft_paint::mixer::{MixerSettings, apply_mixer_stroke};
+use photocraft_paint::mixer::{MixerSettings, MixerState};
 use photocraft_paint::replace::{Limits, ReplaceMode, ReplaceSettings, Sampling, apply_color_replacement, color_replacement_effect};
 use photocraft_paint::tile::PREVIEW_SIDE;
 use photocraft_paint::{
@@ -462,6 +462,8 @@ pub struct LiveStroke {
 /// document revision, params, seed and points), it takes these pixels instead of rendering the
 /// stroke again.
 pub struct LiveCommit {
+    /// Mixer load before and after the stroke; transient, never serialized into the journal.
+    pub(crate) mixer: Option<(MixerState, MixerState)>,
     pub(crate) cmd: String,
     pub(crate) base: (photocraft_doc::DocId, u64),
     pub(crate) params: Value,
@@ -553,7 +555,16 @@ impl LiveStroke {
     pub fn into_commit(mut self) -> Result<LiveCommit> {
         let bounds = self.bounds();
         let (surf, _) = crate::channel_cmds::target_surface(std::sync::Arc::make_mut(&mut self.doc), self.layer, &self.params)?;
-        Ok(LiveCommit { cmd: self.cmd, base: self.base, params: self.params, seed: Some(self.seed), points: self.points, surface: surf.clone(), bounds })
+        Ok(LiveCommit {
+            mixer: None,
+            cmd: self.cmd,
+            base: self.base,
+            params: self.params,
+            seed: Some(self.seed),
+            points: self.points,
+            surface: surf.clone(),
+            bounds,
+        })
     }
 
     /// Everything the stroke has touched so far.
@@ -644,49 +655,9 @@ fn pct(p: &Value, k: &str, d: f32) -> f32 {
     num(p, k).unwrap_or(d).clamp(0.0, 100.0) / 100.0
 }
 
+pub mod mixer_live;
 fn mixer_brush(s: &mut Session, p: &Value) -> Result<Value> {
-    let cmd = "paint.mixerBrush";
-    let pts = parse_points(p, cmd)?;
-    let brush = resolve_brush(s, p, cmd)?;
-    // The brush's Mixer Brush options, overridden by the scalar params.
-    let bm = &brush.mixer;
-    let m = MixerSettings {
-        wet: pct(p, "wet", bm.wet * 100.0),
-        load: pct(p, "load", bm.load * 100.0),
-        mix: pct(p, "mix", bm.mix * 100.0),
-        flow: pct(p, "flow", bm.flow * 100.0),
-        sample_all_layers: flag(p, "sampleAllLayers", bm.sample_all_layers),
-        load_after_stroke: flag(p, "loadAfterStroke", bm.load_after_stroke),
-        clean_after_stroke: flag(p, "cleanAfterStroke", bm.clean_after_stroke),
-    };
-    let sample_all = m.sample_all_layers;
-    let paint = color(p.get("color"), s.tools.foreground);
-    let mut state = s.tools.mixer.clone();
-    state.begin_stroke(paint);
-    let id = if crate::channel_cmds::is_channel_target(p) { None } else { Some(layer_id(s, p)?) };
-    let stroke = Stroke { brush, points: pts };
-    let dmg = s.edit("Mixer Brush", |doc, _| {
-        let sel = doc.selection.clone();
-        let sample = if sample_all {
-            let ds = photocraft_paint::dabs(&stroke);
-            let ctx = photocraft_paint::BrushContext::new(&stroke.brush);
-            let area = ds.iter().fold(Rect::EMPTY, |r, d| r.union(&ctx.dab_rect(d, false)));
-            let buf = photocraft_compose::render(doc, area);
-            let mut surf = Surface::new(photocraft_color::PixelFormat::RGBA32F);
-            let flat: Vec<f32> = buf.px.iter().flatten().copied().collect();
-            if !area.is_empty() {
-                surf.write_region(area, &flat);
-            }
-            Some(surf)
-        } else {
-            None
-        };
-        let (surf, lock) = crate::channel_cmds::target_surface(doc, id, p)?;
-        Ok(apply_mixer_stroke(surf, sample.as_ref(), &stroke, &m, &mut state, sel.as_ref(), lock))
-    })?;
-    state.end_stroke(paint, m.clean_after_stroke, m.load_after_stroke);
-    s.tools.mixer = state;
-    Ok(damage_json(s, dmg))
+    mixer_live::run(s, p)
 }
 
 /// `brush.mixer.load`: Load Brush fills the Mixer Brush's reservoir with the color. The next stroke
@@ -1192,10 +1163,18 @@ macro_rules! spec {
 /// Brush command specs.
 pub fn specs() -> Vec<CommandSpec> {
     vec![
+        spec!(
+            "brush.mixer.sample",
+            "Sample Mixer Brush",
+            r#"{"points":[[x,y,pressure?,tiltX?,tiltY?,rotation?]],"sampleAllLayers":bool=brush setting,"size":px?,"target":"pixels"|"mask"|"quickMask"|{"channel":i}}"#,
+            |s| s.active().map(|_| ()).ok_or_else(|| "no document".into()),
+            mixer_live::sample,
+            true
+        ),
         spec!(
             "paint.pencil",
             "Pencil",
-            r##"{"points":[[x,y,pressure?,tiltX?,tiltY?,rotation?,timeMs?,wheel?],…],"brush":{…}?,"preset":name?,"size":0.5..5000 px?,"opacity":0..1?,"color":"#rrggbb"?=foreground,"mode":"normal|multiply|screen|…|clear (erases with this brush)"="normal","erase":bool?,"block":bool=false (a hard 16×16 screen-px square, 16/zoom doc px; size, opacity, flow, hardness and dynamics ignored: the Eraser's Block mode),"zoom":view zoom=1,"autoErase":bool=false,"seed":u64?,"target":"pixels"|"mask"|"quickMask"|{"channel":i}=Channels panel target}"##,
+            r##"{"points":[[x,y,pressure?,tiltX?,tiltY?,rotation?,timeMs?,wheel?],…],"brush":{…}?,"preset":name?,"size":0.5..5000 px?,"opacity":0..1?,"color":"#rrggbb"?=foreground,"mode":"normal|multiply|screen|…|clear (erases with this brush)"="normal","erase":bool?,"block":bool=false (a hard 16×16 screen-px square, 16/zoom doc px; size, opacity, flow, hardness and dynamics ignored: the Eraser's Block mode),"zoom":view zoom=1,"autoErase":bool=false,"seed":u64?,"target":"pixels"|"mask"|"filterMask"|"quickMask"|{"channel":i}=Channels panel target}"##,
             has_paintable,
             pencil,
             true
@@ -1203,7 +1182,7 @@ pub fn specs() -> Vec<CommandSpec> {
         spec!(
             "paint.mixerBrush",
             "Mixer Brush",
-            r##"{"points":[…],"brush":{…}?,"preset":name?,"size":0.5..5000 px?,"wet":0..100=brush.mixer.wet,"load":0..100=brush.mixer.load,"mix":0..100=brush.mixer.mix,"flow":0..100=brush.mixer.flow,"color":"#rrggbb"?=foreground (a color other than the one recorded by the last stroke, load or clean loads it first; a load or clean records the foreground),"sampleAllLayers":bool=brush.mixer.sampleAllLayers,"cleanAfterStroke":bool=brush.mixer.cleanAfterStroke (empty the brush after the stroke),"loadAfterStroke":bool=brush.mixer.loadAfterStroke (load the brush with `color` after the stroke),"seed":u64?}"##,
+            r##"{"points":[…] (long segments are interpolated),"brush":{…}?,"preset":name?,"size":0.5..5000 px?,"wet":0..100=brush.mixer.wet,"load":0..100=brush.mixer.load,"mix":0..100=brush.mixer.mix,"flow":0..100=brush.mixer.flow,"color":"#rrggbb"?=foreground,"sampleAllLayers":bool=brush.mixer.sampleAllLayers,"cleanAfterStroke":bool=brush.mixer.cleanAfterStroke,"loadAfterStroke":bool=brush.mixer.loadAfterStroke,"seed":u64?,"mixerState":{reservoir,amount,pickup,spatial,color} (optional captured replay state; spatial is null or 4096 RGBA colors)}"##,
             has_paintable,
             mixer_brush,
             true
@@ -1252,3 +1231,6 @@ pub fn specs() -> Vec<CommandSpec> {
 
 #[cfg(test)]
 mod tests;
+
+#[cfg(test)]
+mod mixer_live_tests;
diff --git a/crates/engine/src/brush_cmds/mixer_live.rs b/crates/engine/src/brush_cmds/mixer_live.rs
new file mode 100644
index 0000000000..acdd897fd4
--- /dev/null
+++ b/crates/engine/src/brush_cmds/mixer_live.rs
@@ -0,0 +1,457 @@
+//! Incremental Mixer Brush transaction. Source pixels are composed before each dab;
+//! only the selected target changes. Dropping the transaction cancels it.
+use super::*;
+use photocraft_color::{PixelFormat, SampleType};
+use photocraft_doc::{Document, LayerId};
+use photocraft_paint::dynamics::DabGenerator;
+use photocraft_paint::mixer::{MixerState, apply_mixer_dab_region};
+use photocraft_paint::retouch::{Region, mix_back};
+use photocraft_paint::{BrushContext, Dab};
+use std::collections::BTreeSet;
+use std::sync::Arc;
+
+const CMD: &str = "paint.mixerBrush";
+const MAX_TILES: usize = 256;
+/// The largest tip the live preview renders; larger valid tips render on release.
+const PREVIEW_SIZE: f32 = 1024.0;
+const TILE: i32 = 256;
+
+/// Accept bounded finite channels, including HDR values, without admitting unsafe arithmetic inputs.
+fn valid_color(color: &[f32; 4]) -> bool {
+    color.iter().all(|v| v.is_finite() && v.abs() <= 1_000_000.0)
+}
+
+/// Validate finite paint-load values and the exact 64 by 64 shape of a spatial reservoir.
+fn valid_state(state: &MixerState) -> bool {
+    state.amount.is_finite()
+        && state.reservoir.as_ref().is_none_or(valid_color)
+        && state.pickup.as_ref().is_none_or(valid_color)
+        && state.color.as_ref().is_none_or(valid_color)
+        && state.spatial.as_ref().is_none_or(|colors| colors.len() == 4096 && colors.iter().all(valid_color))
+}
+
+#[derive(Clone)]
+struct Core {
+    doc: Arc<Document>,
+    generator: DabGenerator,
+    ctx: BrushContext,
+    pre: Surface,
+    work: Surface,
+    tiles: BTreeSet<(i32, i32)>,
+    preview_limits: bool,
+    state: MixerState,
+    settings: MixerSettings,
+    layer: Option<LayerId>,
+    params: Value,
+    selection: Option<Surface>,
+    lock: bool,
+    color_restrict: Option<usize>,
+    count: usize,
+    last: Option<StrokePoint>,
+    bounds: Rect,
+}
+
+impl Core {
+    /// Apply a batch against evolving working pixels and return its damage bounds.
+    /// Dab, footprint and tile budgets apply only to live previews; the release replays without them.
+    fn apply(&mut self, dabs: &[Dab]) -> Result<Rect> {
+        if self.preview_limits && self.count.saturating_add(dabs.len()) > 250_000 {
+            return Err(bad(CMD, "stroke exceeds 250000 dabs; start another stroke"));
+        }
+        let mut damage = Rect::EMPTY;
+        for dab in dabs {
+            let index = self.count;
+            self.count += 1;
+            let r = self.ctx.dab_rect(dab, false);
+            if r.is_empty() {
+                continue;
+            }
+            let full = self.ctx.dab_rect(dab, false);
+            if self.preview_limits && u64::from(full.width()).saturating_mul(u64::from(full.height())) > 4_194_304 {
+                return Err(bad(CMD, "Mixer Brush footprint exceeds 4194304 pixels"));
+            }
+            // Float working tiles avoid repeated integer-depth quantization. Initialize only
+            // touched tiles, keeping unchanged source tiles shared by the document snapshots.
+            for ty in r.y0.div_euclid(TILE)..=(r.y1 - 1).div_euclid(TILE) {
+                for tx in r.x0.div_euclid(TILE)..=(r.x1 - 1).div_euclid(TILE) {
+                    if !self.tiles.contains(&(tx, ty)) {
+                        if self.preview_limits && self.tiles.len() >= MAX_TILES {
+                            return Err(bad(CMD, "Mixer Brush stroke working set exceeds 256 tiles"));
+                        }
+                        let tile = Rect::new(tx * TILE, ty * TILE, (tx + 1) * TILE, (ty + 1) * TILE);
+                        self.work.write_region(tile, &self.pre.read_region(tile));
+                        self.tiles.insert((tx, ty));
+                    }
+                }
+            }
+            // Render the visible document including the active layer exactly once, before
+            // deposition. Masks, transforms, blend modes and adjustments use the compositor.
+            let sample = self.settings.sample_all_layers.then(|| {
+                let buf = photocraft_compose::render(&self.doc, r);
+                let fmt = self.pre.format();
+                let mut sample = Region::new(r, fmt.channels());
+                for (src, dst) in buf.px.iter().zip(sample.data.chunks_exact_mut(sample.ch)) {
+                    photocraft_raster::from_rgba_into(&fmt, *src, dst);
+                }
+                sample
+            });
+            let fp = self.ctx.footprint(dab, index);
+            let mut region = Region::read(&self.work, r);
+            apply_mixer_dab_region(&mut region, &fp, self.pre.format(), sample.as_ref(), &self.settings, &mut self.state, self.lock);
+            region.write(&mut self.work);
+            let original = Region::read(&self.pre, r);
+            let (target, _) = crate::channel_cmds::target_surface(Arc::make_mut(&mut self.doc), self.layer, &self.params)?;
+            mix_back(target, &original, &region, r, 1.0, self.selection.as_ref(), self.lock);
+            if let Some(k) = self.color_restrict {
+                let n = target.channels();
+                let mut values = target.read_region(r);
+                let before = self.pre.read_region(r);
+                for (new, old) in values.chunks_exact_mut(n).zip(before.chunks_exact(n)) {
+                    for (c, (new, old)) in new.iter_mut().zip(old).enumerate() {
+                        if c != k {
+                            *new = *old;
+                        }
+                    }
+                }
+                target.write_region(r, &values);
+            }
+            damage = damage.union(&r);
+        }
+        self.bounds = self.bounds.union(&damage);
+        Ok(damage)
+    }
+}
+
+/// A real, cancellable paint result, displayed by the existing damage-aware canvas.
+pub struct LiveMixer {
+    pub doc: Arc<Document>,
+    pub seed: u64,
+    core: Core,
+    state: MixerState,
+    tail: Rect,
+    cmyk: Option<Arc<photocraft_color::convert::CmykSpace>>,
+    original: Arc<Document>,
+    points: Vec<StrokePoint>,
+    original_state: MixerState,
+}
+
+impl LiveMixer {
+    /// Capture the current document and paint load, then render the initial samples with live-preview limits.
+    pub fn begin(s: &Session, p: &Value) -> Result<Self> {
+        Self::begin_with_limits(s, p, true)
+    }
+
+    /// Share initialization between live previews and command replay while keeping their tile budgets distinct.
+    fn begin_with_limits(s: &Session, p: &Value, preview_limits: bool) -> Result<Self> {
+        let (mut live, points) = Self::prepare(s, p, preview_limits)?;
+        live.push(&points)?;
+        Ok(live)
+    }
+
+    /// Whether a stroke the live preview refuses only for its tip size still paints on release.
+    /// `Err` when the stroke can't be painted at all (locked layer, bad params...).
+    pub fn defers_to_release(s: &Session, p: &Value) -> Result<bool> {
+        let (live, _) = Self::prepare(s, p, false)?;
+        Ok(live.core.ctx.brush.size > PREVIEW_SIZE)
+    }
+
+    /// Validate the params and capture the document and paint load, without rendering a dab.
+    fn prepare(s: &Session, p: &Value, preview_limits: bool) -> Result<(Self, Vec<StrokePoint>)> {
+        has_paintable(s).map_err(EngineError::Other)?;
+        if preview_limits && p.get("points").and_then(Value::as_array).is_some_and(|v| v.len() > 65_536) {
+            return Err(bad(CMD, "stroke exceeds 65536 recorded input samples"));
+        }
+        let points = parse_points(p, CMD)?;
+        let brush = resolve_brush(s, p, CMD)?;
+        let bm = &brush.mixer;
+        let settings = MixerSettings {
+            wet: pct(p, "wet", bm.wet * 100.0),
+            load: pct(p, "load", bm.load * 100.0),
+            mix: pct(p, "mix", bm.mix * 100.0),
+            flow: pct(p, "flow", bm.flow * 100.0),
+            sample_all_layers: flag(p, "sampleAllLayers", bm.sample_all_layers) && crate::channel_cmds::target_of(p) == crate::channel_cmds::Target::Pixels,
+            clean_after_stroke: flag(p, "cleanAfterStroke", bm.clean_after_stroke),
+            load_after_stroke: flag(p, "loadAfterStroke", bm.load_after_stroke),
+        };
+        let initial_state = if let Some(value) = p.get("mixerState") {
+            if value.get("spatial").and_then(Value::as_array).is_some_and(|v| v.len() != 4096) {
+                return Err(bad(CMD, "spatial reservoir must contain exactly 4096 colors"));
+            }
+            serde_json::from_value::<MixerState>(value.clone()).map_err(|e| bad(CMD, e.to_string()))?
+        } else {
+            s.tools.mixer.clone()
+        };
+        let mut state = initial_state;
+        if !valid_state(&state) {
+            return Err(bad(CMD, "loaded paint must be finite and color magnitudes at most 1000000"));
+        }
+        let paint = color(p.get("color"), s.tools.foreground);
+        if !valid_color(&paint) {
+            return Err(bad(CMD, "loaded color must be finite and magnitudes at most 1000000"));
+        }
+        // Earlier captured replay states had no foreground marker. Keep their loaded paint.
+        if p.get("mixerState").is_some_and(|v| v.get("color").is_none()) && (state.reservoir.is_some() || state.spatial.is_some()) {
+            state.color = Some(paint);
+        }
+        state.begin_stroke(paint);
+        let layer = if crate::channel_cmds::is_channel_target(p) { None } else { Some(layer_id(s, p)?) };
+        let mut doc = (*s.active().ok_or(EngineError::NoDocument)?.doc).clone();
+        let selection = doc.selection.clone();
+        let (target, lock) = crate::channel_cmds::target_surface(&mut doc, layer, p)?;
+        let pre = target.clone();
+        let work = Surface::new(PixelFormat { sample: SampleType::F32, ..pre.format() });
+        let core = Core {
+            doc: Arc::new(doc),
+            generator: DabGenerator::new(&brush, num(p, "zoom").unwrap_or(1.0)),
+            ctx: BrushContext::new(&brush),
+            pre,
+            work,
+            tiles: BTreeSet::new(),
+            preview_limits,
+            state: state.clone(),
+            settings,
+            layer,
+            params: p.clone(),
+            selection,
+            lock,
+            color_restrict: crate::channel_cmds::color_restriction(s, CMD, p),
+            count: 0,
+            last: None,
+            bounds: Rect::EMPTY,
+        };
+        // Checked last, so a tip that is too big is the only reason left (`defers_to_release`),
+        // and before `push` allocates a dense brush footprint.
+        if preview_limits && core.ctx.brush.size > PREVIEW_SIZE {
+            return Err(bad(CMD, "the live Mixer Brush preview is limited to 1024 px tips"));
+        }
+        let live = Self {
+            doc: core.doc.clone(),
+            seed: brush.seed,
+            core,
+            state,
+            tail: Rect::EMPTY,
+            cmyk: doc_cmyk_space(s),
+            original: s.active().ok_or(EngineError::NoDocument)?.doc.clone(),
+            points: Vec::new(),
+            original_state: s.tools.mixer.clone(),
+        };
+        Ok((live, points))
+    }
+
+    /// Return all damaged pixels, including the provisional smoothing tail currently shown by the preview.
+    pub fn bounds(&self) -> Rect {
+        self.core.bounds.union(&self.tail)
+    }
+    /// Whether the dab generator needs stationary time samples, as for a continuing airbrush stroke.
+    pub fn wants_time(&self) -> bool {
+        self.core.generator.wants_time()
+    }
+
+    /// Batches and individual input samples produce identical results. The speculative end
+    /// dab / smoothing tail is displayed but never fed into the next accepted input.
+    pub fn push(&mut self, points: &[StrokePoint]) -> Result<Rect> {
+        check_coords(points, CMD)?;
+        if self.core.preview_limits && self.points.len().saturating_add(points.len()) > 65_536 {
+            return Err(bad(CMD, "stroke exceeds 65536 recorded input samples"));
+        }
+        let cmyk = self.cmyk.clone();
+        photocraft_color::convert::with_cmyk_space(cmyk.as_ref(), || {
+            let old_tail = self.tail;
+            let mut damage = Rect::EMPTY;
+            for point in points {
+                // Bound each temporary dab batch without rejecting sparse mouse events or
+                // long Shift-click lines. Live and recorded replay use identical interpolation.
+                let start = self.core.last.unwrap_or(*point);
+                let steps = ((point.x - start.x).hypot(point.y - start.y) / 2048.0).ceil().max(1.0) as usize;
+                for step in 1..=steps {
+                    let f = step as f64 / steps as f64;
+                    let ff = f as f32;
+                    let q = if step == steps {
+                        *point
+                    } else {
+                        StrokePoint {
+                            x: start.x + (point.x - start.x) * f,
+                            y: start.y + (point.y - start.y) * f,
+                            pressure: start.pressure + (point.pressure - start.pressure) * ff,
+                            tilt_x: start.tilt_x + (point.tilt_x - start.tilt_x) * ff,
+                            tilt_y: start.tilt_y + (point.tilt_y - start.tilt_y) * ff,
+                            rotation: start.rotation + (point.rotation - start.rotation) * ff,
+                            wheel: start.wheel + (point.wheel - start.wheel) * ff,
+                            time: start.time + (point.time - start.time) * f,
+                        }
+                    };
+                    let (mut dabs, mut dual) = (Vec::new(), Vec::new());
+                    self.core.generator.push(&[q], &mut dabs, &mut dual);
+                    damage = damage.union(&self.core.apply(&dabs)?);
+                }
+                self.core.last = Some(*point);
+            }
+            let mut finished = self.core.clone();
+            let (mut dabs, mut dual) = (Vec::new(), Vec::new());
+            finished.generator.finish(&mut dabs, &mut dual);
+            self.tail = finished.apply(&dabs)?;
+            self.doc = finished.doc;
+            self.state = finished.state;
+            self.points.extend_from_slice(points);
+            Ok(damage.union(&old_tail).union(&self.tail))
+        })
+    }
+
+    /// Keep the same compact journal params as other paint tools: UI settings, points and seed.
+    fn commit_params(&self) -> Result<Value> {
+        let mut params = self.core.params.clone();
+        params["points"] = serde_json::to_value(&self.points).map_err(|e| bad(CMD, e.to_string()))?;
+        params["seed"] = json!(self.seed);
+        Ok(params)
+    }
+
+    /// Stage the already rendered pixels for the ordinary journaled command. Refuse stale
+    /// document/tool state. The command consumes this single-use cache only for identical params.
+    pub fn prepare_commit(self, session: &mut Session) -> Result<Value> {
+        if !session.active().is_some_and(|st| Arc::ptr_eq(&st.doc, &self.original) && (self.core.layer.is_none() || st.active_layer == self.core.layer))
+            || session.tools.mixer != self.original_state
+        {
+            return Err(bad(CMD, "document or loaded paint changed during the stroke"));
+        }
+        let params = self.commit_params()?;
+        let base = session.active().map(|st| (st.doc.id, st.revision)).ok_or(EngineError::NoDocument)?;
+        let bounds = self.bounds();
+        let mut doc = (*self.doc).clone();
+        let surface = crate::channel_cmds::target_surface(&mut doc, self.core.layer, &params)?.0.clone();
+        let mut after = self.state;
+        after.end_stroke(self.core.ctx.brush.color, self.core.settings.clean_after_stroke, self.core.settings.load_after_stroke);
+        session.live_commit = Some(LiveCommit {
+            cmd: CMD.into(),
+            base,
+            params: params.clone(),
+            seed: Some(self.seed),
+            points: self.points,
+            surface,
+            bounds,
+            mixer: Some((self.original_state, after)),
+        });
+        Ok(params)
+    }
+}
+
+/// Consume a matching prepared result or replay without the preview tile cap, then commit one history step.
+/// The completed stroke also applies the automatic clean/load settings to the stored paint load.
+pub(super) fn run(s: &mut Session, p: &Value) -> Result<Value> {
+    let points = parse_points(p, CMD)?;
+    let cached =
+        s.live_commit.take().filter(|live| live.matches(s, CMD, p, &points) && live.mixer.as_ref().is_some_and(|(before, _)| *before == s.tools.mixer));
+    if let Some(live) = cached {
+        let id = if crate::channel_cmds::is_channel_target(p) { None } else { Some(layer_id(s, p)?) };
+        s.edit("Mixer Brush", |doc, _| {
+            *crate::channel_cmds::target_surface(doc, id, p)?.0 = live.surface;
+            Ok(())
+        })?;
+        if let Some((_, after)) = live.mixer {
+            s.tools.mixer = after;
+        }
+        let mut result = damage_json(s, live.bounds);
+        result["fromLive"] = json!(true);
+        return Ok(result);
+    }
+    let live = LiveMixer::begin_with_limits(s, p, false)?;
+    let damage = live.bounds();
+    s.edit("Mixer Brush", |doc, _| {
+        *doc = (*live.doc).clone();
+        Ok(())
+    })?;
+    let mut state = live.state;
+    let paint = live.core.ctx.brush.color;
+    state.end_stroke(paint, live.core.settings.clean_after_stroke, live.core.settings.load_after_stroke);
+    s.tools.mixer = state;
+    Ok(damage_json(s, damage))
+}
+
+/// Sampling changes only session tool state, never document pixels or document Undo.
+pub(super) fn sample(s: &mut Session, p: &Value) -> Result<Value> {
+    if p.get("points").and_then(Value::as_array).is_some_and(|v| v.len() != 1) {
+        return Err(bad("brush.mixer.sample", "exactly one sample point is required"));
+    }
+    let points = parse_points(p, "brush.mixer.sample")?;
+    if points.len() != 1 {
+        return Err(bad("brush.mixer.sample", "exactly one sample point is required"));
+    }
+    let mut brush = resolve_brush(s, p, "brush.mixer.sample")?;
+    if brush.size > 1024.0 {
+        return Err(bad("brush.mixer.sample", "sampling size is limited to 1024 pixels"));
+    }
+    brush.flow = 1.0;
+    let dabs = photocraft_paint::dabs(&Stroke { brush: brush.clone(), points });
+    let dab = dabs.first().ok_or_else(|| bad("brush.mixer.sample", "brush has no contact"))?;
+    let ctx = BrushContext::new(&brush);
+    let rect = ctx.dab_rect(dab, false);
+    if u64::from(rect.width()).saturating_mul(u64::from(rect.height())) > 4_194_304 {
+        return Err(bad("brush.mixer.sample", "sampling footprint is too large"));
+    }
+    let fp = ctx.footprint(dab, 0);
+    let st = s.active().ok_or(EngineError::NoDocument)?;
+    let mut doc = crate::float_cmds::displayed(st, (0, 0)).unwrap_or_else(|| (*st.doc).clone());
+    let id = if crate::channel_cmds::is_channel_target(p) { None } else { Some(layer_id(s, p)?) };
+    let cmyk = doc_cmyk_space(s);
+    let load = photocraft_color::convert::with_cmyk_space(cmyk.as_ref(), || -> Result<Vec<[f32; 4]>> {
+        let surface = if flag(p, "sampleAllLayers", brush.mixer.sample_all_layers) && crate::channel_cmds::target_of(p) == crate::channel_cmds::Target::Pixels {
+            let buf = photocraft_compose::render(&doc, rect);
+            let mut surface = Surface::new(PixelFormat::RGBA32F);
+            surface.write_region(rect, &buf.px.iter().flatten().copied().collect::<Vec<_>>());
+            surface
+        } else if crate::channel_cmds::target_of(p) == crate::channel_cmds::Target::Pixels {
+            id.and_then(|id| doc.layer(id))
+                .and_then(|layer| layer.surface())
+                .cloned()
+                .ok_or_else(|| bad("brush.mixer.sample", "current layer has no raster pixels to sample"))?
+        } else {
+            crate::channel_cmds::target_surface(&mut doc, id, p)?.0.clone()
+        };
+        let mut load = Vec::with_capacity(4096);
+        let (sin, cos) = dab.angle.sin_cos();
+        for row in 0..64 {
+            for col in 0..64 {
+                let mut u = ((col as f32 + 0.5) / 32.0 - 1.0) * dab.radius;
+                let mut v = ((row as f32 + 0.5) / 32.0 - 1.0) * (dab.radius * dab.roundness).max(0.5);
+                if dab.flip_x {
+                    u = -u;
+                }
+                if dab.flip_y {
+                    v = -v;
+                }
+                let (mut dx, mut up) = (u * cos + v * sin, u * sin - v * cos);
+                if dab.proj_scale < 0.999 {
+                    let (sin, cos) = dab.proj_angle.sin_cos();
+                    let along = (dx * cos + up * sin) * (dab.proj_scale.max(0.05) - 1.0);
+                    dx += along * cos;
+                    up += along * sin;
+                }
+                let x = (dab.center.x as f32 + dx).floor() as i32;
+                let y = (dab.center.y as f32 - up).floor() as i32;
+                let mut color = surface.rgba(x, y);
+                let coverage = if x >= fp.rect.x0 && x < fp.rect.x1 && y >= fp.rect.y0 && y < fp.rect.y1 { fp.at(x, y) } else { 0.0 };
+                color[3] *= coverage.clamp(0.0, 1.0);
+                load.push(color);
+            }
+        }
+        Ok(load)
+    })?;
+    let mut average = [0.0f32; 4];
+    for c in &load {
+        for k in 0..3 {
+            average[k] += c[k] * c[3];
+        }
+        average[3] += c[3];
+    }
+    if average[3] <= 0.0 {
+        return Err(bad("brush.mixer.sample", "the sampled area contains no paint; the previous brush load is unchanged"));
+    }
+    for k in 0..3 {
+        average[k] /= average[3];
+    }
+    average[3] = 1.0;
+    s.tools.mixer.load(average);
+    s.tools.mixer.spatial = Some(load);
+    s.tools.mixer.pickup = None;
+    s.tools.mixer.color = Some(s.tools.foreground);
+    Ok(json!({"width":64,"height":64,"color":average}))
+}
diff --git a/crates/engine/src/brush_cmds/mixer_live_tests.rs b/crates/engine/src/brush_cmds/mixer_live_tests.rs
new file mode 100644
index 0000000000..d0c04c30e3
--- /dev/null
+++ b/crates/engine/src/brush_cmds/mixer_live_tests.rs
@@ -0,0 +1,416 @@
+use super::mixer_live::LiveMixer;
+use super::*;
+use photocraft_color::PixelFormat;
+use std::sync::Arc;
+
+/// Build format-specific red/green sampling layers and an empty painting target.
+fn fixture(fmt: PixelFormat) -> Session {
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width":192,"height":96,"background":"#808080"})).unwrap();
+    s.execute("layer.new.layer", json!({"name":"Source"})).unwrap();
+    s.edit("fixture", |doc, id| {
+        let (surface, _) = crate::channel_cmds::target_surface(doc, *id, &json!({}))?;
+        *surface = Surface::new(fmt);
+        surface.fill_rect(Rect::new(0, 0, 96, 96), &[1.0, 0.0, 0.0, 1.0]);
+        surface.fill_rect(Rect::new(96, 0, 192, 96), &[0.0, 1.0, 0.0, 1.0]);
+        Ok(())
+    })
+    .unwrap();
+    s.execute("layer.new.layer", json!({"name":"Paint"})).unwrap();
+    s.edit("depth", |doc, id| {
+        *crate::channel_cmds::target_surface(doc, *id, &json!({}))?.0 = Surface::new(fmt);
+        Ok(())
+    })
+    .unwrap();
+    s.tools.brush.mixer.sample_all_layers = true;
+    s
+}
+
+/// Snapshot the active raster target for exact pixel comparisons without borrowing the session.
+fn target(s: &Session) -> Surface {
+    let st = s.active().unwrap();
+    st.doc.layer(st.active_layer.unwrap()).unwrap().surface().unwrap().clone()
+}
+
+/// All-layer previews match replay and Undo exactly across supported depths without editing source layers.
+#[test]
+fn mixer_live_empty_layer_exact_commit_undo_source_preservation_and_chunking() {
+    for fmt in [PixelFormat::RGBA8, PixelFormat::RGBA16, PixelFormat::RGBA32F] {
+        let mut s = fixture(fmt);
+        assert!(s.tools.brush.mixer.sample_all_layers);
+        let before = s.active().unwrap().doc.clone();
+        let params = json!({"points":[[40,48]],"seed":47,"size":24,"wet":100,"mix":100,"cleanAfterStroke":false});
+        let mut live = LiveMixer::begin(&s, &params).unwrap();
+        let id = s.active().unwrap().active_layer.unwrap();
+        assert!(live.doc.layer(id).unwrap().surface().unwrap().rgba(40, 48)[3] > 0.0);
+        assert_eq!(target(&s).rgba(40, 48)[3], 0.0, "preview must not edit the session");
+        let mut points = vec![StrokePoint::new(40.0, 48.0, 1.0)];
+        for x in [56.0, 72.0, 88.0, 104.0, 120.0, 136.0, 152.0] {
+            let p = StrokePoint::new(x, 48.0, 1.0);
+            live.push(&[p]).unwrap();
+            points.push(p);
+        }
+        let preview = live.doc.layer(id).unwrap().surface().unwrap().clone();
+        let mut full = params.clone();
+        full["points"] = json!(points);
+        s.execute("paint.mixerBrush", full).unwrap();
+        assert_eq!(preview.read_region(before.bounds()), target(&s).read_region(before.bounds()), "live/replay tolerance is exactly zero");
+        for old in &before.layers {
+            if old.id != id {
+                assert_eq!(
+                    old.surface().unwrap().read_region(before.bounds()),
+                    s.active().unwrap().doc.layer(old.id).unwrap().surface().unwrap().read_region(before.bounds())
+                );
+            }
+        }
+        s.execute("edit.undo", json!({})).unwrap();
+        assert_eq!(target(&s).read_region(before.bounds()), before.layer(id).unwrap().surface().unwrap().read_region(before.bounds()));
+        s.execute("edit.redo", json!({})).unwrap();
+        assert_eq!(target(&s).read_region(before.bounds()), preview.read_region(before.bounds()));
+    }
+}
+
+/// Current-layer mixing matches the frozen kernel; dropping a preview and cleaning the load paint nothing.
+#[test]
+fn mixer_live_current_layer_matches_reference_and_cancels() {
+    let mut s = fixture(PixelFormat::RGBA32F);
+    let p = json!({"points":[[30,30],[60,34],[100,60]],"seed":9,"size":16,"sampleAllLayers":false,"wet":65,"mix":70,"load":90});
+    let mut expected = target(&s);
+    let brush = resolve_brush(&s, &p, "paint.mixerBrush").unwrap();
+    let mut state = photocraft_paint::mixer::MixerState::default();
+    state.load(s.tools.foreground);
+    photocraft_paint::mixer::apply_mixer_stroke(
+        &mut expected,
+        None,
+        &Stroke { brush, points: parse_points(&p, "paint.mixerBrush").unwrap() },
+        &MixerSettings { wet: 0.65, mix: 0.70, load: 0.90, sample_all_layers: false, ..Default::default() },
+        &mut state,
+        None,
+        false,
+    );
+    let live = LiveMixer::begin(&s, &p).unwrap();
+    let id = s.active().unwrap().active_layer.unwrap();
+    let actual = live.doc.layer(id).unwrap().surface().unwrap().read_region(s.active().unwrap().doc.bounds());
+    let expected = expected.read_region(s.active().unwrap().doc.bounds());
+    let max = actual.iter().zip(expected).map(|(a, b)| (a - b).abs()).fold(0.0f32, f32::max);
+    assert!(max <= 1e-6, "reference error {max}");
+    drop(live);
+    assert_eq!(target(&s).rgba(30, 30)[3], 0.0);
+    s.execute("brush.mixer.clean", json!({})).unwrap();
+    s.execute("paint.mixerBrush", json!({"points":[[30,30],[60,30]],"sampleAllLayers":false,"wet":0})).unwrap();
+    assert_eq!(target(&s).rgba(30, 30)[3], 0.0, "clean brush must stay empty");
+}
+
+/// Sampling retains a spatial two-color load while leaving document pixels and history alone.
+#[test]
+fn mixer_sample_is_spatial_and_never_edits_document() {
+    let mut s = fixture(PixelFormat::RGBA8);
+    let before = s.active().unwrap().doc.clone();
+    s.execute("brush.mixer.sample", json!({"points":[[96,48]],"size":40,"brush":{"hardness":1.0,"pressureSize":false}})).unwrap();
+    assert!(std::sync::Arc::ptr_eq(&before, &s.active().unwrap().doc));
+    let load = s.tools.mixer.spatial.as_ref().unwrap();
+    assert_eq!(load.len(), 4096);
+    assert!(load.iter().any(|p| p[0] > 0.9 && p[1] < 0.1 && p[3] > 0.9));
+    assert!(load.iter().any(|p| p[1] > 0.9 && p[0] < 0.1 && p[3] > 0.9));
+    s.execute("paint.mixerBrush", json!({"points":[[48,48]],"size":40,"wet":0,"mix":0,"brush":{"hardness":1.0,"pressureSize":false}})).unwrap();
+    assert!(target(&s).rgba(40, 48)[0] > 0.9);
+    assert!(target(&s).rgba(56, 48)[1] > 0.9);
+    assert!(s.tools.mixer.spatial.is_some(), "sample persists across strokes");
+}
+
+/// Smoothing tails match replay and invalid input cannot mutate the last valid preview.
+#[test]
+fn mixer_live_smoothing_tail_and_invalid_input() {
+    let mut s = fixture(PixelFormat::RGBA16);
+    let p = json!({"points":[[20,40]],"size":12,"seed":42,"brush":{"smoothing":{"amount":0.6,"catchUpOnEnd":true}}});
+    let mut live = LiveMixer::begin(&s, &p).unwrap();
+    live.push(&[StrokePoint::new(60.0, 40.0, 0.6)]).unwrap();
+    live.push(&[StrokePoint::new(100.0, 48.0, 1.0)]).unwrap();
+    let before = live.doc.clone();
+    assert!(live.push(&[StrokePoint::new(f64::NAN, 0.0, 1.0)]).is_err());
+    assert!(std::sync::Arc::ptr_eq(&before, &live.doc));
+    let mut commit = p.clone();
+    commit["points"] = json!([[20, 40, 1], [60, 40, 0.6], [100, 48, 1]]);
+    s.execute("paint.mixerBrush", commit).unwrap();
+    let id = s.active().unwrap().active_layer.unwrap();
+    assert_eq!(
+        live.doc.layer(id).unwrap().surface().unwrap().read_region(s.active().unwrap().doc.bounds()),
+        target(&s).read_region(s.active().unwrap().doc.bounds())
+    );
+    assert!(s.execute("paint.mixerBrush", json!({"points":[[0,0]],"size":5001})).is_err());
+    assert!(s.execute("brush.mixer.sample", json!({"points":[[0,0],[1,1]]})).is_err());
+}
+
+/// Composite sampling honors source masks and blending while current-layer mode ignores lower paint.
+#[test]
+fn mixer_sampling_obeys_masks_opacity_blend_and_current_layer_switch() {
+    let mut s = fixture(PixelFormat::RGBA8);
+    let source = s.active().unwrap().doc.layers.iter().find(|l| l.name == "Source").unwrap().id;
+    s.edit("source composition", |doc, _| {
+        let layer = doc.layer_mut(source).unwrap();
+        layer.opacity = 0.4;
+        layer.blend = photocraft_color::BlendMode::Multiply;
+        layer.mask = Some(photocraft_doc::LayerMask::hide_all());
+        Ok(())
+    })
+    .unwrap();
+    let expected = photocraft_compose::render(&s.active().unwrap().doc, Rect::new(39, 39, 40, 40)).px[0];
+    s.execute("brush.mixer.sample", json!({"points":[[40,40]],"size":8})).unwrap();
+    let actual = s.tools.mixer.reservoir.unwrap();
+    for c in 0..3 {
+        assert!((actual[c] - expected[c]).abs() < 1e-5);
+    }
+    s.execute("brush.mixer.clean", json!({})).unwrap();
+    s.execute("paint.mixerBrush", json!({"points":[[40,40],[80,40]],"size":8,"wet":100,"mix":100,"sampleAllLayers":false})).unwrap();
+    assert_eq!(target(&s).rgba(50, 40)[3], 0.0, "current empty layer provides no paint");
+    s.execute("paint.mixerBrush", json!({"points":[[40,40],[80,40]],"size":8,"wet":100,"mix":100,"sampleAllLayers":true})).unwrap();
+    assert!(target(&s).rgba(50, 40)[3] > 0.9, "all layers supplies the visible composite");
+}
+
+/// Later overlapping dabs pick up freshly deposited paint from the live composite.
+#[test]
+fn mixer_overlapping_dabs_resample_the_evolving_composite() {
+    let mut s = fixture(PixelFormat::RGBA32F);
+    s.execute("tools.setColors", json!({"foreground":"#0000ff"})).unwrap();
+    let params = json!({"points":[[50,48]],"size":20,"seed":1,"wet":100,"mix":50,"cleanAfterStroke":false});
+    let mut live = LiveMixer::begin(&s, &params).unwrap();
+    live.push(&[StrokePoint::new(54.0, 48.0, 1.0), StrokePoint::new(50.0, 48.0, 1.0)]).unwrap();
+    let id = s.active().unwrap().active_layer.unwrap();
+    let pixel = live.doc.layer(id).unwrap().surface().unwrap().rgba(50, 48);
+    assert!(pixel[2] > 0.5, "deposited blue feeds back into later pickups: {pixel:?}");
+}
+
+/// The shared live commit keeps shown pixels and one Undo step, refusing stale document snapshots.
+#[test]
+fn mixer_prepared_commit_uses_displayed_pixels_and_rejects_stale_documents() {
+    let mut s = fixture(PixelFormat::RGBA8);
+    let p = json!({"points":[[20,40]],"size":16,"target":"pixels","seed":55});
+    let mut live = LiveMixer::begin(&s, &p).unwrap();
+    live.push(&[StrokePoint::new(80.0, 40.0, 0.6)]).unwrap();
+    let shown = live.doc.clone();
+    let id = s.active().unwrap().active_layer.unwrap();
+    let steps = s.active().unwrap().history.past_len();
+    let commit = live.prepare_commit(&mut s).unwrap();
+    assert!(s.live_commit.is_some());
+    s.execute("paint.mixerBrush", commit.clone()).unwrap();
+    assert!(s.live_commit.is_none());
+    assert_eq!(s.active().unwrap().history.past_len(), steps + 1);
+    assert_eq!(target(&s).read_region(shown.bounds()), shown.layer(id).unwrap().surface().unwrap().read_region(shown.bounds()));
+    s.execute("edit.undo", json!({})).unwrap();
+    s.execute("paint.mixerBrush", commit).unwrap();
+    assert_eq!(target(&s).read_region(shown.bounds()), shown.layer(id).unwrap().surface().unwrap().read_region(shown.bounds()));
+    let stale = LiveMixer::begin(&s, &p).unwrap();
+    s.execute("layer.new.layer", json!({})).unwrap();
+    assert!(stale.prepare_commit(&mut s).is_err());
+}
+
+/// Load and clean affect tool state without dropping a floating selection or creating document history.
+#[test]
+fn mixer_load_commands_preserve_floating_selection_and_history() {
+    let mut s = fixture(PixelFormat::RGBA8);
+    s.execute("select.all", json!({})).unwrap();
+    s.execute("select.float", json!({"dx":8,"dy":0,"copy":true})).unwrap();
+    let doc = s.active().unwrap().doc.clone();
+    let steps = s.active().unwrap().history.past_len();
+    for (command, params) in [("brush.mixer.sample", json!({"points":[[96,48]],"size":24})), ("brush.mixer.load", json!({})), ("brush.mixer.clean", json!({}))]
+    {
+        s.execute(command, params).unwrap();
+        assert!(std::sync::Arc::ptr_eq(&doc, &s.active().unwrap().doc));
+        assert_eq!(s.active().unwrap().history.past_len(), steps);
+        assert!(crate::float_cmds::floating(s.active().unwrap()).is_some());
+    }
+}
+
+/// Malformed reservoir input is rejected and automatic reload follows the selected setting.
+#[test]
+fn mixer_rejects_malformed_load_and_retains_or_reloads_paint() {
+    let mut s = fixture(PixelFormat::RGBA8);
+    let before = s.active().unwrap().doc.clone();
+    for state in [json!({"spatial":[]}), json!({"spatial":[[1,0,0,1]]}), json!({"amount":"bad"}), json!({"reservoir":[1e300,0,0,1]})] {
+        assert!(s.execute("paint.mixerBrush", json!({"points":[[40,40]],"mixerState":state})).is_err());
+        assert!(std::sync::Arc::ptr_eq(&before, &s.active().unwrap().doc));
+    }
+    assert!(s.execute("brush.mixer.load", json!({"color":[1e300,0,0,1]})).is_err());
+    s.execute("brush.mixer.load", json!({"color":"#ff0000"})).unwrap();
+    s.execute("paint.mixerBrush", json!({"points":[[40,40],[80,40]],"size":10,"loadAfterStroke":false,"cleanAfterStroke":false,"load":10})).unwrap();
+    assert!(s.tools.mixer.amount > 0.0 && s.tools.mixer.amount < 1.0);
+    s.execute("paint.mixerBrush", json!({"points":[[40,40],[80,40]],"size":10,"loadAfterStroke":true,"load":10})).unwrap();
+    assert_eq!(s.tools.mixer.amount, 1.0);
+}
+
+/// Large tips keep off-canvas layer pixels and commit the exact preview with reversible history.
+#[test]
+fn mixer_large_tip_retains_off_canvas_paint_and_commits_the_live_result() {
+    let mut s = fixture(PixelFormat::RGBA8);
+    let source = s.active().unwrap().doc.clone();
+    let params = json!({"points":[[96,48]],"size":1024,"wet":0,"mix":0,"color":"#1122ee","brush":{"pressureSize":false}});
+    let live = LiveMixer::begin(&s, &params).unwrap();
+    let id = s.active().unwrap().active_layer.unwrap();
+    let shown = live.doc.layer(id).unwrap().surface().unwrap().clone();
+    assert!(shown.rgba(-100, 48)[3] > 0.99, "off-canvas layer pixels remain paintable");
+    let params = live.prepare_commit(&mut s).unwrap();
+    s.execute("paint.mixerBrush", params).unwrap();
+    assert_eq!(target(&s), shown);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(*s.active().unwrap().doc, *source);
+}
+
+/// Large pointer jumps must replay identically instead of turning a valid stroke into an input-limit error.
+#[test]
+fn mixer_long_segments_are_interpolated_and_replay_matches_live() {
+    let mut s = fixture(PixelFormat::RGBA8);
+    let p = json!({"points":[[20,48],[5020,48]],"seed":71,"size":2,"sampleAllLayers":false,"wet":0,"mix":0,"load":100,"color":"#ff0000"});
+    let live = LiveMixer::begin(&s, &p).unwrap();
+    let id = s.active().unwrap().active_layer.unwrap();
+    let expected = live.doc.layer(id).unwrap().surface().unwrap().clone();
+    s.execute("paint.mixerBrush", p).unwrap();
+    for x in [20, 1020, 2068, 4090, 5019] {
+        assert_eq!(target(&s).rgba(x, 48), expected.rgba(x, 48));
+        assert!(target(&s).rgba(x, 48)[3] > 0.0);
+    }
+}
+
+/// Authorization, validation, unknown commands and missing targets all discard the single-use offer.
+#[test]
+fn mixer_prepared_offer_is_dropped_on_every_early_dispatch_failure() {
+    for failure in 0..4 {
+        let mut s = fixture(PixelFormat::RGBA8);
+        let live = LiveMixer::begin(&s, &json!({"points":[[20,20]],"size":4})).unwrap();
+        let p = live.prepare_commit(&mut s).unwrap();
+        let before = s.active().unwrap().doc.clone();
+        let result = match failure {
+            0 => {
+                s.authorize = Some(|_, _| Err(EngineError::Other("denied".into())));
+                s.execute("paint.mixerBrush", p)
+            }
+            1 => s.execute("paint.mixerBrush", json!("invalid params")),
+            2 => s.execute("unknown.command", p),
+            _ => {
+                s.active_mut().unwrap().active_layer = None;
+                s.execute("paint.mixerBrush", p)
+            }
+        };
+        assert!(result.is_err());
+        assert!(s.live_commit.is_none(), "failed dispatch retained the preview: {failure}");
+        assert!(Arc::ptr_eq(&s.active().unwrap().doc, &before));
+    }
+}
+
+/// A stroke beyond the live tile budget still renders on command replay and remains undoable.
+#[test]
+fn mixer_command_outgrows_the_preview_tile_budget_without_losing_the_stroke() {
+    let mut s = fixture(PixelFormat::RGBA8);
+    let points: Vec<_> = (0..257).map(|i| [128.0 + (i % 17) as f64 * 512.0, 128.0 + (i / 17) as f64 * 512.0]).collect();
+    let p = json!({"points":points,"size":2,"brush":{"spacing":10.0,"smoothing":{"amount":0.0}},"seed":44,
+        "sampleAllLayers":false,"wet":0,"mix":0,"load":100,"color":"#ff0000"});
+    let before = s.active().unwrap().doc.clone();
+    let err = LiveMixer::begin(&s, &p).err().expect("bounded preview");
+    assert!(err.to_string().contains("256 tiles"), "{err}");
+    assert!(Arc::ptr_eq(&s.active().unwrap().doc, &before));
+    s.execute("paint.mixerBrush", p).unwrap();
+    // Spacing deliberately leaves gaps; inspect the final tile's stroke region instead
+    // of assuming the exact release pixel is a dab center.
+    let end = Rect::new(600, 7776, 672, 7840);
+    assert!(target(&s).read_region(end).as_chunks::<4>().0.iter().any(|px| px[3] > 0.0));
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(target(&s).read_region(end).as_chunks::<4>().0.iter().all(|px| px[3] == 0.0));
+}
+
+/// An empty sample reports an error while retaining the previous paint load and document.
+#[test]
+fn mixer_empty_samples_preserve_the_previous_load_and_document() {
+    let mut s = fixture(PixelFormat::RGBA8);
+    s.execute("brush.mixer.sample", json!({"points": [[96,48]], "size": 40})).unwrap();
+    let state = s.tools.mixer.clone();
+    let doc = s.active().unwrap().doc.clone();
+    for params in [json!({"points": [[20,20]], "size": 8, "sampleAllLayers": false}), json!({"points": [[-100,-100]], "size": 8, "sampleAllLayers": true})] {
+        let error = s.execute("brush.mixer.sample", params).unwrap_err().to_string();
+        assert!(error.contains("contains no paint"), "{error}");
+        assert_eq!(s.tools.mixer, state);
+        assert!(Arc::ptr_eq(&s.active().unwrap().doc, &doc));
+    }
+}
+
+/// Rotating a hard round sampling grid must give zero coverage beyond the footprint, not panic.
+#[test]
+fn mixer_rotated_hard_tip_samples_safely_and_preserves_the_document() {
+    for angle in [45.0, -45.0, 135.0] {
+        let mut s = fixture(PixelFormat::RGBA8);
+        s.execute("tools.setBrush", json!({"brush":{"size":40,"angle":angle,"hardness":1.0,"pressureSize":false}})).unwrap();
+        let before = s.active().unwrap().doc.clone();
+        s.execute("brush.mixer.sample", json!({"points":[[48,48]]})).unwrap();
+        let load = s.tools.mixer.spatial.as_ref().unwrap();
+        assert_eq!(load.len(), 4096);
+        assert!(load.iter().any(|c| c[3] == 0.0));
+        assert!(load.iter().any(|c| c[0] > 0.9 && c[3] > 0.9));
+        assert!(Arc::ptr_eq(&before, &s.active().unwrap().doc));
+    }
+}
+
+/// The default stays current-layer-only; all-layer sampling is an explicit user choice.
+#[test]
+fn mixer_default_does_not_sample_other_layers() {
+    assert!(!MixerSettings::default().sample_all_layers);
+    assert!(!Session::new().tools.brush.mixer.sample_all_layers);
+}
+
+/// Large session tips and spatial reservoirs stay out of each journaled stroke.
+#[test]
+fn mixer_shared_live_commit_keeps_the_journal_compact() {
+    let mut s = fixture(PixelFormat::RGBA8);
+    s.execute("brush.mixer.sample", json!({"points":[[96,48]],"size":40})).unwrap();
+    s.tools.brush.tip = TipShape::Sampled(GrayTile::from_fn(256, 256, |_, _| 1.0));
+    for x in [40.0, 60.0, 80.0] {
+        let p = json!({"points":[[x,48]],"size":12,"seed":7,"wet":0,"mix":0});
+        let live = LiveMixer::begin(&s, &p).unwrap();
+        let id = s.active().unwrap().active_layer.unwrap();
+        let shown = live.doc.layer(id).unwrap().surface().unwrap().clone();
+        let params = live.prepare_commit(&mut s).unwrap();
+        assert!(s.live_commit.is_some());
+        let result = s.execute("paint.mixerBrush", params).unwrap();
+        assert_eq!(result["fromLive"], true);
+        assert_eq!(target(&s), shown);
+        assert!(s.live_commit.is_none());
+        let params = &s.journal.last().unwrap().1;
+        for field in ["brush", "mixerState", "color"] {
+            assert!(params.get(field).is_none(), "{field}");
+        }
+        assert!(serde_json::to_vec(params).unwrap().len() < 1024);
+    }
+}
+
+/// Preview limits never reject valid command sizes, including the maximum session size.
+#[test]
+fn mixer_large_brushes_replay_after_the_preview_budget() {
+    for (size, pressure) in [(2000, 1.0), (5000, 1.0)] {
+        let mut s = fixture(PixelFormat::RGBA8);
+        let before = s.active().unwrap().doc.clone();
+        let params = json!({"points":[[96,48,pressure]],"size":size,"wet":0,"mix":0,"sampleAllLayers":false,
+            "color":"#ff0000","brush":{"pressureSize":true,"hardness":1.0}});
+        assert!(LiveMixer::begin(&s, &params).is_err());
+        s.execute("paint.mixerBrush", params).unwrap();
+        assert!(target(&s).rgba(96, 48)[0] > 0.9);
+        s.execute("edit.undo", json!({})).unwrap();
+        assert_eq!(*s.active().unwrap().doc, *before);
+    }
+}
+
+/// Long strokes past the live preview's sample and dab budgets still render on command replay
+/// (Stroke Path with Simulate Pressure sends up to 200,000 samples), as main painted them.
+#[test]
+fn mixer_command_paints_strokes_beyond_the_preview_sample_and_dab_budgets() {
+    // 70,000 samples a pixel apart (above 65,536), or 2,000 samples 170 px apart (about 340,000 dabs).
+    for (count, step, budget) in [(70_000, 1, "65536"), (2_000, 170, "250000 dabs")] {
+        let mut s = fixture(PixelFormat::RGBA8);
+        // Zig-zagging along one row, one dab per pixel.
+        let points: Vec<_> = (0..count).map(|i: i32| [f64::from(10 + (i * step % 340 - 170).abs()), 48.0]).collect();
+        let p = json!({"points":points,"size":2,"brush":{"spacing":0.5,"hardness":1.0,"pressureSize":false,"smoothing":{"amount":0.0}},
+            "seed":7,"sampleAllLayers":false,"wet":0,"mix":0,"load":100,"color":"#ff0000"});
+        let err = LiveMixer::begin(&s, &p).err().expect("bounded preview");
+        assert!(err.to_string().contains(budget), "{err}");
+        let steps = s.active().unwrap().history.past_len();
+        s.execute("paint.mixerBrush", p).unwrap();
+        assert_eq!(s.active().unwrap().history.past_len(), steps + 1);
+        assert!(target(&s).rgba(100, 48)[0] > 0.9);
+    }
+}
diff --git a/crates/engine/src/build_info.rs b/crates/engine/src/build_info.rs
index f110ada56e..1b1b7ca975 100644
--- a/crates/engine/src/build_info.rs
+++ b/crates/engine/src/build_info.rs
@@ -11,7 +11,10 @@
 //! shells out to git, so builds work from a source tarball and for wasm.
 
 /// The workspace version, such as `0.1.0` or `0.2.0-rc.1`.
-pub const VERSION: &str = env!("CARGO_PKG_VERSION");
+pub const VERSION: &str = match option_env!("PHOTOCRAFT_OVERRIDE_VERSION") {
+    Some(v) => v,
+    None => env!("CARGO_PKG_VERSION"),
+};
 
 /// The full git commit this build was made from, when the build environment recorded it.
 pub fn git_sha() -> Option<&'static str> {
diff --git a/crates/engine/src/canvas_geom.rs b/crates/engine/src/canvas_geom.rs
index 77ac5a2d06..0a4ed6faa4 100644
--- a/crates/engine/src/canvas_geom.rs
+++ b/crates/engine/src/canvas_geom.rs
@@ -137,6 +137,9 @@ pub(crate) fn transform_layer_geometry(l: &mut Layer, a: &Affine, content: bool,
             if let Some(f) = &mut sh.fill {
                 map_fill(a, f);
             }
+            if let Some(st) = &mut sh.stroke {
+                map_fill(a, &mut st.paint);
+            }
             if content {
                 crate::vector_cmds::transform_shape(sh, a);
             }
diff --git a/crates/engine/src/canvas_geom/tests.rs b/crates/engine/src/canvas_geom/tests.rs
index 2ba0dfbd66..473a82e062 100644
--- a/crates/engine/src/canvas_geom/tests.rs
+++ b/crates/engine/src/canvas_geom/tests.rs
@@ -221,6 +221,38 @@ fn gradient_fill_offset_stays_a_fraction_of_the_frame() {
     assert!((offset.0 - 0.1).abs() < 1e-6 && (offset.1 - 0.25).abs() < 1e-6, "{offset:?}");
 }
 
+/// The shape's (fill, stroke) gradient angles after `cmd` on a shape whose fill and stroke both
+/// start as a 0° (left to right) gradient.
+fn shape_gradient_angles_after(cmd: &str, p: serde_json::Value) -> (f32, f32) {
+    let mut s = Session::new();
+    s.execute("file.new", json!({"width": W, "height": H})).unwrap();
+    let g = json!({"gradient": {"stops": [[0, "#ff0000"], [1, "#0000ff"]], "angle": 0}});
+    s.execute("shape.create", json!({"kind": "rect", "rect": [10, 8, 30, 20], "fill": g, "stroke": {"width": 6, "fill": g}})).unwrap();
+    s.execute(cmd, p).unwrap();
+    let angle = |f: &Fill| if let Fill::Gradient { angle, .. } = f { *angle } else { panic!("not a gradient: {f:?}") };
+    let sh = doc(&s).walk().into_iter().find_map(|(_, _, l)| if let LayerContent::Shape(sh) = &l.content { Some(sh.clone()) } else { None }).unwrap();
+    (angle(sh.fill.as_ref().unwrap()), angle(&sh.stroke.as_ref().unwrap().paint))
+}
+
+/// A gradient stroke turns and mirrors with the canvas like the fill does (#9239).
+#[test]
+fn shape_gradient_stroke_turns_with_the_canvas() {
+    let same = |a: f32, b: f32| {
+        let d = (a - b).rem_euclid(360.0);
+        d < 1e-3 || d > 360.0 - 1e-3
+    };
+    for (cmd, p, want) in [
+        ("image.imageRotation.90cw", json!({}), -90.0),
+        ("image.imageRotation.flipCanvasHorizontal", json!({}), 180.0),
+        ("image.imageRotation.flipCanvasVertical", json!({}), 0.0),
+        ("image.rotation.arbitrary", json!({"angle": 30, "direction": "cw"}), -30.0),
+    ] {
+        let (fill, stroke) = shape_gradient_angles_after(cmd, p);
+        assert!(same(fill, want), "{cmd}: fill {fill}, want {want}");
+        assert!(same(stroke, want), "{cmd}: stroke {stroke}, want {want}");
+    }
+}
+
 fn type_and_shape_origin(d: &Document) -> ([f64; 6], [f64; 2]) {
     let mut t = None;
     let mut k = None;
diff --git a/crates/engine/src/channel_clip.rs b/crates/engine/src/channel_clip.rs
index 86a49b0be6..47677e21ff 100644
--- a/crates/engine/src/channel_clip.rs
+++ b/crates/engine/src/channel_clip.rs
@@ -74,7 +74,7 @@ pub(crate) fn copy(s: &mut Session) -> Result<Option<Value>> {
     if bounds.is_empty() {
         return Err(EngineError::Other("Could not copy: the selected area is empty".into()));
     }
-    s.clipboard = Some(Clip { surface, bounds, layers: None, resolution: Some(doc.resolution_dpi) });
+    s.clipboard = Some(Clip { surface, bounds, layers: None, resolution: Some(doc.resolution_dpi), source: Some(doc.id) });
     Ok(Some(json!({"bounds": [bounds.x0, bounds.y0, bounds.width(), bounds.height()], "channel": k})))
 }
 
@@ -86,7 +86,7 @@ pub(crate) fn paste(s: &mut Session, p: &Value, k: usize, in_place: bool, limit:
     let d = s.active().ok_or(EngineError::NoDocument)?;
     let canvas = d.doc.bounds();
     let id = d.active_layer.ok_or_else(|| EngineError::Other("no active layer".into()))?;
-    let (dx, dy) = crate::edit_cmds::paste_offset(&clip, canvas, p, in_place);
+    let (dx, dy) = crate::edit_cmds::paste_offset(&clip, d.doc.id, canvas, p, in_place);
     let src = crate::edit_cmds::shifted(&clip.surface, dx, dy);
     let area = src.content_bounds().intersect(&canvas);
     s.edit(label, |doc, _| {
diff --git a/crates/engine/src/channel_cmds.rs b/crates/engine/src/channel_cmds.rs
index bda9eae0b0..5c6eeaedcd 100644
--- a/crates/engine/src/channel_cmds.rs
+++ b/crates/engine/src/channel_cmds.rs
@@ -94,7 +94,7 @@ impl ChannelView {
     /// The layer mask shown on the canvas (#196) and how, if its layer still has a mask.
     pub fn shown_layer_mask<'a>(&self, doc: &'a Document) -> Option<(&'a photocraft_doc::LayerMask, crate::mask_view_cmds::MaskViewMode)> {
         let v = self.layer_mask?;
-        Some((doc.layer(v.layer)?.mask.as_ref()?, v.mode))
+        Some((crate::mask_view_cmds::viewed_mask(doc.layer(v.layer)?, v.filter)?, v.mode))
     }
 }
 
@@ -212,6 +212,8 @@ pub enum GraySurface {
     Alpha(usize),
     /// The Quick Mask.
     QuickMask,
+    /// The active smart object's filter mask (FILE-215-3).
+    FilterMask,
 }
 
 /// Isolated Curves channel for the active document, matching [`inject_target`].
@@ -246,6 +248,7 @@ pub fn isolated_curve_channel_for(st: &DocState, layers_panel_mask: bool) -> Opt
             Some(IsolatedCurveChannel { name: "Quick Mask".into(), key: "", hist: 0, tint: false, translate: true, gray: Some(GraySurface::QuickMask) })
         }
         ChannelTarget::LayerMask => layer_mask_curve_channel(st),
+        ChannelTarget::Composite if crate::mask_view_cmds::current(st).is_some_and(|v| v.filter) => filter_mask_curve_channel(st),
         ChannelTarget::Composite if crate::mask_view_cmds::current(st).is_some() || layers_panel_mask => layer_mask_curve_channel(st),
         _ => None,
     }
@@ -258,6 +261,15 @@ fn layer_mask_curve_channel(st: &DocState) -> Option<IsolatedCurveChannel> {
     Some(IsolatedCurveChannel { name, key: "", hist: 0, tint: false, translate: false, gray: Some(GraySurface::LayerMask) })
 }
 
+/// The Curves target when the active smart object's filter mask is targeted (its thumbnail on the
+/// Smart Filters row, FILE-215-3): a gray plane, though the mask may not exist until the first edit.
+pub fn filter_mask_curve_channel(st: &DocState) -> Option<IsolatedCurveChannel> {
+    let layer = st.active_layer.and_then(|id| st.doc.layer(id))?;
+    crate::smart_cmds::filter_mask_paintable(layer).ok()?;
+    let name = format!("{} Filter Mask", layer.name);
+    Some(IsolatedCurveChannel { name, key: "", hist: 0, tint: false, translate: false, gray: Some(GraySurface::FilterMask) })
+}
+
 fn edit_mode(doc: &Document) -> ColorMode {
     doc.pixel_format().mode
 }
@@ -602,6 +614,9 @@ fn mask_plane(s: &Session, p: &Value, cmd: &str) -> Result<Option<Vec<f32>>> {
 pub(crate) enum Target {
     Pixels,
     Mask,
+    /// A smart object's filter mask (`"target":"filterMask"`): where it is black the smart
+    /// filters don't show (FILE-215-3).
+    FilterMask,
     Alpha(usize),
     QuickMask,
 }
@@ -610,6 +625,7 @@ pub(crate) fn target_of(p: &Value) -> Target {
     match p.get("target") {
         Some(Value::String(s)) => match s.as_str() {
             "mask" => Target::Mask,
+            "filterMask" => Target::FilterMask,
             "quickMask" => Target::QuickMask,
             _ => Target::Pixels,
         },
@@ -654,6 +670,13 @@ pub(crate) fn read_target_surface<'a>(doc: &'a Document, layer: Option<LayerId>,
             let id = layer.ok_or_else(|| EngineError::Other("no active layer".into()))?;
             doc.layer(id).and_then(|l| l.mask.as_ref()).map(|m| &m.surface).ok_or(EngineError::NoLayer(id))
         }
+        Target::FilterMask => {
+            let id = layer.ok_or_else(|| EngineError::Other("no active layer".into()))?;
+            doc.layer(id)
+                .and_then(|l| crate::mask_view_cmds::viewed_mask(l, true))
+                .map(|m| &m.surface)
+                .ok_or_else(|| EngineError::Other("the layer has no filter mask".into()))
+        }
     }
 }
 
@@ -686,10 +709,17 @@ fn edits_mask(id: &str) -> bool {
 /// The precondition of `id` when `p` targets the active layer's mask (`"target":"mask"`): the
 /// layer needs a mask. None when another precondition applies.
 pub(crate) fn mask_target_enabled(s: &Session, id: &str, p: &Value) -> Option<std::result::Result<(), String>> {
-    if target_of(p) != Target::Mask || !edits_mask(id) {
-        return None;
+    match target_of(p) {
+        // The commands that paint, fill, filter or adjust the filter mask need a smart object with
+        // smart filters, not a pixel layer. Paste keeps its own check (something to paste).
+        Target::FilterMask if follows_filter_mask(id) && !PASTE_IDS.contains(&id) => {
+            Some(crate::active_layer_of(s).and_then(crate::smart_cmds::filter_mask_paintable))
+        }
+        Target::Mask if edits_mask(id) => {
+            Some(crate::active_layer_of(s).and_then(|l| if l.mask.is_some() { Ok(()) } else { Err("the active layer has no layer mask".into()) }))
+        }
+        _ => None,
     }
-    Some(crate::active_layer_of(s).and_then(|l| if l.mask.is_some() { Ok(()) } else { Err("the active layer has no layer mask".into()) }))
 }
 
 /// Whether command `id` edits the targeted channel or mask when its params name no `"target"`
@@ -700,15 +730,68 @@ pub fn follows_target(id: &str) -> bool {
     routed(id) || id == "select.float" || id == "layer.translate"
 }
 
+/// Whether command `id` edits a smart object's targeted filter mask (`"target":"filterMask"`):
+/// every routed command but those that act on the smart object itself while its filter mask is
+/// targeted (Edit › Transform, Apply Image, Convert for Smart Filters, Last Filter, Liquify, the
+/// lens filters and Vanishing Point, which add a smart filter, the render filters that make a new
+/// layer, and Desaturate), so neither the shell nor the engine sends those the filter mask.
+pub fn follows_filter_mask(id: &str) -> bool {
+    routed(id)
+        && !id.starts_with("edit.transform.")
+        && !matches!(
+            id,
+            "image.applyImage"
+                | "image.adjustments.desaturate"
+                | "filter.vanishingPoint"
+                | "filter.render.flame"
+                | "filter.render.tree"
+                | "filter.render.pictureFrame"
+                | "filter.convertForSmartFilters"
+                | "filter.lastFilter"
+                | crate::distort_cmds::LIQUIFY
+                | crate::lens_cmds::LENS
+                | crate::lens_cmds::WIDE
+                | crate::lens_cmds::RAW
+        )
+}
+
+/// The paint and retouch tools that follow the targeted channel or mask.
+const PAINT_IDS: &[&str] = &[
+    "paint.stroke",
+    "paint.pencil",
+    "paint.bucket",
+    "paint.gradient",
+    "paint.mixerBrush",
+    "paint.cloneStamp",
+    "paint.patternStamp",
+    "paint.healingBrush",
+    "paint.spotHealing",
+    "paint.dodge",
+    "paint.burn",
+    "paint.sponge",
+    "paint.blur",
+    "paint.sharpen",
+    "paint.smudge",
+    "paint.historyBrush",
+    "paint.artHistoryBrush",
+    "paint.redEye",
+    "paint.remove",
+];
+
+/// Pasting into a targeted mask or channel (#1035).
+const PASTE_IDS: &[&str] = &["edit.paste", "edit.pasteSpecial.pasteInPlace", "edit.pasteSpecial.pasteInto", "edit.pasteSpecial.pasteOutside"];
+
 /// Commands whose target follows the Channels panel.
 pub(crate) fn routed(id: &str) -> bool {
     id.starts_with("filter.")
         || id == "plugin.run"
         || id.starts_with("image.adjustments.")
-        || matches!(id, "paint.stroke" | "paint.pencil" | "paint.bucket" | "paint.gradient" | "paint.mixerBrush" | "edit.fill" | "image.applyImage")
+        || matches!(id, "edit.fill" | "image.applyImage")
         || crate::fill_key_cmds::IDS.contains(&id)
+        || PAINT_IDS.contains(&id)
         // Pasting into a targeted mask or channel (#1035); Copy takes a targeted mask (#2928).
-        || matches!(id, "edit.copy" | "edit.paste" | "edit.pasteSpecial.pasteInPlace" | "edit.pasteSpecial.pasteInto" | "edit.pasteSpecial.pasteOutside")
+        || id == "edit.copy"
+        || PASTE_IDS.contains(&id)
         // Edit › Transform › Rotate/Flip turn a targeted mask or channel (#2835).
         || matches!(
             id,
@@ -718,22 +801,6 @@ pub(crate) fn routed(id: &str) -> bool {
                 | "edit.transform.flipHorizontal"
                 | "edit.transform.flipVertical"
         )
-        || matches!(
-            id,
-            "paint.cloneStamp"
-                | "paint.patternStamp"
-                | "paint.healingBrush"
-                | "paint.spotHealing"
-                | "paint.dodge"
-                | "paint.burn"
-                | "paint.sponge"
-                | "paint.blur"
-                | "paint.sharpen"
-                | "paint.smudge"
-                | "paint.historyBrush"
-                | "paint.redEye"
-                | "paint.remove"
-        )
 }
 
 /// Fill in `"target"` from the targeted channel (or Quick Mask mode) when the caller gave none.
@@ -747,6 +814,13 @@ pub(crate) fn inject_target(s: &Session, id: &str, params: Value) -> Value {
         ChannelTarget::Composite if st.doc.quick_mask.is_some() => json!("quickMask"),
         ChannelTarget::LayerMask => json!("mask"),
         // Viewing the active layer's mask (⌥-click): pixel commands edit the mask.
+        // A shown filter mask takes only the commands that edit it; the rest act on the smart object.
+        ChannelTarget::Composite if crate::mask_view_cmds::current(st).is_some_and(|v| v.filter) => {
+            if !follows_filter_mask(id) {
+                return params;
+            }
+            json!("filterMask")
+        }
         ChannelTarget::Composite if crate::mask_view_cmds::current(st).is_some() => json!("mask"),
         _ => return params,
     };
@@ -759,6 +833,16 @@ pub(crate) fn inject_target(s: &Session, id: &str, params: Value) -> Value {
     }
 }
 
+/// The smart object whose filter mask command `id` with `params` edits (`"target":"filterMask"`):
+/// its `"layer"` param, else the active layer. None for a command that doesn't edit the filter
+/// mask, so moving the smart object doesn't re-render its filters.
+pub(crate) fn filter_mask_layer(s: &Session, id: &str, params: &Value) -> Option<LayerId> {
+    if target_of(params) != Target::FilterMask || !follows_filter_mask(id) {
+        return None;
+    }
+    params.get("layer").and_then(Value::as_u64).map(LayerId).or_else(|| s.active()?.active_layer)
+}
+
 /// The colour channel pixel commands are limited to, if a single colour channel is targeted.
 pub(crate) fn color_restriction(s: &Session, id: &str, params: &Value) -> Option<usize> {
     if !routed(id) || is_channel_target(params) || crate::commands::is_mask_target(params) {
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index 767a9791b0..8c1c6937d7 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -65,13 +65,17 @@ pub(crate) fn has_paintable(s: &Session) -> std::result::Result<(), String> {
     }
 }
 
-/// Surface a paint command writes to: the layer's pixels, or its mask with `"target":"mask"`.
+/// Surface a paint command writes to: the layer's pixels, its mask with `"target":"mask"`, or a
+/// smart object's filter mask with `"target":"filterMask"`.
 pub(crate) fn paint_surface<'a>(doc: &'a mut Document, id: LayerId, p: &Value) -> Result<&'a mut photocraft_raster::Surface> {
     if is_mask_target(p) {
         check_all_unlocked(doc, id)?;
     } else {
         check_pixels_unlocked(doc, id)?;
     }
+    if crate::channel_cmds::target_of(p) == crate::channel_cmds::Target::FilterMask {
+        return crate::smart_cmds::filter_mask_surface(doc, id);
+    }
     let l = doc.layer_mut(id).ok_or(EngineError::NoLayer(id))?;
     if is_mask_target(p) {
         l.mask.as_mut().map(|m| &mut m.surface).ok_or_else(|| EngineError::Other("layer has no mask".into()))
@@ -99,8 +103,10 @@ pub(crate) fn check_pixels_unlocked(doc: &Document, id: LayerId) -> Result<()> {
     Ok(())
 }
 
+/// The params target a grayscale mask of the layer: its layer mask (`"mask"`) or, on a smart
+/// object, its filter mask (`"filterMask"`).
 pub(crate) fn is_mask_target(p: &Value) -> bool {
-    p.get("target").and_then(Value::as_str) == Some("mask")
+    matches!(p.get("target").and_then(Value::as_str), Some("mask" | "filterMask"))
 }
 
 fn can_undo(s: &Session) -> std::result::Result<(), String> {
@@ -467,9 +473,7 @@ fn destructive_adjust(s: &mut Session, label: &str, adj: Adjustment, p: &Value)
         return s.edit(label, |doc, _| {
             check_all_unlocked(doc, id)?;
             let sel = doc.selection.clone();
-            let l = doc.layer_mut(id).ok_or(EngineError::NoLayer(id))?;
-            let mask = l.mask.as_mut().ok_or_else(|| EngineError::Other("layer has no mask".into()))?;
-            pixels::adjust_mask(&mut mask.surface, &adj, sel.as_ref()).map_err(EngineError::Other)?;
+            pixels::adjust_mask(paint_surface(doc, id, p)?, &adj, sel.as_ref()).map_err(EngineError::Other)?;
             Ok(Value::Null)
         });
     }
@@ -543,7 +547,7 @@ fn build() -> Vec<CommandSpec> {
             "New…",
             ["File"],
             Some("Cmd+N"),
-            r##"{"width":1..300000=1920,"height":1..300000=1080 (pixel counts are rounded),"mode":"rgb|gray|grayscale|cmyk|lab"="rgb","depth":8|16|32=8,"background":"white|black|backgroundColor|transparent|#rrggbb"="white","backgroundColor":[r,g,b]? (0..1; defaults to toolbox colour),"resolution":1..30000=72 (ppi),"name":str,"profile":"working"|built-in id|path to an .icc file="working" (the colour profile it is tagged with; it must suit the mode)}"##,
+            r##"{"width":1..300000=1920,"height":1..300000=1080 (pixel counts are rounded),"mode":"rgb|gray|grayscale|cmyk|lab"="rgb","depth":8|16|32=8,"background":"white|black|backgroundColor|transparent|#rrggbb"="white","backgroundColor":[r,g,b]? (0..1; defaults to toolbox colour),"resolution":1..30000=72 (ppi),"name":str,"artboard":bool=false (one artboard over the canvas, its background the chosen one, holding an empty Layer 1; no Background layer),"profile":"working"|built-in id|path to an .icc file="working" (the colour profile it is tagged with; it must suit the mode)}"##,
             always,
             |s, p| {
                 use crate::document_preset_cmds::{MAX_DIMENSION, MAX_RESOLUTION, background_color, color_mode, sample_type};
@@ -562,22 +566,28 @@ fn build() -> Vec<CommandSpec> {
                 let depth = sample_type(p.get("depth").and_then(Value::as_u64).unwrap_or(8)).unwrap_or(SampleType::U8);
                 let name = p.get("name").and_then(Value::as_str).unwrap_or("Untitled").to_string();
                 let res = p.get("resolution").and_then(Value::as_f64).unwrap_or(72.0).clamp(1.0, MAX_RESOLUTION) as f32;
-                let mut doc = match p.get("background").and_then(Value::as_str).unwrap_or("white") {
+                // The background colour; `None` for Transparent.
+                let background = match p.get("background").and_then(Value::as_str).unwrap_or("white") {
                     "backgroundColor" => {
                         let bgc = background_color(p, s.tools.background, "file.new")?;
-                        Document::with_background(name, Size::new(w, h), mode, depth, Color::rgba(bgc[0], bgc[1], bgc[2], 1.0))
+                        Some(Color::rgba(bgc[0], bgc[1], bgc[2], 1.0))
                     }
-                    "transparent" => {
-                        let mut d = Document::new(name, Size::new(w, h), mode, depth);
-                        d.layers.push(Layer::raster("Layer 1", d.pixel_format()));
-                        d
-                    }
-                    "black" => Document::with_background(name, Size::new(w, h), mode, depth, Color::BLACK),
+                    "transparent" => None,
+                    "black" => Some(Color::BLACK),
                     other => {
                         let c = parse_hex(other).unwrap_or([1.0; 4]);
-                        Document::with_background(name, Size::new(w, h), mode, depth, Color::rgba(c[0], c[1], c[2], c[3]))
+                        Some(Color::rgba(c[0], c[1], c[2], c[3]))
                     }
                 };
+                let mut doc = if p.get("artboard").and_then(Value::as_bool).unwrap_or(false) {
+                    crate::artboard_cmds::new_artboard_document(name, Size::new(w, h), mode, depth, background)
+                } else if let Some(c) = background {
+                    Document::with_background(name, Size::new(w, h), mode, depth, c)
+                } else {
+                    let mut d = Document::new(name, Size::new(w, h), mode, depth);
+                    d.layers.push(Layer::raster("Layer 1", d.pixel_format()));
+                    d
+                };
                 doc.resolution_dpi = res;
                 // Photoshop's New Document › Color Profile: tag the document with another profile
                 // than the working space (#321). Checked before the document opens.
@@ -608,7 +618,7 @@ fn build() -> Vec<CommandSpec> {
             "Fill…",
             ["Edit"],
             Some("Shift+F5"),
-            r##"{"contents":"foreground|background|color|contentAware|pattern|history|black|gray|white"="color","color":"#rrggbb|[r,g,b,a]"=foreground (contents=color),"pattern":id|name (contents=pattern),"scale":%=100,"angle":deg,"state":row?,"snapshot":id? (contents=history: a History panel row as history.setSource, redo rows last, or a snapshot; default the History Brush source),"colorAdaptation":bool=true (contents=contentAware),"mode":"normal|multiply|…"="normal","opacity":0..100=100,"preserveTransparency":bool=false,"target":"pixels"|"mask"|"quickMask"|{"channel":i}?}"##,
+            r##"{"contents":"foreground|background|color|contentAware|pattern|history|black|gray|white"="color","color":"#rrggbb|[r,g,b,a]"=foreground (contents=color),"pattern":id|name (contents=pattern),"scale":%=100,"angle":deg,"state":row?,"snapshot":id? (contents=history: a History panel row as history.setSource, redo rows last, or a snapshot; default the History Brush source),"colorAdaptation":bool=true (contents=contentAware),"mode":"normal|multiply|…"="normal","opacity":0..100=100,"preserveTransparency":bool=false,"target":"pixels"|"mask"|"filterMask"|"quickMask"|{"channel":i}?}"##,
             has_pixel_or_channel,
             crate::fill_cmds::fill
         ),
@@ -1189,7 +1199,7 @@ fn build() -> Vec<CommandSpec> {
             "Brush Stroke",
             [],
             None,
-            r##"{"points":[[x,y,pressure?,tiltX?,tiltY?,rotation?,timeMs?,wheel?],…],"brush":{…BrushSettings}?,"preset":name?,"size":0.5..5000 px?,"hardness":0..1?,"opacity":0..1?,"flow":0..1?,"spacing":0..10?,"color":"#rrggbb"?=foreground,"mode":"normal|multiply|screen|…|clear (erases with this brush)"="normal","erase":bool?,"smoothing":0..1?,"zoom":number=1,"seed":u64?,"target":"pixels"|"mask"|"quickMask"|{"channel":i}=Channels panel target}"##,
+            r##"{"points":[[x,y,pressure?,tiltX?,tiltY?,rotation?,timeMs?,wheel?],…],"brush":{…BrushSettings}?,"preset":name?,"size":0.5..5000 px?,"hardness":0..1?,"opacity":0..1?,"flow":0..1?,"spacing":0..10?,"color":"#rrggbb"?=foreground,"mode":"normal|multiply|screen|…|clear (erases with this brush)"="normal","erase":bool?,"smoothing":0..1?,"zoom":number=1,"seed":u64?,"target":"pixels"|"mask"|"filterMask"|"quickMask"|{"channel":i}=Channels panel target}"##,
             has_paintable,
             crate::brush_cmds::paint_stroke
         ),
diff --git a/crates/engine/src/crop_fill.rs b/crates/engine/src/crop_fill.rs
index 6ef0698cea..e67ff25844 100644
--- a/crates/engine/src/crop_fill.rs
+++ b/crates/engine/src/crop_fill.rs
@@ -8,9 +8,15 @@
 //! layers keep their transparency there, as after a plain crop. Each connected piece of the
 //! uncovered area (each corner, each edge strip) is filled on its own, with Photoshop's sampling
 //! window around that piece, and only pixels the image covers are sampled.
+//!
+//! Pixels an earlier crop with Delete Cropped Pixels off hid past the canvas edges are still the
+//! layer's. Under a turned frame they count as covered, so they are kept (and sampled) rather than
+//! filled over; a straight crop fills all of the area past the old canvas, them included, as
+//! Photoshop does (#8060).
 
 use photocraft_doc::{Document, LayerId};
 use photocraft_geom::Rect;
+use photocraft_raster::Surface;
 use rayon::prelude::*;
 
 use crate::{EngineError, Result};
@@ -22,7 +28,7 @@ const SEED: u64 = 1;
 const MAX_PIXELS: u64 = 400_000_000;
 
 /// Where the cropped canvas came from in the original document.
-#[derive(Clone, Copy, Debug)]
+#[derive(Clone, Debug)]
 pub(crate) struct Coverage {
     /// Cropped canvas → original document: `[a, b, c, d, e, f]` with
     /// `x = a·u + b·v + e`, `y = c·u + d·v + f`.
@@ -32,12 +38,23 @@ pub(crate) struct Coverage {
     pub height: f64,
     /// Whether the map rotates (its resampled edge is antialiased against the background colour).
     pub rotated: bool,
+    /// The filled layer's pixels before a turned crop (original document px), set by
+    /// [`Coverage::holding`]: where they lie past the old canvas they are hidden image, not
+    /// uncovered area. A straight crop has none: Photoshop fills over hidden pixels there.
+    pub held: Option<Surface>,
 }
 
 impl Coverage {
     /// An unrotated crop to `r` (original document px).
     pub fn crop(r: Rect, width: u32, height: u32) -> Self {
-        Coverage { map: [1.0, 0.0, 0.0, 1.0, f64::from(r.x0), f64::from(r.y0)], width: f64::from(width), height: f64::from(height), rotated: false }
+        Coverage { map: [1.0, 0.0, 0.0, 1.0, f64::from(r.x0), f64::from(r.y0)], width: f64::from(width), height: f64::from(height), rotated: false, held: None }
+    }
+
+    /// Takes the pixels of the layer the fill will go to from `doc` before a turned crop (the
+    /// surface is shared, not copied), so hidden pixels past the old canvas count as covered.
+    pub fn holding(mut self, doc: &Document, active: Option<LayerId>) -> Self {
+        self.held = target_layer(doc, active).ok().and_then(|id| doc.layer(id)).and_then(|l| l.surface()).cloned();
+        self
     }
 
     /// Whether the cropped canvas's pixel (u, v) is the original image's: its centre maps inside
@@ -48,7 +65,27 @@ impl Coverage {
         let [a, b, c, d, e, f] = self.map;
         let (cu, cv) = (f64::from(u) + 0.5, f64::from(v) + 0.5);
         let (x, y) = (a * cu + b * cv + e, c * cu + d * cv + f);
-        x >= margin && y >= margin && x <= self.width - margin && y <= self.height - margin
+        (x >= margin && y >= margin && x <= self.width - margin && y <= self.height - margin) || self.holds(x, y)
+    }
+
+    /// Whether the layer held an image pixel at original document point (x, y) past the canvas
+    /// (#8060): mostly opaque there and one pixel around it too (the turned edge is blended with
+    /// the background colour, as at the canvas edge). Without an alpha channel
+    /// hidden pixels can't be told from empty ones: nothing is held.
+    fn holds(&self, x: f64, y: f64) -> bool {
+        let Some(surf) = &self.held else { return false };
+        let format = surf.format();
+        if !format.alpha || !(x.is_finite() && y.is_finite()) {
+            return false;
+        }
+        let a = surf.channels().saturating_sub(1);
+        let at = |x: f64, y: f64| {
+            let (fx, fy) = (x.floor(), y.floor());
+            let limit = f64::from(i32::MAX);
+            fx.abs() < limit && fy.abs() < limit && surf.sample_channel(fx as i32, fy as i32, a) > 0.5
+        };
+        const ROUND: [(f64, f64); 5] = [(0.0, 0.0), (-1.0, 0.0), (1.0, 0.0), (0.0, -1.0), (0.0, 1.0)];
+        ROUND.iter().all(|&(dx, dy)| at(x + dx, y + dy))
     }
 
     fn margin(&self) -> f64 {
diff --git a/crates/engine/src/document_preset_cmds.rs b/crates/engine/src/document_preset_cmds.rs
index e65856951b..9930b2fe31 100644
--- a/crates/engine/src/document_preset_cmds.rs
+++ b/crates/engine/src/document_preset_cmds.rs
@@ -78,6 +78,7 @@ pub(crate) fn validate_new_params(s: &Session, p: &Value) -> Result<()> {
                 continue;
             }
             "name" => (value.is_string(), "a string".into()),
+            "artboard" => (value.is_boolean(), "true or false".into()),
             "profile" => (value.as_str().is_some_and(|v| !v.is_empty()), "working, a built-in profile id or an .icc path".into()),
             _ => return Err(bad(cmd, format!("unknown parameter `{key}`"))),
         };
diff --git a/crates/engine/src/edit_cmds.rs b/crates/engine/src/edit_cmds.rs
index 5ba3a26110..4631cbae75 100644
--- a/crates/engine/src/edit_cmds.rs
+++ b/crates/engine/src/edit_cmds.rs
@@ -3,7 +3,7 @@
 
 use photocraft_color::{ColorMode, PixelFormat};
 use photocraft_doc::adjust::LevelsChannel;
-use photocraft_doc::{Adjustment, Document, Layer, LayerContent, LayerId};
+use photocraft_doc::{Adjustment, DocId, Document, Layer, LayerContent, LayerId};
 use photocraft_geom::Rect;
 use photocraft_raster::Surface;
 use serde_json::{Value, json};
@@ -31,6 +31,9 @@ pub struct Clip {
     /// The source document's resolution (ppi): File › New from the clipboard takes it, as
     /// Photoshop's Clipboard preset does. None for an image from another app.
     pub resolution: Option<f32>,
+    /// The document the pixels were copied from: Paste keeps them in place only there, and
+    /// centres them in any other (#8945). None for an image from another app.
+    pub source: Option<DocId>,
 }
 
 /// Photoshop's layer-based copy (CC 2018 on): with no selection, Copy takes the active layer
@@ -195,7 +198,7 @@ fn lift(src: &Surface, sel: Option<&Surface>, canvas: Rect) -> Result<Clip> {
     };
     let mut out = Surface::new(with_alpha);
     if area.is_empty() {
-        return Ok(Clip { surface: out, bounds: Rect::EMPTY, layers: None, resolution: None });
+        return Ok(Clip { surface: out, bounds: Rect::EMPTY, layers: None, resolution: None, source: None });
     }
     // Only the selected area is read: converting the whole layer (a 24 MP Background gaining
     // alpha) cost about a second per Layer via Copy (#668).
@@ -217,7 +220,7 @@ fn lift(src: &Surface, sel: Option<&Surface>, canvas: Rect) -> Result<Clip> {
     out.put_tiles(shared);
     out.prune();
     let bounds = out.content_bounds();
-    Ok(Clip { surface: out, bounds, layers: None, resolution: None })
+    Ok(Clip { surface: out, bounds, layers: None, resolution: None, source: None })
 }
 
 /// [`lift`] over one rectangle: `src`'s pixels with alpha (`n` channels), the selection
@@ -299,20 +302,23 @@ fn copy(s: &mut Session, merged: bool) -> Result<Value> {
         return Err(EngineError::Other("Could not copy: the selected area is empty".into()));
     }
     let b = clip.bounds;
-    let clip = Clip { resolution: Some(d.doc.resolution_dpi), ..clip };
+    let clip = Clip { resolution: Some(d.doc.resolution_dpi), source: Some(d.doc.id), ..clip };
     s.clipboard = Some(clip);
     Ok(json!({"bounds": [b.x0, b.y0, b.width(), b.height()]}))
 }
 
-/// Copy with the layer mask targeted (`"target":"mask"`, #2928): the mask's values as a
+/// Copy the targeted layer mask (`"target":"mask"`, #2928) or smart-filter mask
+/// (`"target":"filterMask"`): the mask's values as a
 /// grayscale clip, inside the selection or the whole canvas — an untouched mask copies at its
 /// default value, so a plain Reveal All / Hide All mask transfers too. Paste then writes into
 /// another layer's mask (targeted, #1035), in this or another document.
-fn copy_mask(s: &mut Session) -> Result<Value> {
+fn copy_mask(s: &mut Session, filter: bool) -> Result<Value> {
     let d = s.active().ok_or(EngineError::NoDocument)?;
     let canvas = d.doc.bounds();
     let id = d.active_layer.ok_or_else(|| EngineError::Other("no active layer".into()))?;
-    let mask = d.doc.layer(id).ok_or(EngineError::NoLayer(id))?.mask.as_ref().ok_or_else(|| EngineError::Other("the active layer has no layer mask".into()))?;
+    let layer = d.doc.layer(id).ok_or(EngineError::NoLayer(id))?;
+    let mask = crate::mask_view_cmds::viewed_mask(layer, filter)
+        .ok_or_else(|| EngineError::Other(if filter { "the active layer has no filter mask" } else { "the active layer has no layer mask" }.into()))?;
     let sel = d.doc.selection.as_ref();
     let area = sel.map_or(canvas, |m| m.content_bounds().intersect(&canvas));
     if area.is_empty() {
@@ -342,9 +348,9 @@ fn copy_mask(s: &mut Session) -> Result<Value> {
         return Err(EngineError::Other("Could not copy: the selected area is empty".into()));
     }
     let b = bounds;
-    let resolution = Some(d.doc.resolution_dpi);
-    s.clipboard = Some(Clip { surface, bounds: b, layers: None, resolution });
-    Ok(json!({"bounds": [b.x0, b.y0, b.width(), b.height()], "target": "mask"}))
+    let (resolution, source) = (Some(d.doc.resolution_dpi), Some(d.doc.id));
+    s.clipboard = Some(Clip { surface, bounds: b, layers: None, resolution, source });
+    Ok(json!({"bounds": [b.x0, b.y0, b.width(), b.height()], "target": if filter { "filterMask" } else { "mask" }}))
 }
 
 fn clear_selected(doc: &mut Document, id: LayerId, background: [f32; 4]) -> Result<()> {
@@ -387,7 +393,7 @@ fn paste(s: &mut Session, p: &Value, in_place: bool) -> Result<Value> {
     }
     let canvas = d.doc.bounds();
     let fmt = d.doc.pixel_format();
-    let (dx, dy) = paste_offset(&clip, canvas, p, in_place);
+    let (dx, dy) = paste_offset(&clip, d.doc.id, canvas, p, in_place);
     if let Some(layers) = clip.layers.as_deref().filter(|_| crate::layer_copy_cmds::layered(d.doc.mode)) {
         return paste_layers(s, layers, dx, dy);
     }
@@ -453,8 +459,9 @@ fn paste_layers(s: &mut Session, layers: &Document, dx: i32, dy: i32) -> Result<
 /// canvas centre, then kept on the canvas as Photoshop keeps it: pixels that fit stay wholly
 /// inside, larger ones start at the canvas's top-left corner (#6759). `"clampToCanvas": false`
 /// skips that, for Paste Into / Outside, which centre on the selection.
-pub(crate) fn paste_offset(clip: &Clip, canvas: Rect, p: &Value, in_place: bool) -> (i32, i32) {
-    if in_place || (clip.bounds.intersect(&canvas) == clip.bounds && p.get("center").is_none()) {
+pub(crate) fn paste_offset(clip: &Clip, doc: DocId, canvas: Rect, p: &Value, in_place: bool) -> (i32, i32) {
+    let home = clip.source == Some(doc);
+    if in_place || (home && clip.bounds.intersect(&canvas) == clip.bounds && p.get("center").is_none()) {
         return (0, 0);
     }
     let c = p.get("center").and_then(Value::as_array).filter(|a| a.len() >= 2).map(|a| (a[0].as_f64().unwrap_or(0.0), a[1].as_f64().unwrap_or(0.0)));
@@ -495,7 +502,7 @@ pub(crate) fn paste_to_target(s: &mut Session, p: &Value, in_place: bool, limit:
     let d = s.active().ok_or(EngineError::NoDocument)?;
     let canvas = d.doc.bounds();
     let layer = d.active_layer;
-    let (dx, dy) = paste_offset(&clip, canvas, p, in_place);
+    let (dx, dy) = paste_offset(&clip, d.doc.id, canvas, p, in_place);
     let src = shifted(&clip.surface, dx, dy);
     let area = src.content_bounds().intersect(&canvas);
     s.edit(label, |doc, _| {
@@ -995,11 +1002,11 @@ pub fn specs() -> Vec<CommandSpec> {
             "Copy",
             &["Edit"],
             Some("Cmd+C"),
-            r##"{"target":"mask"? = the targeted mask, copied as grayscale (#2928)} (a targeted colour or alpha channel copies that channel, as grayscale)"##,
+            r##"{"target":"mask|filterMask"? = the targeted mask, copied as grayscale (#2928)} (a targeted colour or alpha channel copies that channel, as grayscale)"##,
             can_copy,
             |s, p| {
                 if crate::commands::is_mask_target(p) {
-                    return copy_mask(s);
+                    return copy_mask(s, crate::channel_cmds::target_of(p) == crate::channel_cmds::Target::FilterMask);
                 }
                 match crate::channel_clip::copy(s)? {
                     Some(r) => Ok(r),
@@ -1121,7 +1128,7 @@ mod tests {
         let mut s = Session::new();
         let mut surface = Surface::new(PixelFormat::RGBA8);
         surface.write_pixel(i32::MIN, 0, &[1.0, 0.0, 0.0, 1.0]);
-        s.clipboard = Some(Clip { surface, bounds: Rect::from_xywh(i32::MIN, 0, 1, 1), layers: None, resolution: None });
+        s.clipboard = Some(Clip { surface, bounds: Rect::from_xywh(i32::MIN, 0, 1, 1), layers: None, resolution: None, source: None });
         let result = new_from_clipboard(&mut s);
         assert!(result.unwrap_err().to_string().contains("clipboard origin"));
         assert!(s.execute("file.newFromClipboard", json!({})).is_err());
@@ -1129,15 +1136,38 @@ mod tests {
         assert_eq!(s.clipboard.as_ref().unwrap().surface.rgba(i32::MIN, 0), [1.0, 0.0, 0.0, 1.0]);
     }
 
+    /// #8945: pixels copied in one document land in place when pasted back into it, and centred
+    /// in another, even where their old position would fit (Photoshop's Paste).
+    #[test]
+    fn paste_centres_pixels_from_another_document() {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 40, "height": 30, "background": "white"})).unwrap();
+        s.execute("select.all", json!({})).unwrap();
+        s.execute("edit.copy", json!({})).unwrap();
+        let r = s.execute("edit.paste", json!({})).unwrap();
+        assert_eq!(r["offset"], json!([0, 0]), "back into its own document: in place");
+        s.execute("file.new", json!({"width": 100, "height": 80, "background": "white"})).unwrap();
+        let r = s.execute("edit.paste", json!({})).unwrap();
+        assert_eq!(r["offset"], json!([30, 25]), "into another document: centred");
+        // An image from another app has no source document: centred too.
+        s.clipboard = s.clipboard.take().map(|c| Clip { source: None, ..c });
+        let r = s.execute("edit.paste", json!({})).unwrap();
+        assert_eq!(r["offset"], json!([30, 25]));
+        // Paste in Place still keeps the position.
+        let r = s.execute("edit.pasteSpecial.pasteInPlace", json!({})).unwrap();
+        assert_eq!(r["offset"], json!([0, 0]));
+    }
+
     #[test]
     fn paste_centers_clipboard_bounds_near_coordinate_limits() {
         for origin in [i32::MAX - 512, i32::MIN + 512] {
-            let clip = Clip { surface: Surface::new(PixelFormat::RGBA8), bounds: Rect::from_xywh(origin, origin, 2, 2), layers: None, resolution: None };
-            let (dx, dy) = paste_offset(&clip, Rect::new(0, 0, 20, 20), &json!({}), false);
+            let clip =
+                Clip { surface: Surface::new(PixelFormat::RGBA8), bounds: Rect::from_xywh(origin, origin, 2, 2), layers: None, resolution: None, source: None };
+            let (dx, dy) = paste_offset(&clip, DocId(1), Rect::new(0, 0, 20, 20), &json!({}), false);
             assert_eq!(i64::from(origin) + i64::from(dx), 9);
             assert_eq!(i64::from(origin) + i64::from(dy), 9);
             let clip = Clip { bounds: Rect::new(0, 0, 2, 2), ..clip };
-            let (dx, dy) = paste_offset(&clip, Rect::from_xywh(origin, origin, 20, 20), &json!({}), false);
+            let (dx, dy) = paste_offset(&clip, DocId(1), Rect::from_xywh(origin, origin, 20, 20), &json!({}), false);
             assert_eq!(dx, origin + 9);
             assert_eq!(dy, origin + 9);
         }
@@ -1314,7 +1344,7 @@ mod tests {
         s.execute("file.new", json!({"width": w, "height": h})).unwrap();
         let mut surface = Surface::new(PixelFormat::RGBA8);
         surface.fill_rect(Rect::new(0, 0, cw, ch), &[1.0, 0.0, 0.0, 1.0]);
-        s.clipboard = Some(Clip { surface, bounds: Rect::new(0, 0, cw, ch), layers: None, resolution: None });
+        s.clipboard = Some(Clip { surface, bounds: Rect::new(0, 0, cw, ch), layers: None, resolution: None, source: None });
         s
     }
 
@@ -1375,8 +1405,9 @@ mod tests {
             bounds: Rect::new(i32::MAX - 2, i32::MAX - 2, i32::MAX, i32::MAX),
             layers: None,
             resolution: None,
+            source: None,
         };
-        let (dx, dy) = paste_offset(&clip, Rect::new(i32::MIN, i32::MIN, i32::MIN + 4, i32::MIN + 4), &json!({}), false);
+        let (dx, dy) = paste_offset(&clip, DocId(1), Rect::new(i32::MIN, i32::MIN, i32::MIN + 4, i32::MIN + 4), &json!({}), false);
         assert_eq!((dx, dy), (i32::MIN, i32::MIN), "an unrepresentable shift saturates instead of wrapping");
     }
 
@@ -2471,13 +2502,13 @@ mod tests {
         };
         let mut out = Surface::new(with_alpha);
         if area.is_empty() {
-            return Clip { surface: out, bounds: Rect::EMPTY, layers: None, resolution: None };
+            return Clip { surface: out, bounds: Rect::EMPTY, layers: None, resolution: None, source: None };
         }
         let px = lift_region(src, sel, area, with_alpha.channels()).unwrap();
         out.try_write_region(area, &px).unwrap();
         out.prune();
         let bounds = out.content_bounds();
-        Clip { surface: out, bounds, layers: None, resolution: None }
+        Clip { surface: out, bounds, layers: None, resolution: None, source: None }
     }
 
     fn noise(fmt: PixelFormat, r: Rect, seed: u32) -> Surface {
diff --git a/crates/engine/src/edit_menu_cmds.rs b/crates/engine/src/edit_menu_cmds.rs
index 997c0daacd..0ef173d242 100644
--- a/crates/engine/src/edit_menu_cmds.rs
+++ b/crates/engine/src/edit_menu_cmds.rs
@@ -1408,7 +1408,7 @@ fn export_import(s: &mut Session, p: &Value) -> Result<Value> {
         .get("kinds")
         .and_then(Value::as_array)
         .map(|a| a.iter().filter_map(Value::as_str).map(str::to_string).collect())
-        .unwrap_or_else(|| ["brushes", "customShapes", "tools"].iter().map(|k| k.to_string()).collect());
+        .unwrap_or_else(|| ["brushes", "customShapes", "tools"].iter().map(ToString::to_string).collect());
     let want = |k: &str| kinds.iter().any(|x| x == k);
     match str_or(p, "action", "export") {
         "export" => {
diff --git a/crates/engine/src/extra_cmds.rs b/crates/engine/src/extra_cmds.rs
index db5c93fcfe..d5364cfd88 100644
--- a/crates/engine/src/extra_cmds.rs
+++ b/crates/engine/src/extra_cmds.rs
@@ -400,7 +400,38 @@ fn paste_into(s: &mut Session, p: &Value, outside: bool) -> Result<Value> {
 /// The canvas grown to every layer's pixels: Image › Reveal All's new canvas, and what the Crop
 /// tool shows while a frame is edited.
 pub fn reveal_all_bounds(doc: &Document) -> Rect {
-    doc.walk().into_iter().filter_map(|(_, _, l)| l.surface().map(|s| s.content_bounds())).fold(doc.bounds(), |a, b| a.union(&b))
+    let canvas = doc.bounds();
+    doc.walk().into_iter().filter_map(|(_, _, l)| l.surface().map(|s| visible_bounds(s, canvas))).fold(canvas, |a, b| a.union(&b))
+}
+
+/// Bounds of `s`'s pixels outside `canvas` with alpha > 0, as Photoshop's layer bounds (#9379):
+/// the Eraser only clears alpha, so an erased pixel keeps its colour bytes and `content_bounds`
+/// counts it. Pixels inside `canvas` can't grow the result and aren't read.
+fn visible_bounds(s: &photocraft_raster::Surface, canvas: Rect) -> Rect {
+    use rayon::prelude::*;
+    let fmt = s.format();
+    if !fmt.alpha || s.default_pixel().last().is_none_or(|a| *a > 0.0) {
+        return s.content_bounds();
+    }
+    let (n, bpp, side) = (fmt.channels(), fmt.bytes_per_pixel(), photocraft_geom::TILE_SIZE);
+    let tiles: Vec<_> = s.tiles().filter(|(c, _)| !canvas.contains_rect(&c.rect())).collect();
+    let tile_bounds = |o: Rect, bytes: &[u8]| {
+        let mut out = Rect::EMPTY;
+        for (ly, row) in bytes.chunks_exact(bpp * side as usize).enumerate() {
+            let y = o.y0.saturating_add(ly as i32);
+            let on_canvas = (canvas.y0..canvas.y1).contains(&y);
+            let visible = |lx: &i32| {
+                let x = o.x0.saturating_add(*lx);
+                !(on_canvas && (canvas.x0..canvas.x1).contains(&x))
+                    && row.get(*lx as usize * bpp..).is_some_and(|px| photocraft_color::read_sample(px, fmt.sample, n - 1) > 0.0)
+            };
+            let Some(first) = (0..side).find(visible) else { continue };
+            let last = (first..side).rfind(visible).unwrap_or(first);
+            out = out.union(&Rect::new(o.x0.saturating_add(first), y, o.x0.saturating_add(last).saturating_add(1), y.saturating_add(1)));
+        }
+        out
+    };
+    tiles.par_iter().map(|(c, t)| tile_bounds(c.rect(), t.bytes())).reduce(|| Rect::EMPTY, |a, b| a.union(&b))
 }
 
 // ---------- layers ----------
@@ -1760,6 +1791,28 @@ mod tests {
         assert_eq!(s.execute("image.revealAll", json!({})).unwrap()["changed"], false);
     }
 
+    #[test]
+    fn reveal_all_skips_erased_pixels() {
+        // #9379: the Eraser only clears alpha, so erased pixels keep their colour bytes; Reveal
+        // All grew the canvas to them although nothing there is visible.
+        // No Background: its off-canvas pixels are opaque and would be revealed anyway.
+        for depth in [8, 16, 32] {
+            let mut s = Session::new();
+            s.execute("file.new", json!({"width": 40, "height": 30, "depth": depth, "background": "transparent"})).unwrap();
+            paint_square(&mut s, Rect::new(0, 0, 40, 30), [1.0, 0.0, 0.0, 1.0]);
+            let erase = json!({"points": [[32, -10], [32, 40]], "size": 28, "erase": true, "brush": {"hardness": 1.0}});
+            s.execute("paint.stroke", erase).unwrap();
+            assert_eq!(pixel(&s, 30, 15)[3], 0.0, "{depth}: erased");
+            s.execute("image.canvasSize", json!({"width": 20, "height": 30, "anchor": "topLeft"})).unwrap();
+            assert_eq!(s.execute("image.revealAll", json!({})).unwrap()["changed"], false, "{depth}");
+            assert_eq!((doc(&s).size.width, doc(&s).size.height), (20, 30), "{depth}");
+            // A pixel that is only partly erased is still there to reveal.
+            paint_square(&mut s, Rect::new(25, 5, 26, 6), [0.0, 0.0, 1.0, 0.5]);
+            assert_eq!(s.execute("image.revealAll", json!({})).unwrap()["changed"], true, "{depth}");
+            assert_eq!((doc(&s).size.width, doc(&s).size.height), (26, 30), "{depth}");
+        }
+    }
+
     #[test]
     fn rasterize_fill_and_all_in_one_step() {
         let mut s = session(8);
diff --git a/crates/engine/src/fill_key_cmds.rs b/crates/engine/src/fill_key_cmds.rs
index ce3b478a70..16585a33d6 100644
--- a/crates/engine/src/fill_key_cmds.rs
+++ b/crates/engine/src/fill_key_cmds.rs
@@ -18,7 +18,7 @@ use crate::{EngineError, Result, Session};
 /// The fill-key command ids (routed to the Channels panel target like `edit.fill`).
 pub const IDS: [&str; 5] = ["edit.fillForeground", "edit.fillBackground", "edit.fillForegroundPreserve", "edit.fillBackgroundPreserve", "edit.fillHistory"];
 
-const PARAMS: &str = r##"{"layer":id?,"target":"pixels"|"mask"|"quickMask"|{"channel":i}?}"##;
+const PARAMS: &str = r##"{"layer":id?,"target":"pixels"|"mask"|"filterMask"|"quickMask"|{"channel":i}?}"##;
 
 /// The shape or type layer the colour fill keys recolor instead of filling pixels.
 fn target_live_layer(s: &Session, p: &Value) -> Option<LayerId> {
diff --git a/crates/engine/src/filters/validation.rs b/crates/engine/src/filters/validation.rs
index b2359ffa57..f9bc1a4eec 100644
--- a/crates/engine/src/filters/validation.rs
+++ b/crates/engine/src/filters/validation.rs
@@ -161,9 +161,9 @@ pub(crate) fn validate_params(id: &str, params: &Value) -> Result<()> {
                 "layer" => (value.as_u64().is_some(), "an unsigned layer id".into()),
                 "coalesce" => (value.is_string(), "a string".into()),
                 "target" => (
-                    value.as_str().is_some_and(|s| matches!(s, "pixels" | "mask" | "quickMask"))
+                    value.as_str().is_some_and(|s| matches!(s, "pixels" | "mask" | "filterMask" | "quickMask"))
                         || value.as_object().is_some_and(|o| o.len() == 1 && o.get("channel").and_then(Value::as_u64).is_some()),
-                    "pixels, mask, quickMask or {\"channel\":index}".into(),
+                    "pixels, mask, filterMask, quickMask or {\"channel\":index}".into(),
                 ),
                 _ => return Err(bad(format!("unknown parameter `{key}`"))),
             }
diff --git a/crates/engine/src/float_cmds.rs b/crates/engine/src/float_cmds.rs
index 12b06bd76e..19ac191900 100644
--- a/crates/engine/src/float_cmds.rs
+++ b/crates/engine/src/float_cmds.rs
@@ -291,7 +291,7 @@ fn float(s: &mut Session, p: &Value) -> Result<Value> {
     let st = s.active_mut().ok_or(EngineError::NoDocument)?;
     if floating(st).is_none() {
         let layer = st.active_layer.ok_or_else(|| EngineError::Other("no active layer".into()))?;
-        let parts = CutParts::new(&st.doc, layer, copy, background, crate::commands::is_mask_target(p))?;
+        let parts = CutParts::new(&st.doc, layer, copy, background, crate::channel_cmds::target_of(p) == crate::channel_cmds::Target::Mask)?;
         st.floating = Some(Floating { layer, offset: (0, 0), revision: st.revision, parts: Arc::new(parts), moved: false });
     }
     let f = st.floating.as_mut().ok_or(EngineError::NoDocument)?;
@@ -333,7 +333,8 @@ pub fn drop_floating(s: &mut Session) -> Result<Value> {
 
 /// Commands that leave a floating piece floating: its own, and ones that don't touch documents.
 fn keeps_floating(id: &str) -> bool {
-    matches!(id, "select.float" | "select.drop") || ["view.", "window.", "help.", "prefs."].iter().any(|p| id.starts_with(p))
+    matches!(id, "select.float" | "select.drop" | "brush.mixer.sample" | "brush.mixer.load" | "brush.mixer.clean")
+        || ["view.", "window.", "help.", "prefs."].iter().any(|p| id.starts_with(p))
 }
 
 /// Before any command (`Session::dispatch`): Undo puts a floating piece back (and is used up:
diff --git a/crates/engine/src/hidden_target.rs b/crates/engine/src/hidden_target.rs
index 249317354a..977d642f21 100644
--- a/crates/engine/src/hidden_target.rs
+++ b/crates/engine/src/hidden_target.rs
@@ -32,6 +32,7 @@ const GATED: &[&str] = &[
     "paint.sharpen",
     "paint.smudge",
     "paint.historyBrush",
+    "paint.artHistoryBrush",
     "layer.translate",
 ];
 
diff --git a/crates/engine/src/history_cmds.rs b/crates/engine/src/history_cmds.rs
index 14bfbffd54..0596bbb12d 100644
--- a/crates/engine/src/history_cmds.rs
+++ b/crates/engine/src/history_cmds.rs
@@ -101,6 +101,12 @@ fn snapshot_index(s: &Session, cmd: &str, p: &Value) -> Result<usize> {
     st.snapshots.iter().position(|snap| snap.id == id).ok_or_else(|| bad(cmd, format!("no snapshot {id}")))
 }
 
+/// The name `history.newSnapshot` gives a snapshot without one: "Snapshot N" (the New Snapshot
+/// dialog suggests it too).
+pub fn next_snapshot_name(st: &crate::DocState) -> String {
+    format!("Snapshot {}", st.next_snapshot)
+}
+
 /// A non-blank `name` param, trimmed; `None` when absent.
 fn name_param(cmd: &str, p: &Value) -> Result<Option<String>> {
     match p.get("name") {
@@ -140,9 +146,9 @@ fn new_snapshot(s: &mut Session, p: &Value) -> Result<Value> {
         _ => (st.doc.clone(), st.layer_target()),
     };
     let st = s.active_mut().ok_or(EngineError::NoDocument)?;
+    let name = name.unwrap_or_else(|| next_snapshot_name(st));
     let id = st.next_snapshot;
     st.next_snapshot = id.saturating_add(1);
-    let name = name.unwrap_or_else(|| format!("Snapshot {id}"));
     st.snapshots.push(Snapshot { id, name: name.clone(), doc, layers });
     Ok(json!({ "snapshot": id, "name": name }))
 }
@@ -413,7 +419,8 @@ mod tests {
         assert_eq!(entries(&s), before, "taking a snapshot is not a step");
         let r = s.execute("history.newSnapshot", json!({"name": "Before green"})).unwrap();
         assert_eq!(r, json!({"snapshot": 2, "name": "Before green"}));
-        assert_eq!(snapshots(&s), json!([{"id": 1, "name": "Snapshot 1"}, {"id": 2, "name": "Before green"}]));
+        let first = json!({"id": 0, "name": s.active().unwrap().doc.name});
+        assert_eq!(snapshots(&s), json!([first, {"id": 1, "name": "Snapshot 1"}, {"id": 2, "name": "Before green"}]));
     }
 
     #[test]
@@ -433,7 +440,7 @@ mod tests {
         assert!(s.active().unwrap().active_layer.is_some());
         s.execute("edit.undo", json!({})).unwrap();
         assert_eq!(top_pixel(&s), blue, "undo leaves the snapshot");
-        assert_eq!(snapshots(&s).as_array().unwrap().len(), 1, "snapshots are not history");
+        assert_eq!(snapshots(&s).as_array().unwrap().len(), 2, "snapshots are not history");
     }
 
     #[test]
@@ -465,7 +472,7 @@ mod tests {
         let base = with.active().unwrap().memory_bytes();
         with.execute("history.newSnapshot", json!({"from": "mergedLayers"})).unwrap();
         let st = with.active().unwrap();
-        let flat = tile_bytes(&st.snapshots[0].doc);
+        let flat = tile_bytes(&st.snapshots.last().unwrap().doc);
         assert!(flat > 0);
         assert_eq!(st.memory_bytes(), base + flat);
         // Room for the document's tiles and four fill tiles.
@@ -494,11 +501,11 @@ mod tests {
         s.execute("edit.fill", json!({"color": "#0000ff"})).unwrap();
         let st = s.active().unwrap();
         // The snapshot's green layer tile, now only in it and the last state.
-        let shared = tile_bytes(&Document { layers: st.snapshots[0].doc.layers[1..].to_vec(), ..(*st.doc).clone() });
+        let shared = tile_bytes(&Document { layers: st.snapshots.last().unwrap().doc.layers[1..].to_vec(), ..(*st.doc).clone() });
         let all = st.history.unique_bytes(&st.doc);
         let r = s.execute("edit.purge.histories", json!({})).unwrap();
         assert_eq!(r["bytes"], json!(all - shared), "the green tile stays with the snapshot");
-        assert_eq!(s.active().unwrap().snapshots.len(), 1);
+        assert_eq!(s.active().unwrap().snapshots.len(), 2, "the first snapshot and the new one");
     }
 
     #[test]
@@ -509,11 +516,31 @@ mod tests {
         }
         s.execute("history.renameSnapshot", json!({"snapshot": 2, "name": "Lesson start"})).unwrap();
         s.execute("history.deleteSnapshot", json!({"snapshot": 1})).unwrap();
-        assert_eq!(snapshots(&s), json!([{"id": 2, "name": "Lesson start"}, {"id": 3, "name": "Snapshot 3"}]));
+        s.execute("history.deleteSnapshot", json!({"snapshot": 0})).unwrap();
+        assert_eq!(snapshots(&s), json!([{"id": 2, "name": "Lesson start"}, {"id": 3, "name": "Snapshot 3"}]), "the first snapshot can go too");
         let r = s.execute("history.newSnapshot", json!({})).unwrap();
         assert_eq!(r["snapshot"], json!(4), "ids are never reused");
     }
 
+    /// Photoshop's first snapshot (#2966): every document starts with a snapshot of itself as
+    /// opened, named after it, so the opening state can always be brought back, even after
+    /// History has dropped its oldest states.
+    #[test]
+    fn a_document_starts_with_a_first_snapshot_of_itself() {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 20, "height": 10})).unwrap();
+        let name = s.active().unwrap().doc.name.clone();
+        assert_eq!(snapshots(&s), json!([{"id": 0, "name": name}]));
+        let opened = top_pixel(&s);
+        for _ in 0..3 {
+            s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        }
+        s.active_mut().unwrap().history.purge_last();
+        s.execute("history.selectSnapshot", json!({"snapshot": 0})).unwrap();
+        assert_eq!(top_pixel(&s), opened, "back to the document as opened");
+        assert_eq!(entries(&s).last(), Some(&name), "a state named after the document");
+    }
+
     #[test]
     fn snapshot_commands_refuse_bad_params() {
         let mut s = Session::new();
diff --git a/crates/engine/src/history_source_cmds.rs b/crates/engine/src/history_source_cmds.rs
index c84cbe8400..908e6d11d3 100644
--- a/crates/engine/src/history_source_cmds.rs
+++ b/crates/engine/src/history_source_cmds.rs
@@ -366,7 +366,6 @@ mod tests {
             json!({"state": 1.5}),
             json!({"state": "1"}),
             json!({"state": [1]}),
-            json!({"snapshot": 0}),
             json!({"snapshot": 1}),
             json!({"snapshot": -1}),
             json!({"snapshot": "Open"}),
@@ -376,5 +375,7 @@ mod tests {
             assert!(s.execute(CMD, p.clone()).is_err(), "{p}");
         }
         assert_eq!(s.active().unwrap().history.brush_source(), Some(0), "nothing changed");
+        // Snapshot 0 is the document as opened, so it is a valid source.
+        assert_eq!(s.execute(CMD, json!({"snapshot": 0})).unwrap()["snapshot"], 0);
     }
 }
diff --git a/crates/engine/src/image_cmds.rs b/crates/engine/src/image_cmds.rs
index 6353f1f2cc..1efc9c0a0e 100644
--- a/crates/engine/src/image_cmds.rs
+++ b/crates/engine/src/image_cmds.rs
@@ -610,6 +610,8 @@ fn crop(s: &mut Session, p: &Value) -> Result<Value> {
     s.edit("Crop", |doc, active| {
         let original = doc.size;
         crop_doc(doc, "image.crop", r, delete, extension)?;
+        // A straight crop fills all of the area past the old canvas, pixels an earlier Delete Cropped
+        // Pixels off crop hid there included, as Photoshop does; only a turned frame keeps them (#8060).
         if content_aware {
             crate::crop_fill::fill_uncovered(doc, *active, &crate::crop_fill::Coverage::crop(r, original.width, original.height))?;
         }
@@ -769,6 +771,15 @@ fn rotated_crop(s: &mut Session, r: Rect, angle: f64, delete: bool, content_awar
         width: f64::from(size.width),
         height: f64::from(size.height),
         rotated: true,
+        held: None,
+    };
+    // The pixels before the turn: under a turned frame a Delete Cropped Pixels off crop's hidden ones
+    // count as image, as in Photoshop (a straight crop fills over them) (#8060).
+    let coverage = if content_aware {
+        let d = s.active().ok_or(EngineError::NoDocument)?;
+        coverage.holding(&d.doc, d.active_layer)
+    } else {
+        coverage
     };
     crate::analysis_cmds::compound(s, "Crop", |s| {
         // Pixels the crop deletes needn't be turned first: keeping only what lands in the frame
diff --git a/crates/engine/src/jobs.rs b/crates/engine/src/jobs.rs
index 5c26e41cba..ffa4db96cb 100644
--- a/crates/engine/src/jobs.rs
+++ b/crates/engine/src/jobs.rs
@@ -229,6 +229,7 @@ struct Running {
     started_ms: f64,
     coalesce: Option<String>,
     color_restrict: Option<usize>,
+    filter_mask_layer: Option<LayerId>,
     /// The document's layer selection when the job started: applying targets it, not whatever
     /// got selected meanwhile (a Type click does that without editing the document, #7366).
     layers: Option<LayerSelection>,
@@ -418,6 +419,7 @@ pub fn run<T: Send + 'static>(
         started_ms: now_ms(),
         coalesce: s.coalesce_request.clone(),
         color_restrict: s.color_restrict,
+        filter_mask_layer: s.filter_mask_layer,
         layers,
         rx,
         apply: Some(erased),
@@ -762,6 +764,9 @@ impl Session {
 
     /// Run the command `id`: inline, or (with `background`) as a job when it is one.
     pub(crate) fn dispatch(&mut self, id: &str, params: Value, background: bool) -> Result<Started> {
+        // The offer belongs to this one dispatch. Early errors drop it locally, including
+        // authorization, validation, floating-selection and admission failures.
+        let live_commit = self.live_commit.take();
         let spec = crate::commands::find(id).ok_or_else(|| EngineError::UnknownCommand(id.to_string()))?;
         // Params are named fields: anything but an object (or null, meaning none) is a caller
         // mistake, not "use every default".
@@ -818,6 +823,7 @@ impl Session {
         let expand_new_fx = crate::commands::layer_panel_option(self, "expandNewEffects", true);
         self.coalesce_request = params.get("coalesce").and_then(Value::as_str).map(str::to_string);
         self.color_restrict = crate::channel_cmds::color_restriction(self, id, &run_params);
+        self.filter_mask_layer = crate::channel_cmds::filter_mask_layer(self, id, &run_params);
         self.jobs.spawn = background;
         // Commands this one runs on its own behalf journal after this mark (#3067).
         let nested_from = self.journal.len();
@@ -830,14 +836,17 @@ impl Session {
         // Last-resort guard (AGENTS.md, Never crash): a command that panics anyway fails with an
         // error instead of taking the app down. `edit` only commits a document after its closure
         // returns, so the documents are unchanged.
+        self.live_commit = live_commit.filter(|live| live.cmd == id);
         let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| (spec.run)(self, &run_params)))
             .unwrap_or_else(|_| Err(EngineError::Other(format!("`{id}` failed with an internal error (logged); the document is unchanged"))));
+        self.live_commit = None;
         if self.actions.recording.is_none() {
             self.actions.recording = recording;
         }
         self.jobs.spawn = false;
         self.coalesce_request = None;
         self.color_restrict = None;
+        self.filter_mask_layer = None;
         let pending = self.jobs.pending.take();
         match (r, pending) {
             (Err(e), Some(job)) => {
@@ -950,7 +959,8 @@ impl Session {
     }
 
     fn apply_job(&mut self, job: &Running, apply: Option<Apply>, payload: Payload) -> Result<Value> {
-        let Running { label, doc, snapshot, coalesce, color_restrict, layers, command, params, journal, recorded_by, pre_selected, .. } = job;
+        let Running { label, doc, snapshot, coalesce, color_restrict, filter_mask_layer, layers, command, params, journal, recorded_by, pre_selected, .. } =
+            job;
         // A recording started after the job (#7289) keeps what it has so far, and the job's step
         // goes into the journal past its start, so that recording doesn't get it.
         let foreign = self.actions.recording.is_some() && *recorded_by != Some(self.actions.take);
@@ -967,6 +977,7 @@ impl Session {
                     return Err(EngineError::Other(format!("`{label}`: the document changed while it ran; the result was discarded")));
                 }
                 self.active = Some(i);
+                self.note_active_change();
                 Some(i)
             }
             None => None,
@@ -986,6 +997,7 @@ impl Session {
         };
         self.coalesce_request = coalesce.clone();
         self.color_restrict = *color_restrict;
+        self.filter_mask_layer = *filter_mask_layer;
         // Apply-time hooks can dispatch commands too. Keep the same single-step recording
         // contract as synchronous dispatch without truncating work done while the worker ran.
         let nested_from = self.journal.len();
@@ -1000,6 +1012,7 @@ impl Session {
         }
         self.coalesce_request = None;
         self.color_restrict = None;
+        self.filter_mask_layer = None;
         // Finish successful command bookkeeping on the document the job edited.
         // Restoring the viewed document first would attribute Fade and slice updates
         // to that document instead, when the user switched tabs mid-job.
@@ -1022,11 +1035,15 @@ impl Session {
         // This also restores the selection when the apply step returned an error.
         if target.is_some() && self.active == target {
             self.active = prev_active.filter(|i| *i < self.docs.len()).or(self.active);
+            self.note_active_change();
         }
         r
     }
 
     fn end_job(&mut self, job: &Running, outcome: JobOutcome) {
+        // Every terminal path invalidates a preview, including worker errors, cancellation
+        // and discarded results whose document was closed or changed.
+        self.live_commit = None;
         let (state, result, error) = match &outcome {
             JobOutcome::Done(v) => ("done", Some(v.clone()), None),
             JobOutcome::Failed(e) => ("failed", None, Some(e.clone())),
diff --git a/crates/engine/src/jobs_tests.rs b/crates/engine/src/jobs_tests.rs
index 8ae8d904d3..0974a5c17a 100644
--- a/crates/engine/src/jobs_tests.rs
+++ b/crates/engine/src/jobs_tests.rs
@@ -727,3 +727,58 @@ fn a_job_lands_in_the_recording_it_was_started_in_only() {
     s.execute("actions.stop", json!({})).unwrap();
     assert_eq!(action_steps(&mut s, "A"), ["filter.blur.gaussianBlur"]);
 }
+
+/// Exercise six terminal job routes so prepared paint snapshots cannot outlive a completed or discarded job.
+#[test]
+fn every_job_terminal_path_drops_a_live_commit_stroke() {
+    use crate::brush_cmds::mixer_live::LiveMixer;
+    use std::sync::atomic::{AtomicBool, Ordering};
+
+    for outcome in 0..6 {
+        let mut s = session(32, 32);
+        let live = LiveMixer::begin(&s, &json!({"points": [[16, 16]], "size": 4})).unwrap();
+        live.prepare_commit(&mut s).unwrap();
+        let gate = Arc::new(AtomicBool::new(false));
+        let worker_gate = gate.clone();
+        let id = job(s
+            .start_job(
+                "test.mixer_cleanup",
+                json!({}),
+                "Mixer cleanup",
+                true,
+                move |ctx| {
+                    while !worker_gate.load(Ordering::Relaxed) {
+                        ctx.check()?;
+                        std::thread::sleep(Duration::from_millis(1));
+                    }
+                    if outcome == 1 { Err(EngineError::Other("worker failed".into())) } else { Ok(()) }
+                },
+                move |_, ()| {
+                    if outcome == 4 { Err(EngineError::Other("apply failed".into())) } else { Ok(json!({})) }
+                },
+            )
+            .unwrap());
+        assert!(s.live_commit.is_some());
+        if outcome == 2 {
+            assert!(s.cancel_job(id));
+            s.join_cancelled_jobs();
+        } else {
+            if outcome == 3 {
+                // Simulate replacement outside command dispatch, which itself clears offers.
+                let doc = (*s.active().unwrap().doc).clone();
+                s.active_mut().unwrap().doc = Arc::new(doc);
+            } else if outcome == 5 {
+                s.docs.clear();
+                s.active = None;
+            }
+            gate.store(true, Ordering::Relaxed);
+        }
+        let event = wait_event(&mut s, id);
+        match outcome {
+            0 => assert!(matches!(event.outcome, JobOutcome::Done(_))),
+            2 => assert!(matches!(event.outcome, JobOutcome::Cancelled)),
+            _ => assert!(matches!(event.outcome, JobOutcome::Failed(_))),
+        }
+        assert!(s.live_commit.is_none(), "terminal path {outcome} retained the preview");
+    }
+}
diff --git a/crates/engine/src/lens_cmds.rs b/crates/engine/src/lens_cmds.rs
index c68469f40f..66a5ccfcf6 100644
--- a/crates/engine/src/lens_cmds.rs
+++ b/crates/engine/src/lens_cmds.rs
@@ -472,7 +472,7 @@ pub fn specs() -> Vec<CommandSpec> {
             label: "Camera Raw Filter…",
             menu: &["Filter"],
             shortcut: Some("Cmd+Shift+A"),
-            params: r##"{"temperature":-100..100=0,"tint":-100..100=0,"exposure":-5..5=0,"contrast":-100..100=0,"highlights":-100..100=0,"shadows":-100..100=0,"whites":-100..100=0,"blacks":-100..100=0,"texture":-100..100=0,"clarity":-100..100=0,"dehaze":-100..100=0,"vibrance":-100..100=0,"saturation":-100..100=0,"curveHighlights":-100..100=0,"curveLights":-100..100=0,"curveDarks":-100..100=0,"curveShadows":-100..100=0,"curveSplits":[25,50,75],"pointCurve":[[in,out]],"pointCurveRed":[[in,out]],"pointCurveGreen":[[in,out]],"pointCurveBlue":[[in,out]],"hslHue":[8],"hslSat":[8],"hslLum":[8],"gradeShadows":{"hue":deg,"sat":0..100,"lum":-100..100},"gradeMidtones":{},"gradeHighlights":{},"gradeGlobal":{},"gradeBlending":0..100=50,"gradeBalance":-100..100=0,"sharpenAmount":0..150=0,"sharpenRadius":0.5..3=1,"sharpenDetail":0..100=25,"sharpenMasking":0..100=0,"noiseLuminance":0..100=0,"noiseLuminanceDetail":0..100=50,"noiseColor":0..100=0,"noiseColorDetail":0..100=50,"grainAmount":0..100=0,"grainSize":0..100=25,"grainRoughness":0..100=50,"vignetteAmount":-100..100=0,"vignetteMidpoint":0..100=50,"vignetteRoundness":-100..100=0,"vignetteFeather":0..100=50,"vignetteHighlights":0..100=0,"vignetteStyle":"highlightPriority|colorPriority|paintOverlay","seed":u32=0}"##,
+            params: r##"{"temperature":-100..100=0,"tint":-100..100=0,"exposure":-5..5=0,"contrast":-100..100=0,"highlights":-100..100=0,"shadows":-100..100=0,"whites":-100..100=0,"blacks":-100..100=0,"texture":-100..100=0,"clarity":-100..100=0,"dehaze":-100..100=0,"vibrance":-100..100=0,"saturation":-100..100=0,"curveHighlights":-100..100=0,"curveLights":-100..100=0,"curveDarks":-100..100=0,"curveShadows":-100..100=0,"curveSplits":[25,50,75],"pointCurve":[[in,out]],"pointCurveRed":[[in,out]],"pointCurveGreen":[[in,out]],"pointCurveBlue":[[in,out]],"hslHue":[8],"hslSat":[8],"hslLum":[8],"gradeShadows":{"hue":deg,"sat":0..100,"lum":-100..100},"gradeMidtones":{},"gradeHighlights":{},"gradeGlobal":{},"gradeBlending":0..100=50,"gradeBalance":-100..100=0,"shadowTint":-100..100=0,"calibrationHue":[red,green,blue] -100..100,"calibrationSat":[red,green,blue] -100..100 (the Calibration panel: Shadows tint and the primaries' hue and saturation),"sharpenAmount":0..150=0,"sharpenRadius":0.5..3=1,"sharpenDetail":0..100=25,"sharpenMasking":0..100=0,"noiseLuminance":0..100=0,"noiseLuminanceDetail":0..100=50,"noiseColor":0..100=0,"noiseColorDetail":0..100=50,"grainAmount":0..100=0,"grainSize":0..100=25,"grainRoughness":0..100=50,"vignetteAmount":-100..100=0,"vignetteMidpoint":0..100=50,"vignetteRoundness":-100..100=0,"vignetteFeather":0..100=50,"vignetteHighlights":0..100=0,"vignetteStyle":"highlightPriority|colorPriority|paintOverlay","seed":u32=0}"##,
             enabled: raw_enabled,
             run: camera_raw_cmd,
             journal: true,
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 44cbe903ad..c49e555071 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -244,8 +244,9 @@ pub struct DocState {
     /// pixel coordinates. Per-document view state: discarded when the document closes, never saved
     /// to `.pcraft` or PSD, and not a history step.
     pub color_samplers: Vec<[f64; 2]>,
-    /// History panel snapshots, oldest first (`history.newSnapshot`, #2966). Kept for the
-    /// session only, as in Photoshop: not history states, and not saved with the document.
+    /// History panel snapshots, oldest first (`history.newSnapshot`, #2966): the first (id 0) is
+    /// the document as opened. Kept for the session only, as in Photoshop: not history states,
+    /// and not saved with the document.
     pub snapshots: Vec<history_cmds::Snapshot>,
     /// The id the next snapshot gets; ids are never reused, so deleting one keeps the others.
     next_snapshot: u64,
@@ -272,9 +273,14 @@ impl DocState {
     pub fn new(doc: Document, path: Option<String>) -> Self {
         let active_layer = doc.top_layer();
         let mut history = History::default();
-        history.set_current_layers(LayerTarget { active: active_layer, selected: active_layer.into_iter().collect() });
+        let target = LayerTarget { active: active_layer, selected: active_layer.into_iter().collect() };
+        history.set_current_layers(target.clone());
+        let doc = Arc::new(doc);
+        // Photoshop's first snapshot: the document as opened, named after it, so the History
+        // panel's top row can always bring it back (#2966).
+        let first = history_cmds::Snapshot { id: 0, name: doc.name.clone(), doc: doc.clone(), layers: target };
         Self {
-            doc: Arc::new(doc),
+            doc,
             history,
             active_layer,
             selected_layers: active_layer.into_iter().collect(),
@@ -294,7 +300,7 @@ impl DocState {
             show_only: None,
             floating: None,
             color_samplers: Vec::new(),
-            snapshots: Vec::new(),
+            snapshots: vec![first],
             next_snapshot: 1,
             source_snapshot: None,
         }
@@ -470,6 +476,12 @@ pub const PRECHECKED: &[&str] = &["layer.new.layer", "layer.new.group", "layer.n
 pub struct Session {
     docs: Vec<DocState>,
     active: Option<usize>,
+    /// Monotonic counter, bumped whenever a different document becomes active (including a
+    /// switch away and back inside one pass). UI work that must not cross documents (control
+    /// screenshots, automation input) binds to it.
+    active_generation: u64,
+    /// The document id [`Self::active_generation`] was last bumped for.
+    active_doc_for_generation: Option<photocraft_doc::DocId>,
     pub tools: ToolState,
     /// Log of executed commands (for action recording and debugging).
     pub journal: Vec<(String, Value)>,
@@ -493,6 +505,9 @@ pub struct Session {
     pub quick_mask_options: channel_cmds::QuickMaskOptions,
     /// Colour channel the running command may change (a single colour channel is targeted).
     color_restrict: Option<usize>,
+    /// Smart object whose filter mask the running command edits (`"target":"filterMask"`): each
+    /// edit re-renders it, in the same history step.
+    filter_mask_layer: Option<LayerId>,
     /// Edit › Preferences, keyboard shortcuts, menu and toolbar customisation (see `prefs`).
     pub prefs: prefs::PrefsStore,
     /// Release checks use an injected platform transport; no network I/O in the engine.
@@ -581,9 +596,25 @@ impl Session {
     pub fn active_mut(&mut self) -> Option<&mut DocState> {
         self.active.and_then(|i| self.docs.get_mut(i))
     }
+    /// Monotonic active-document generation. It changes when a different document becomes
+    /// active, including a switch away and back between two observations; equal values therefore
+    /// mean the document was not switched in between.
+    pub fn active_generation(&self) -> u64 {
+        self.active_generation
+    }
+    /// Bump [`Self::active_generation`] when the active document id changed. Call after every
+    /// assignment to `self.active`.
+    pub(crate) fn note_active_change(&mut self) {
+        let id = self.active().map(|st| st.doc.id);
+        if id != self.active_doc_for_generation {
+            self.active_doc_for_generation = id;
+            self.active_generation = self.active_generation.wrapping_add(1);
+        }
+    }
     pub fn set_active(&mut self, index: usize) -> bool {
         if index < self.docs.len() {
             self.active = Some(index);
+            self.note_active_change();
             self.sync_tools_mask_target();
             true
         } else {
@@ -623,6 +654,7 @@ impl Session {
         let active = self.active().map(|d| d.doc.id);
         let to = move_item(&mut self.docs, from, to)?;
         self.active = active.and_then(|id| self.docs.iter().position(|d| d.doc.id == id));
+        self.note_active_change();
         Some(to)
     }
 
@@ -640,6 +672,7 @@ impl Session {
         self.docs.push(st);
         let i = self.docs.len() - 1;
         self.active = Some(i);
+        self.note_active_change();
         i
     }
 
@@ -678,6 +711,7 @@ impl Session {
                 _ => index.min(self.docs.len() - 1),
             })
         };
+        self.note_active_change();
         Some(d)
     }
 
@@ -833,7 +867,7 @@ impl Session {
         let d = self.active_mut()?;
         d.doc.layer(target)?;
         let active = d.active_layer.replace(target);
-        let r = (spec.enabled)(self);
+        let r = self.precondition(spec, params);
         if let Some(d) = self.active_mut() {
             d.active_layer = active;
         }
@@ -847,6 +881,7 @@ impl Session {
         let _authorization = crate::jobs::render_authorization_scope(self.authorize);
         let _document = crate::doc_path::scope(self.active().and_then(|d| d.path.as_deref()).map(std::path::Path::new));
         let restrict = self.color_restrict;
+        let filter_mask_layer = self.filter_mask_layer;
         let sampler_map = self.sampler_map.take();
         let symmetry_map = self.symmetry_map.take();
         let st = self.active_mut().ok_or(EngineError::NoDocument)?;
@@ -860,6 +895,9 @@ impl Session {
         if let (Some(k), Some(id)) = (restrict, active) {
             channel_cmds::restrict_to_color(&before, &mut doc, id, k);
         }
+        if let Some(id) = filter_mask_layer {
+            smart_cmds::refresh_after_filter_mask_edit(&mut doc, id)?;
+        }
         st.doc = Arc::new(doc);
         st.active_layer = active;
         fix_selection(st);
diff --git a/crates/engine/src/mask_view_cmds.rs b/crates/engine/src/mask_view_cmds.rs
index 403a6a0a47..6244f7bb23 100644
--- a/crates/engine/src/mask_view_cmds.rs
+++ b/crates/engine/src/mask_view_cmds.rs
@@ -7,6 +7,9 @@
 //! While a mask is shown, pixel commands without an explicit `target` edit that mask
 //! ([`crate::channel_cmds`]'s target injection), so painting in mask view paints the mask.
 //! The view ends when its layer stops being the active layer or loses its mask ([`fix`]).
+//!
+//! With `"mask":"filter"` the same view shows a smart object's filter mask (⌥-click the filter
+//! mask thumbnail on its Smart Filters row), and painting while it's shown paints that mask.
 
 use photocraft_doc::LayerId;
 use serde::Serialize;
@@ -35,6 +38,19 @@ pub enum MaskViewMode {
 pub struct LayerMaskView {
     pub layer: LayerId,
     pub mode: MaskViewMode,
+    /// The smart object's filter mask is shown, not its layer mask.
+    pub filter: bool,
+}
+
+/// The mask a view of `l` shows: its layer mask, or (`filter`) its smart filter mask.
+pub fn viewed_mask(l: &photocraft_doc::Layer, filter: bool) -> Option<&photocraft_doc::LayerMask> {
+    if !filter {
+        return l.mask.as_ref();
+    }
+    match &l.content {
+        photocraft_doc::LayerContent::Smart(sm) => sm.filter_mask.as_ref(),
+        _ => None,
+    }
 }
 
 fn bad(msg: impl Into<String>) -> EngineError {
@@ -48,7 +64,7 @@ fn has_doc(s: &Session) -> std::result::Result<(), String> {
 /// The mask view of `st` when it is live: its layer is the active layer and still has a mask.
 pub fn current(st: &DocState) -> Option<LayerMaskView> {
     let v = st.channel_view.layer_mask?;
-    let live = st.active_layer == Some(v.layer) && st.doc.layer(v.layer).is_some_and(|l| l.mask.is_some());
+    let live = st.active_layer == Some(v.layer) && st.doc.layer(v.layer).is_some_and(|l| viewed_mask(l, v.filter).is_some());
     live.then_some(v)
 }
 
@@ -68,16 +84,26 @@ fn mode_name(v: Option<LayerMaskView>) -> &'static str {
     }
 }
 
-/// The view as JSON (`{"layer","mode"}`, or `null` when off); part of `document.inspect`.
+/// The view as JSON (`{"layer","mode"}`, plus `"mask":"filter"` for a filter mask, or `null` when
+/// off); part of `document.inspect`.
 pub fn view_json(st: &DocState) -> Value {
     match current(st) {
+        Some(v) if v.filter => json!({"layer": v.layer.0, "mode": mode_name(Some(v)), "mask": "filter"}),
         Some(v) => json!({"layer": v.layer.0, "mode": mode_name(Some(v))}),
         None => Value::Null,
     }
 }
 
-/// `{"layer":id?,"mode":"off"|"gray"|"overlay"|"toggleGray"|"toggleOverlay"="toggleGray"}`.
+/// `{"layer":id?,"mode":"off"|"gray"|"overlay"|"toggleGray"|"toggleOverlay"="toggleGray","mask":"layer"|"filter"="layer"}`.
 fn set_view(s: &mut Session, p: &Value) -> Result<Value> {
+    let filter = match p.get("mask") {
+        None | Some(Value::Null) => false,
+        Some(v) => match v.as_str() {
+            Some("layer") => false,
+            Some("filter") => true,
+            _ => return Err(bad("`mask` must be \"layer\" or \"filter\"")),
+        },
+    };
     let mode = match p.get("mode") {
         None | Some(Value::Null) => "toggleGray",
         Some(v) => v.as_str().ok_or_else(|| bad("`mode` must be a string"))?,
@@ -88,9 +114,9 @@ fn set_view(s: &mut Session, p: &Value) -> Result<Value> {
         Some(v) => LayerId(v.as_u64().ok_or_else(|| bad("`layer` must be a layer id"))?),
     };
     let l = st.doc.layer(layer).ok_or(EngineError::NoLayer(layer))?;
-    let has_mask = l.mask.is_some();
+    let has_mask = viewed_mask(l, filter).is_some();
     let name = l.name.clone();
-    let shown = current(st).filter(|v| v.layer == layer).map(|v| v.mode);
+    let shown = current(st).filter(|v| v.layer == layer && v.filter == filter).map(|v| v.mode);
     let want = match mode {
         "off" => None,
         "gray" => Some(MaskViewMode::Gray),
@@ -100,16 +126,16 @@ fn set_view(s: &mut Session, p: &Value) -> Result<Value> {
         other => return Err(bad(format!("unknown mode `{other}` (off|gray|overlay|toggleGray|toggleOverlay)"))),
     };
     if want.is_some() && !has_mask {
-        return Err(bad(format!("layer \"{name}\" has no layer mask")));
+        return Err(bad(format!("layer \"{name}\" has no {}", if filter { "filter mask" } else { "layer mask" })));
     }
     // ⌥-clicking another layer's mask selects that layer, as in Photoshop.
     if want.is_some() && s.active().and_then(|st| st.active_layer) != Some(layer) {
         s.select_layer(layer)?;
     }
     let st = s.active_mut().ok_or(EngineError::NoDocument)?;
-    let next = want.map(|mode| LayerMaskView { layer, mode });
+    let next = want.map(|mode| LayerMaskView { layer, mode, filter });
     // "off" for a layer whose mask isn't the one shown leaves the other view alone.
-    let applies = next.is_some() || st.channel_view.layer_mask.is_some_and(|v| v.layer == layer);
+    let applies = next.is_some() || st.channel_view.layer_mask.is_some_and(|v| v.layer == layer && v.filter == filter);
     if applies && st.channel_view.layer_mask != next {
         st.channel_view.layer_mask = next;
         // Hiding the mask while every colour channel is off would leave a blank canvas.
@@ -123,7 +149,7 @@ fn set_view(s: &mut Session, p: &Value) -> Result<Value> {
         st.last_damage = Some(photocraft_geom::Rect::EMPTY);
     }
     let v = current(st);
-    Ok(json!({"layer": layer.0, "mode": mode_name(v.filter(|v| v.layer == layer))}))
+    Ok(json!({"layer": layer.0, "mode": mode_name(v.filter(|v| v.layer == layer && v.filter == filter)), "mask": if filter { "filter" } else { "layer" }}))
 }
 
 /// `\` needs a layer mask on the active layer; without one Photoshop's key does nothing.
@@ -150,7 +176,7 @@ pub fn specs() -> Vec<CommandSpec> {
             label: "View Layer Mask",
             menu: &[],
             shortcut: None,
-            params: r##"{"layer":id?,"mode":"off"|"gray"|"overlay"|"toggleGray"|"toggleOverlay"="toggleGray"} (gray: the mask alone, ⌥-click its thumbnail; overlay: red rubylith over the composite, ⇧⌥-click or `\`; view state, not an undo step; painting while shown paints the mask)"##,
+            params: r##"{"layer":id?,"mode":"off"|"gray"|"overlay"|"toggleGray"|"toggleOverlay"="toggleGray","mask":"layer"|"filter"="layer" (filter: a smart object's filter mask)} (gray: the mask alone, ⌥-click its thumbnail; overlay: red rubylith over the composite, ⇧⌥-click or `\`; view state, not an undo step; painting while shown paints the mask)"##,
             enabled: has_doc,
             run: set_view,
             journal: false,
diff --git a/crates/engine/src/mode_cmds.rs b/crates/engine/src/mode_cmds.rs
index 180f940e91..413b768846 100644
--- a/crates/engine/src/mode_cmds.rs
+++ b/crates/engine/src/mode_cmds.rs
@@ -123,6 +123,8 @@ pub(crate) fn rotate_arbitrary(s: &mut Session, p: &Value) -> Result<Value> {
             } else {
                 // Rotating the whole image moves locked layers too, including inside groups.
                 with_released_movement_locks(l, |l| crate::transform_cmds::transform_layer(None, photocraft_doc::Locks::default(), l, &h, Some(a), interp))?;
+                // Free Transform moves only linked masks; the whole image turns them all (#9201).
+                warp_unlinked_masks(l, &h, interp)?;
             }
             // What Free Transform leaves alone: unlinked vector masks, gradient angles, artboards…
             crate::canvas_geom::transform_layer_geometry(l, &a, false, dpi);
@@ -142,6 +144,24 @@ pub(crate) fn rotate_arbitrary(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"width": size.width, "height": size.height}))
 }
 
+/// Warps the unlinked pixel masks of `l` and its descendants, which [`transform_layer`] leaves in
+/// place.
+///
+/// [`transform_layer`]: crate::transform_cmds::transform_layer
+fn warp_unlinked_masks(l: &mut Layer, h: &Homography, interp: Interp) -> Result<()> {
+    if let Some(m) = l.mask.as_mut()
+        && !m.linked
+    {
+        m.surface = crate::transform_cmds::warp_gray(&m.surface, h, interp)?;
+    }
+    if let LayerContent::Group(g) = &mut l.content {
+        for c in &mut g.children {
+            warp_unlinked_masks(c, h, interp)?;
+        }
+    }
+    Ok(())
+}
+
 /// Runs `f` with movement locks (`position` and `all`) temporarily released on `l` and all its
 /// descendants, so canvas-wide rotation moves every layer, then restores each lock.
 fn with_released_movement_locks<R>(l: &mut Layer, f: impl FnOnce(&mut Layer) -> Result<R>) -> Result<R> {
diff --git a/crates/engine/src/mode_cmds/tests.rs b/crates/engine/src/mode_cmds/tests.rs
index 84d816a349..21836ff5ae 100644
--- a/crates/engine/src/mode_cmds/tests.rs
+++ b/crates/engine/src/mode_cmds/tests.rs
@@ -144,6 +144,59 @@ fn rotate_arbitrary_rotates_grouped_locked_children_and_preserves_lock() {
     assert_eq!(photocraft_compose::flatten(&d_arb).px, photocraft_compose::flatten(d_cw).px);
 }
 
+/// Rotating the whole image turns every layer mask, linked or not, as Rotate 180° does (#9201).
+#[test]
+fn rotate_arbitrary_turns_unlinked_layer_masks() {
+    for depth in [8, 16] {
+        for grouped in [false, true] {
+            let mut s = Session::new();
+            s.execute("file.new", json!({"width": 40, "height": 30, "depth": depth, "background": "white"})).unwrap();
+            s.execute("layer.new.layer", json!({"name": "Paint"})).unwrap();
+            s.execute("select.rect", json!({"x": 0, "y": 0, "width": 10, "height": 10})).unwrap();
+            s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+            s.execute("layer.layerMask.revealSelection", json!({})).unwrap();
+            s.execute("layer.layerMask.linked", json!({"linked": false})).unwrap();
+            let id = s.active().unwrap().active_layer.unwrap();
+            if grouped {
+                s.execute("layer.groupLayers", json!({})).unwrap();
+            }
+            let mask = |s: &Session| doc(s).layer(id).unwrap().mask.clone().unwrap();
+            let base = s.active().unwrap().doc.clone();
+            s.execute("image.rotation.arbitrary", json!({"angle": 180, "interpolation": "nearest"})).unwrap();
+            let m = mask(&s);
+            assert!(!m.linked);
+            let at = |x, y| m.surface.sample_channel(x, y, 0);
+            assert!(at(34, 24) > 0.9, "{depth}-bit, grouped {grouped}: the mask turned with its layer");
+            assert!(at(4, 4) < 0.1, "{depth}-bit, grouped {grouped}: nothing left at the old place");
+            // Rotate 180° and a crop turned by 180° over the whole canvas give the same mask.
+            for (id_, p) in [("image.imageRotation.180", json!({})), ("image.crop", json!({"x": 0, "y": 0, "width": 40, "height": 30, "angle": 180}))] {
+                s.active_mut().unwrap().doc = base.clone();
+                s.execute(id_, p).unwrap();
+                let turned = mask(&s);
+                for y in 0..30 {
+                    for x in 0..40 {
+                        let (a, b) = (at(x, y), turned.surface.sample_channel(x, y, 0));
+                        assert!((a - b).abs() < 1e-3, "{id_}, {depth}-bit, grouped {grouped}: ({x},{y}) {a} vs {b}");
+                    }
+                }
+            }
+            // 90° pins the direction too (180° is its own inverse).
+            s.active_mut().unwrap().doc = base.clone();
+            s.execute("image.rotation.arbitrary", json!({"angle": 90, "interpolation": "nearest"})).unwrap();
+            let arbitrary = mask(&s);
+            s.active_mut().unwrap().doc = base.clone();
+            s.execute("image.imageRotation.90cw", json!({})).unwrap();
+            let turned = mask(&s);
+            for y in 0..40 {
+                for x in 0..30 {
+                    let (a, b) = (arbitrary.surface.sample_channel(x, y, 0), turned.surface.sample_channel(x, y, 0));
+                    assert!((a - b).abs() < 1e-3, "90cw, {depth}-bit, grouped {grouped}: ({x},{y}) {a} vs {b}");
+                }
+            }
+        }
+    }
+}
+
 #[test]
 fn flattened_mode_pixels_match_the_allocating_conversion_at_every_channel_count() {
     let px = [[0.0, 0.25, 0.75, 0.0], [0.9, 0.3, 0.2, 0.2], [0.1, 0.7, 0.4, 0.7], [1.0; 4]];
diff --git a/crates/engine/src/paint_cmds.rs b/crates/engine/src/paint_cmds.rs
index 4255d796c4..91c0a87356 100644
--- a/crates/engine/src/paint_cmds.rs
+++ b/crates/engine/src/paint_cmds.rs
@@ -1,6 +1,6 @@
 //! Paint helpers: Paint Bucket and Gradient tool.
 
-use photocraft_algo::paint::{GradientShape, bucket_fill_inks, bucket_fill_region_inks, bucket_fill_region_src, bucket_fill_src, paint_gradient};
+use photocraft_algo::paint::{FillMode, GradientShape, bucket_fill_inks, bucket_fill_region_inks, paint_gradient};
 use serde_json::{Value, json};
 
 use crate::commands::{CommandSpec, blend_from_str};
@@ -41,12 +41,27 @@ fn opacity(p: &Value, cmd: &str) -> Result<f32> {
     Ok(crate::eraser_cmds::number(p, cmd, "opacity", 100.0, 1.0..=100.0)? as f32 / 100.0)
 }
 
+/// The Paint Bucket's `mode`: a blend mode (not Pass Through, a group's) or `clear`.
+fn fill_mode(p: &Value) -> Result<FillMode> {
+    let bad = |msg: String| EngineError::BadParams { cmd: "paint.bucket".into(), msg };
+    match p.get("mode") {
+        None | Some(Value::Null) => Ok(FillMode::Blend(photocraft_color::BlendMode::Normal)),
+        Some(Value::String(m)) if m.eq_ignore_ascii_case("clear") => Ok(FillMode::Clear),
+        Some(Value::String(m)) => blend_from_str(m)
+            .filter(|m| *m != photocraft_color::BlendMode::PassThrough)
+            .map(FillMode::Blend)
+            .ok_or_else(|| bad(format!("unknown blend mode `{m}`"))),
+        Some(v) => Err(bad(format!("`mode` must be a blend mode name or `clear`, not {v}"))),
+    }
+}
+
 fn bucket(s: &mut Session, p: &Value) -> Result<Value> {
     let fg = s.tools.foreground;
     let c = color(p.get("color"), fg);
     let (x, y) = (f(p, "x", 0.0).floor() as i32, f(p, "y", 0.0).floor() as i32);
     let (tol, contiguous, aa) = (f(p, "tolerance", 32.0), b(p, "contiguous", true), b(p, "antiAlias", true));
     let opacity = opacity(p, "paint.bucket")?;
+    let mode = fill_mode(p)?;
     let all = b(p, "sampleAllLayers", false) && crate::channel_cmds::target_of(p) == crate::channel_cmds::Target::Pixels;
     // Other visible layers can define the region, but the fill still writes only to the target.
     let region = if all {
@@ -83,16 +98,16 @@ fn bucket(s: &mut Session, p: &Value) -> Result<Value> {
             let w = area.width() as usize;
             let src = |px: i32, py: i32| rendered[(py - area.y0) as usize * w + (px - area.x0) as usize];
             if let Some(region) = &region {
-                bucket_fill_region_src(surf, region, opacity, sel.as_ref(), lock, src);
+                bucket_fill_region_inks(surf, region, opacity, sel.as_ref(), lock, src, None, mode);
                 true
             } else {
-                bucket_fill_src(surf, area, (x, y), tol, contiguous, aa, opacity, sel.as_ref(), lock, src)
+                bucket_fill_inks(surf, area, (x, y), tol, contiguous, aa, opacity, sel.as_ref(), lock, src, None, mode)
             }
         } else if let Some(region) = &region {
-            bucket_fill_region_inks(surf, region, opacity, sel.as_ref(), lock, |_, _| c, inks);
+            bucket_fill_region_inks(surf, region, opacity, sel.as_ref(), lock, |_, _| c, inks, mode);
             true
         } else {
-            bucket_fill_inks(surf, area, (x, y), tol, contiguous, aa, opacity, sel.as_ref(), lock, |_, _| c, inks)
+            bucket_fill_inks(surf, area, (x, y), tol, contiguous, aa, opacity, sel.as_ref(), lock, |_, _| c, inks, mode)
         };
         surf.prune();
         Ok(ok)
@@ -162,7 +177,7 @@ pub fn specs() -> Vec<CommandSpec> {
             label: "Paint Bucket",
             menu: &[],
             shortcut: None,
-            params: r##"{"x":px,"y":px,"tolerance":0..255=32,"contiguous":bool=true,"antiAlias":bool=true,"sampleAllLayers":bool=false,"contents":"foreground|pattern"="foreground","color":"#rrggbb"=foreground,"pattern":id|name (contents=pattern),"scale":%=100,"angle":deg,"opacity":1..100=100,"target":"pixels"|"mask"|"quickMask"|{"channel":i}=Channels panel target}"##,
+            params: r##"{"x":px,"y":px,"tolerance":0..255=32,"contiguous":bool=true,"antiAlias":bool=true,"sampleAllLayers":bool=false,"contents":"foreground|pattern"="foreground","color":"#rrggbb"=foreground,"pattern":id|name (contents=pattern),"scale":%=100,"angle":deg,"opacity":1..100=100,"mode":"normal|multiply|…|clear (erases the filled area)"="normal","target":"pixels"|"mask"|"filterMask"|"quickMask"|{"channel":i}=Channels panel target}"##,
             enabled: crate::commands::has_paintable,
             run: bucket,
             journal: true,
@@ -172,7 +187,7 @@ pub fn specs() -> Vec<CommandSpec> {
             label: "Gradient",
             menu: &[],
             shortcut: None,
-            params: r##"{"from":[x,y],"to":[x,y],"style":"linear|radial|angle|reflected|diamond"="linear","colors":["#rrggbb",…]? (evenly spaced),"gradient":preset name?,"stops":[[t,"#rrggbb"|"foreground"|"background"],…]?,"transparency":[[t,0..100],…]? (default: the current gradient, see gradient.presets.select),"method":"classic|perceptual|linear|smooth"? (Photoshop's interpolation; omitted: straight stops),"smoothness":0..100=100,"reverse":bool=false,"dither":bool=true,"opacity":1..100=100,"mode":"normal|multiply|…"="normal","target":"pixels"|"mask"|"quickMask"|{"channel":i}=Channels panel target}"##,
+            params: r##"{"from":[x,y],"to":[x,y],"style":"linear|radial|angle|reflected|diamond"="linear","colors":["#rrggbb",…]? (evenly spaced),"gradient":preset name?,"stops":[[t,"#rrggbb"|"foreground"|"background"],…]?,"transparency":[[t,0..100],…]? (default: the current gradient, see gradient.presets.select),"method":"classic|perceptual|linear|smooth"? (Photoshop's interpolation; omitted: straight stops),"smoothness":0..100=100,"reverse":bool=false,"dither":bool=true,"opacity":1..100=100,"mode":"normal|multiply|…"="normal","target":"pixels"|"mask"|"filterMask"|"quickMask"|{"channel":i}=Channels panel target}"##,
             enabled: crate::commands::has_paintable,
             run: gradient,
             journal: true,
@@ -210,6 +225,33 @@ mod tests {
         (s, bottom)
     }
 
+    /// The options bar's Mode reaches the fill: Multiply over grey, Clear erases, a bad name or
+    /// Pass Through is an error and changes nothing.
+    #[test]
+    fn bucket_mode_multiplies_clears_and_rejects_bad_names() {
+        for depth in [8, 16, 32] {
+            let mut s = Session::new();
+            s.execute("file.new", json!({"width": 8, "height": 8, "depth": depth})).unwrap();
+            s.execute("layer.new.layer", json!({})).unwrap();
+            let base = json!({"x": 1, "y": 1, "antiAlias": false, "tolerance": 0});
+            let with = |extra: Value| {
+                let mut p = base.clone();
+                p.as_object_mut().unwrap().extend(extra.as_object().unwrap().clone());
+                p
+            };
+            s.execute("paint.bucket", with(json!({"color": "#808080"}))).unwrap();
+            s.execute("paint.bucket", with(json!({"color": "#ff0000", "mode": "multiply"}))).unwrap();
+            let p = px(&s, 3, 3);
+            assert!((p[0] - 0.5).abs() < 0.01 && p[1] < 0.01 && p[3] > 0.99, "depth {depth}: {p:?}");
+            for bad in [json!("passThrough"), json!("sparkle"), json!(3)] {
+                assert!(s.execute("paint.bucket", with(json!({"mode": bad}))).is_err(), "{bad}");
+            }
+            assert_eq!(px(&s, 3, 3), p, "a refused mode paints nothing");
+            s.execute("paint.bucket", with(json!({"mode": "Clear", "opacity": 50}))).unwrap();
+            assert!((px(&s, 3, 3)[3] - 0.5).abs() < 0.01, "depth {depth}: half cleared");
+        }
+    }
+
     #[test]
     fn bucket_sample_all_layers_uses_visible_boundaries_at_all_depths() {
         for depth in [8, 16, 32] {
diff --git a/crates/engine/src/pattern_cmds.rs b/crates/engine/src/pattern_cmds.rs
index 95163d39f5..5aab2887f0 100644
--- a/crates/engine/src/pattern_cmds.rs
+++ b/crates/engine/src/pattern_cmds.rs
@@ -22,14 +22,36 @@ use crate::{EngineError, Result, Session};
 #[derive(Clone, Debug)]
 pub struct PatternLibrary {
     pub items: Vec<Pattern>,
+    /// Bumped when a pattern's pixels are replaced under the same id (an imported `.pat` whose
+    /// id is already in the library), which its id, name and size don't show.
+    pub pixels_rev: u64,
 }
 
 impl Default for PatternLibrary {
     fn default() -> Self {
-        PatternLibrary { items: builtin() }
+        PatternLibrary { items: builtin(), pixels_rev: 0 }
     }
 }
 
+impl PatternLibrary {
+    /// Add `pat`, or replace the pattern with its id (marking the pixels changed).
+    pub fn upsert(&mut self, pat: Pattern) {
+        match self.items.iter_mut().find(|q| q.id == pat.id) {
+            Some(q) => {
+                *q = pat;
+                self.pixels_rev += 1;
+            }
+            None => self.items.push(pat),
+        }
+    }
+}
+
+/// Whether `p` is a built-in pattern as shipped (same id, name, size and pixels): those are never
+/// saved. A built-in replaced by an import, or renamed, is the user's and is.
+pub(crate) fn is_pristine_builtin(p: &Pattern, builtins: &[Pattern]) -> bool {
+    builtins.iter().any(|b| b.id == p.id && b.name == p.name && (b.width, b.height) == (p.width, p.height) && b.surface == p.surface)
+}
+
 fn hash01(x: u32, y: u32, seed: u32) -> f32 {
     let mut h = x.wrapping_mul(0x8da6_b343) ^ y.wrapping_mul(0xd816_3841) ^ seed.wrapping_mul(0xcb1a_b31f);
     h ^= h >> 13;
@@ -278,10 +300,7 @@ fn import(s: &mut Session, p: &Value) -> Result<Value> {
     let mut ids = Vec::new();
     for pat in pats {
         ids.push(pat.id.clone());
-        match s.patterns.items.iter_mut().find(|q| q.id == pat.id) {
-            Some(q) => *q = pat,
-            None => s.patterns.items.push(pat),
-        }
+        s.patterns.upsert(pat);
     }
     Ok(json!({"imported": ids, "count": ids.len()}))
 }
diff --git a/crates/engine/src/photo_cmds.rs b/crates/engine/src/photo_cmds.rs
index 222866fdd0..a1201ecc71 100644
--- a/crates/engine/src/photo_cmds.rs
+++ b/crates/engine/src/photo_cmds.rs
@@ -829,12 +829,62 @@ fn merge_to_hdr(s: &mut Session, p: &Value) -> Result<Value> {
 
 // ---------- Crop and Straighten Photos ----------
 
+/// Paints the pixels outside the selection (holes, gaps between regions) in
+/// the median colour of the selection's edge, so detection sees them as
+/// background and finds no photo there. Returns false when no pixel is at
+/// least half selected (a faint feathered selection), so the caller refuses
+/// instead of searching the unmasked area.
+fn mask_unselected(sel: &Surface, area: Rect, w: usize, h: usize, rgba: &mut [[f32; 4]]) -> bool {
+    let mut cov = Vec::new();
+    sel.read_region_into(area, &mut cov);
+    let ch = sel.channels().max(1);
+    let inside: Vec<bool> = cov.chunks_exact(ch).map(|p| p[0] >= 0.5).collect();
+    if inside.len() != w * h || rgba.len() != w * h {
+        return true;
+    }
+    if !inside.iter().any(|&b| b) {
+        return false;
+    }
+    if inside.iter().all(|&b| b) {
+        return true;
+    }
+    let is_in = |x: usize, y: usize| inside.get(y * w + x).copied().unwrap_or(false);
+    let mut edge = Vec::new();
+    for y in 0..h {
+        for x in 0..w {
+            let on_edge = x == 0 || y == 0 || x + 1 == w || y + 1 == h || !is_in(x - 1, y) || !is_in(x + 1, y) || !is_in(x, y - 1) || !is_in(x, y + 1);
+            if is_in(x, y)
+                && on_edge
+                && let Some(q) = rgba.get(y * w + x)
+            {
+                edge.push(*q);
+            }
+        }
+    }
+    let bg: [f32; 4] = std::array::from_fn(|c| {
+        let mut v: Vec<f32> = edge.iter().map(|p| p[c]).collect();
+        v.sort_by(f32::total_cmp);
+        v.get(v.len() / 2).copied().unwrap_or(1.0)
+    });
+    for (q, &keep) in rgba.iter_mut().zip(&inside) {
+        if !keep {
+            *q = bg;
+        }
+    }
+    true
+}
+
 fn crop_and_straighten(s: &mut Session, _p: &Value) -> Result<Value> {
     let st = s.active().ok_or(EngineError::NoDocument)?;
     let doc = st.doc.clone();
     let fmt = doc.pixel_format();
     let flat = flattened(&doc, fmt);
-    let area = doc.bounds();
+    let canvas = doc.bounds();
+    // Like Photoshop, only the selected area is searched when there is a selection.
+    let area = doc.selection.as_ref().map_or(canvas, |m| m.content_bounds().intersect(&canvas));
+    if area.is_empty() {
+        return Err(EngineError::Other("the selection is empty".into()));
+    }
     let (w, h) = (area.width() as usize, area.height() as usize);
     let mut rgba = vec![[0.0f32; 4]; w * h];
     flat.read_rgba_into(area, &mut rgba);
@@ -847,7 +897,15 @@ fn crop_and_straighten(s: &mut Session, _p: &Value) -> Result<Value> {
             }
         }
     }
-    let found = scancrop::find_photos(w, h, &rgba);
+    if let Some(sel) = &doc.selection
+        && !mask_unselected(sel, area, w, h, &mut rgba)
+    {
+        return Err(EngineError::Other("no pixels are more than 50% selected".into()));
+    }
+    let mut found = scancrop::find_photos(w, h, &rgba);
+    for f in &mut found {
+        f.center = [f.center[0] + f64::from(area.x0), f.center[1] + f64::from(area.y0)];
+    }
     if found.is_empty() {
         return Err(EngineError::Other("no photos found on a uniform background".into()));
     }
@@ -857,7 +915,7 @@ fn crop_and_straighten(s: &mut Session, _p: &Value) -> Result<Value> {
         let corners = f.corners();
         let hq = Homography::rect_to_quad([0.0, 0.0, pw as f64, ph as f64], corners).and_then(|h| h.inverse());
         let Some(hm) = hq else { continue };
-        let warped = warp_surface(&flat, area, &hm, Interp::Bicubic)?;
+        let warped = warp_surface(&flat, canvas, &hm, Interp::Bicubic)?;
         let keep = Rect::new(0, 0, pw as i32, ph as i32);
         let mut px = Surface::new(fmt);
         px.write_region(keep, &warped.read_region(keep));
@@ -924,7 +982,7 @@ pub fn specs() -> Vec<CommandSpec> {
             label: "Crop and Straighten Photos",
             menu: &["File", "Automate"],
             shortcut: None,
-            params: "{} → one new document per photo found on the scan",
+            params: "{} → one new document per photo found on the scan (inside the selection when there is one)",
             enabled: not_indexed,
             run: crop_and_straighten,
             journal: true,
@@ -1173,6 +1231,87 @@ mod tests {
         assert_eq!(s.documents().len(), 1);
     }
 
+    #[test]
+    fn crop_and_straighten_only_processes_the_selection() {
+        // Photoshop: with a selection, only the photos inside it are split off.
+        let (w, h) = (480usize, 340usize);
+        let mut px = vec![[0.98f32, 0.98, 0.98, 1.0]; w * h];
+        // Upright photos: red 160x110 at (40, 60), blue 150x120 at (290, 180).
+        for (x0, y0, pw, ph, c) in [(40, 60, 160, 110, [0.6f32, 0.1, 0.1, 1.0]), (290, 180, 150, 120, [0.1, 0.2, 0.6, 1.0])] {
+            for y in y0..y0 + ph {
+                px[y * w + x0..y * w + x0 + pw].fill(c);
+            }
+        }
+        let mut s = Session::new();
+        s.add_document(doc_from("scan", &px, w, h, SampleType::U8), None);
+        s.execute("select.rect", json!({"x": 270, "y": 160, "width": 190, "height": 160})).unwrap();
+        let r = s.execute("file.automate.cropAndStraightenPhotos", json!({})).unwrap();
+        let found = r["photos"].as_array().unwrap();
+        assert_eq!(found.len(), 1, "{r}");
+        assert_eq!(s.documents().len(), 2);
+        // The reported centre is in the scan's coordinates.
+        let c = &found[0]["center"];
+        assert!((c[0].as_f64().unwrap() - 365.0).abs() < 3.0 && (c[1].as_f64().unwrap() - 240.0).abs() < 3.0, "{c}");
+        let d = &s.documents()[1].doc;
+        assert!((d.size.width as i64 - 150).abs() <= 4 && (d.size.height as i64 - 120).abs() <= 4, "{:?}", d.size);
+        let q = d.layers[0].surface().unwrap().rgba(d.size.width as i32 / 2, d.size.height as i32 / 2);
+        assert!(q[2] > 0.5 && q[0] < 0.2, "{q:?}");
+        // Without a selection both photos are found.
+        s.set_active(0);
+        s.execute("select.deselect", json!({})).unwrap();
+        let r = s.execute("file.automate.cropAndStraightenPhotos", json!({})).unwrap();
+        assert_eq!(r["photos"].as_array().unwrap().len(), 2, "{r}");
+    }
+
+    #[test]
+    fn crop_and_straighten_skips_photos_between_selected_regions() {
+        // Two selected rectangles: a photo in the gap between them lies inside
+        // their bounding box but outside the selection, so it is not split off.
+        let (w, h) = (480usize, 340usize);
+        let mut px = vec![[0.75f32, 0.75, 0.75, 1.0]; w * h];
+        // Red 160x110 at (40, 60) and blue 150x120 at (290, 180) are selected; green 130x80 at (280, 50) is not.
+        for (x0, y0, pw, ph, c) in
+            [(40, 60, 160, 110, [0.6f32, 0.1, 0.1, 1.0]), (290, 180, 150, 120, [0.1, 0.2, 0.6, 1.0]), (280, 50, 130, 80, [0.1, 0.6, 0.1, 1.0])]
+        {
+            for y in y0..y0 + ph {
+                px[y * w + x0..y * w + x0 + pw].fill(c);
+            }
+        }
+        let mut s = Session::new();
+        s.add_document(doc_from("scan", &px, w, h, SampleType::U8), None);
+        s.execute("select.rect", json!({"x": 20, "y": 40, "width": 200, "height": 150})).unwrap();
+        s.execute("select.rect", json!({"x": 270, "y": 160, "width": 190, "height": 160, "mode": "add"})).unwrap();
+        let r = s.execute("file.automate.cropAndStraightenPhotos", json!({})).unwrap();
+        let found = r["photos"].as_array().unwrap();
+        assert_eq!(found.len(), 2, "{r}");
+        for f in found {
+            let c = &f["center"];
+            let (cx, cy) = (c[0].as_f64().unwrap(), c[1].as_f64().unwrap());
+            let near = |x: f64, y: f64| (cx - x).abs() < 3.0 && (cy - y).abs() < 3.0;
+            assert!(near(120.0, 115.0) || near(365.0, 240.0), "{c}");
+        }
+    }
+
+    #[test]
+    fn crop_and_straighten_refuses_a_selection_under_half_coverage() {
+        // A faint (strongly feathered) selection has no pixel at or above 50%:
+        // like Photoshop, nothing counts as selected, so no photo is split off
+        // from the unmasked bounding box.
+        let (w, h) = (480usize, 340usize);
+        let mut px = vec![[0.98f32, 0.98, 0.98, 1.0]; w * h];
+        for y in 180..300 {
+            px[y * w + 290..y * w + 440].fill([0.1, 0.2, 0.6, 1.0]);
+        }
+        let mut s = Session::new();
+        s.add_document(doc_from("scan", &px, w, h, SampleType::U8), None);
+        let mut m = Surface::new(photocraft_color::PixelFormat::GRAY8);
+        m.fill_rect(Rect::new(270, 160, 460, 320), &[0.3]);
+        std::sync::Arc::make_mut(&mut s.active_mut().unwrap().doc).selection = Some(m);
+        let e = s.execute("file.automate.cropAndStraightenPhotos", json!({})).unwrap_err();
+        assert!(e.to_string().contains("50%"), "{e}");
+        assert_eq!(s.documents().len(), 1);
+    }
+
     #[test]
     fn crop_and_straighten_makes_documents() {
         let (w, h) = (500usize, 360usize);
diff --git a/crates/engine/src/prefs.rs b/crates/engine/src/prefs.rs
index 6b7639b3ae..1525741a5e 100644
--- a/crates/engine/src/prefs.rs
+++ b/crates/engine/src/prefs.rs
@@ -61,7 +61,7 @@ choice!(DarkTheme { Pro = "pro", ProMedium = "proMedium", Studio = "studio", Sol
 choice!(LightTheme { ProLight = "proLight", ProLightGray = "proLightGray", StudioLight = "studioLight", Classic = "classic", Adwaita = "adwaita", BreezeLight = "breezeLight", SoftLight = "softLight" } default ProLight);
 choice!(CanvasColor { Default = "default", Black = "black", DarkGray = "darkGray", MediumGray = "mediumGray", LightGray = "lightGray", Custom = "custom" } default Default);
 choice!(CanvasBorder { DropShadow = "dropShadow", Line = "line", None = "none" } default DropShadow);
-choice!(UiScale { Auto = "auto", P75 = "75", P80 = "80", P85 = "85", P90 = "90", P95 = "95", P100 = "100", P125 = "125", P150 = "150", P175 = "175", P200 = "200", P250 = "250", P300 = "300" } default Auto);
+choice!(UiScale { Auto = "auto", P75 = "75", P80 = "80", P85 = "85", P90 = "90", P95 = "95", P100 = "100", P105 = "105", P110 = "110", P115 = "115", P120 = "120", P125 = "125", P150 = "150", P175 = "175", P200 = "200", P250 = "250", P300 = "300" } default Auto);
 choice!(
     /// Graphics backend of the desktop app's window and GPU canvas (applies at next launch).
     /// `auto` lets PhotoCraft pick (DX12 for Intel adapters on Windows); `cpu` composites on the
@@ -223,6 +223,7 @@ pub struct General {
     pub always_create_smart_objects_when_placing: bool,
     /// Scroll wheel zooms instead of panning.
     pub zoom_with_scroll_wheel: bool,
+    /// Wheel zoom eases over the frames of a notch; off, a notch is one instant ×1.1 step.
     pub animated_zoom: bool,
     pub zoom_resizes_windows: bool,
     pub use_legacy_free_transform: bool,
@@ -549,7 +550,11 @@ pub struct Performance {
     pub memory_usage_mb: u32,
     /// Undo steps kept per document (History panel states).
     pub history_states: u32,
-    /// Display cache levels (mip levels kept for zoomed-out views).
+    /// Cache Levels, 1–8: the highest cache level the Histogram panel counts a large document at
+    /// (level n counts a proxy 2^(n-1) times smaller; 1 counts every pixel). Lower is more
+    /// accurate, higher faster. The panel picks the level from the document's size up to this;
+    /// the web build, which counts on the UI thread, reduces documents from a quarter of the size
+    /// the desktop does. Uncached Refresh always counts at level 1.
     pub cache_levels: u32,
     /// Side of the GPU canvas texture tiles, in pixels (applies at next launch).
     pub cache_tile_size: u32,
@@ -901,6 +906,35 @@ pub struct RawDefaults {
     pub open_in_camera_raw: bool,
     /// The demosaic method raws are developed with; the open-time Camera Raw dialog starts from it.
     pub demosaic: RawDemosaic,
+    /// Keep a raw file's develop settings in a sidecar (`IMG_0001.xmp` beside `IMG_0001.CR2`),
+    /// as Camera Raw's "Save image settings in: Sidecar .xmp files"; the sidecar is read again
+    /// when the file is next opened. Off reads sidecars but never writes one.
+    pub write_xmp_sidecars: bool,
+}
+
+impl RawColorSpace {
+    /// The built-in profile `edit.convertToProfile` knows this space as.
+    pub fn profile_id(self) -> &'static str {
+        match self {
+            RawColorSpace::Srgb => "srgb",
+            RawColorSpace::AdobeRgb => "adobe-rgb-compat",
+            RawColorSpace::ProPhoto => "prophoto-compat",
+            RawColorSpace::DisplayP3 => "display-p3",
+        }
+    }
+}
+
+impl RawSharpen {
+    /// Camera Raw's output sharpening for this medium as the Detail panel's (amount, radius):
+    /// none, Screen (light, fine), Matte paper (stronger, wider: ink spreads), Glossy paper.
+    pub fn preset(self) -> Option<(f32, f32)> {
+        match self {
+            RawSharpen::None => None,
+            RawSharpen::Screen => Some((25.0, 1.0)),
+            RawSharpen::Matte => Some((35.0, 1.2)),
+            RawSharpen::Glossy => Some((40.0, 1.0)),
+        }
+    }
 }
 
 impl RawDemosaic {
@@ -925,6 +959,7 @@ impl Default for RawDefaults {
             apply_auto_tone: false,
             open_in_camera_raw: true,
             demosaic: RawDemosaic::Ahd,
+            write_xmp_sidecars: true,
         }
     }
 }
@@ -1119,7 +1154,6 @@ pub const HIDDEN_UNTIL_IMPLEMENTED: &[&str] = &[
     "general.colorPicker",
     "workspace.autoShowHiddenPanels",
     "workspace.enableFloatingDocumentWindowDocking",
-    "performance.cacheLevels",
     "performance.effectCacheMb",
     "performance.legacyCompositing",
     "scratchDisks.disks",
@@ -1129,15 +1163,6 @@ pub const HIDDEN_UNTIL_IMPLEMENTED: &[&str] = &[
     "plugIns.allowScriptsToConnect",
     "type.textEngine",
     "enhancedControls.scrubbySliderAcceleration",
-    "rawDefaults.colorSpace",
-    "rawDefaults.bitDepth",
-    "rawDefaults.sharpenFor",
-    "rawDefaults.openAsSmartObject",
-    "rawDefaults.applyAutoTone",
-    // Agent access is governed by the launch flags (`--control`, the automation roots), not
-    // by these yet.
-    "integrations.allowAgentControl",
-    "integrations.controlPort",
 ];
 
 /// Is the preference at `path` (`"section.key"`) hidden from the Preferences dialog?
diff --git a/crates/engine/src/prefs/tests.rs b/crates/engine/src/prefs/tests.rs
index 8ce36173b7..6f17a21970 100644
--- a/crates/engine/src/prefs/tests.rs
+++ b/crates/engine/src/prefs/tests.rs
@@ -22,6 +22,21 @@ fn defaults_match_photoshop() {
     }
 }
 
+#[test]
+fn intermediate_ui_scale_presets_survive_restart() {
+    let mut s = Session::new();
+    assert_eq!(s.execute("prefs.get", json!({"path": "interface.uiScale"})).unwrap(), json!("auto"));
+    for scale in ["100", "105", "110", "115", "120", "125"] {
+        s.execute("prefs.set", json!({"path": "interface.uiScale", "value": scale})).unwrap();
+        let mut restored = Session::new();
+        restored.load_prefs_json(&s.prefs_to_json()).unwrap();
+        assert_eq!(restored.execute("prefs.get", json!({"path": "interface.uiScale"})).unwrap(), json!(scale));
+    }
+    // Presets remain discrete choices: arbitrary values must not silently replace a valid scale.
+    assert!(s.execute("prefs.set", json!({"path": "interface.uiScale", "value": "112"})).is_err());
+    assert_eq!(s.execute("prefs.get", json!({"path": "interface.uiScale"})).unwrap(), json!("125"));
+}
+
 /// #2264: the Studio workspace dot pattern can be hidden without changing themes.
 #[test]
 fn canvas_dot_grid_can_be_disabled_persisted_and_reset() {
diff --git a/crates/engine/src/preset_store.rs b/crates/engine/src/preset_store.rs
index 83cb16a838..a065e48e6d 100644
--- a/crates/engine/src/preset_store.rs
+++ b/crates/engine/src/preset_store.rs
@@ -38,6 +38,11 @@
 //! The Actions list (`actions.json`, see [`crate::actions_cmds`]) lives in the same directory.
 //! A missing file is an empty list. A corrupt or oversized file is skipped with a warning.
 //! Headless sessions have no store, so their actions stay in memory.
+//!
+//! So do the patterns the user defined or imported (`patterns.pat`, Photoshop's own pattern file
+//! format, #9317): the whole user library in its order, rewritten when its ids, names or order
+//! change. The built-in patterns are regenerated on start and never written. Like `actions.json`,
+//! a file that fails to load is warned about and never overwritten.
 
 use std::collections::{BTreeMap, HashMap, HashSet};
 use std::io::Read;
@@ -67,6 +72,10 @@ pub const MAX_INDEX_BYTES: u64 = 4 << 20;
 pub const ACTIONS_FILE: &str = "actions.json";
 /// Largest Actions file read or written.
 pub const MAX_ACTIONS_BYTES: u64 = 16 << 20;
+/// The user's pattern library (`.pat`).
+pub const PATTERNS_FILE: &str = "patterns.pat";
+/// Largest pattern library read or written.
+pub const MAX_PATTERNS_BYTES: u64 = 256 << 20;
 /// The whole store never grows beyond this; further groups are skipped with a warning.
 pub const MAX_STORE_BYTES: u64 = 2 << 30;
 /// Largest tip side accepted from disk.
@@ -550,6 +559,10 @@ pub struct PresetStore {
     actions_rev: u64,
     /// `actions.json` exists but failed to load: left on disk untouched, so it is never written.
     actions_skipped: bool,
+    /// [`patterns_key`] of the user patterns last written (or loaded).
+    patterns_key: u64,
+    /// `patterns.pat` exists but failed to load: left on disk untouched, so it is never written.
+    patterns_skipped: bool,
     warnings: Vec<String>,
     /// Full tips loaded for brushes in use (behind a lock so `&Session` paths can load).
     cache: Mutex<TipCache>,
@@ -568,6 +581,8 @@ pub struct Opened {
     pub warnings: Vec<String>,
     /// Recorded actions (`actions.json`). Empty when the file is missing or unreadable.
     pub actions: Vec<crate::actions_cmds::Action>,
+    /// User patterns (`patterns.pat`), in library order. Empty when the file is missing or unreadable.
+    pub patterns: Vec<photocraft_doc::Pattern>,
 }
 
 /// Load a store (any thread; the desktop app does this in the background at start).
@@ -644,6 +659,9 @@ pub fn open(backend: Box<dyn PresetBackend>) -> Opened {
     let loaded_actions = load_actions(backend.as_ref(), &mut warnings);
     let actions_skipped = loaded_actions.is_none();
     let actions = loaded_actions.unwrap_or_default();
+    let loaded_patterns = load_patterns(backend.as_ref(), &mut warnings);
+    let patterns_skipped = loaded_patterns.is_none();
+    let patterns = loaded_patterns.unwrap_or_default();
     let mut store = PresetStore {
         backend,
         synced_rev: None,
@@ -653,6 +671,8 @@ pub fn open(backend: Box<dyn PresetBackend>) -> Opened {
         index: None,
         actions_rev: 0,
         actions_skipped,
+        patterns_key: patterns_key(&patterns, 0),
+        patterns_skipped,
         warnings: Vec::new(),
         cache: Mutex::new(TipCache { limit: TIP_CACHE_BYTES, ..Default::default() }),
     };
@@ -710,7 +730,41 @@ pub fn open(backend: Box<dyn PresetBackend>) -> Opened {
     let hidden_builtins = index.as_ref().map(|i| i.hidden_builtins.clone()).unwrap_or_default();
     let order = index.as_ref().map(|i| i.order.clone()).unwrap_or_default();
     store.index = index;
-    Opened { store, presets, hidden_builtins, order, warnings, actions }
+    Opened { store, presets, hidden_builtins, order, warnings, actions, patterns }
+}
+
+/// `patterns.pat`: a missing file is no patterns. Anything else unreadable is a warning.
+/// The saved patterns; `None` when `patterns.pat` exists but could not be loaded.
+fn load_patterns(backend: &dyn PresetBackend, warnings: &mut Vec<String>) -> Option<Vec<photocraft_doc::Pattern>> {
+    let bytes = match backend.read(PATTERNS_FILE, MAX_PATTERNS_BYTES) {
+        Ok(b) => b,
+        Err(e) if missing_file(&e) => return Some(Vec::new()),
+        Err(e) => {
+            warnings.push(format!("patterns: {PATTERNS_FILE} skipped: {e}"));
+            return None;
+        }
+    };
+    match photocraft_io::pattern_map::read_pat(&bytes) {
+        Ok(p) => Some(p),
+        Err(e) => {
+            warnings.push(format!("patterns: {PATTERNS_FILE} skipped: {e}"));
+            None
+        }
+    }
+}
+
+/// What decides whether the user patterns need rewriting: their ids, names, sizes and order, and
+/// the library's [`pixels_rev`](crate::pattern_cmds::PatternLibrary::pixels_rev) (pixels replaced
+/// under the same id).
+fn patterns_key(patterns: &[photocraft_doc::Pattern], pixels_rev: u64) -> u64 {
+    use std::hash::{Hash, Hasher};
+    let mut h = std::collections::hash_map::DefaultHasher::new();
+    for p in patterns {
+        (&p.id, &p.name, p.width, p.height).hash(&mut h);
+    }
+    patterns.len().hash(&mut h);
+    pixels_rev.hash(&mut h);
+    h.finish()
 }
 
 /// `actions.json`: a missing file is an empty list. Anything else unreadable is a warning.
@@ -1075,6 +1129,49 @@ impl PresetStore {
     }
 }
 
+impl PresetStore {
+    /// Write the user patterns (the library minus the built-ins) when they changed since the last
+    /// load or write. An oversized library is warned once per change and not written. An I/O
+    /// error is warned and retried on the next command.
+    pub fn sync_patterns(&mut self, library: &[photocraft_doc::Pattern], pixels_rev: u64) {
+        let builtins = crate::pattern_cmds::builtin();
+        let user: Vec<photocraft_doc::Pattern> = library.iter().filter(|p| !crate::pattern_cmds::is_pristine_builtin(p, &builtins)).cloned().collect();
+        let key = patterns_key(&user, pixels_rev);
+        if self.patterns_key == key {
+            return;
+        }
+        self.patterns_key = key;
+        if self.patterns_skipped {
+            self.warnings.push(format!("Couldn't save patterns: {PATTERNS_FILE} could not be read, so it was left unchanged"));
+            return;
+        }
+        if user.is_empty() {
+            if let Err(e) = self.backend.remove(PATTERNS_FILE) {
+                self.warnings.push(format!("Couldn't save patterns: {e}"));
+                // Try again after the next command.
+                self.patterns_key = key.wrapping_add(1);
+            }
+            return;
+        }
+        let bytes = match photocraft_io::pattern_map::write_pat(&user) {
+            Ok(b) => b,
+            Err(e) => {
+                self.warnings.push(format!("Couldn't save patterns: {e}"));
+                return;
+            }
+        };
+        if bytes.len() as u64 > MAX_PATTERNS_BYTES {
+            self.warnings.push(format!("patterns: the pattern library is too large to save ({} MB limit)", MAX_PATTERNS_BYTES >> 20));
+            return;
+        }
+        if let Err(e) = self.backend.write(PATTERNS_FILE, &bytes) {
+            self.warnings.push(format!("Couldn't save patterns: {e}"));
+            // Try again after the next command.
+            self.patterns_key = key.wrapping_add(1);
+        }
+    }
+}
+
 fn builtin_names() -> &'static [String] {
     static NAMES: std::sync::OnceLock<Vec<String>> = std::sync::OnceLock::new();
     NAMES.get_or_init(|| photocraft_paint::presets::builtin().into_iter().map(|p| p.name).collect())
@@ -1091,7 +1188,24 @@ impl Session {
     /// built-in of the same name; presets created before the store finished loading win), hide
     /// deleted built-ins, then sync. Returns the load warnings.
     pub fn attach_preset_store(&mut self, opened: Opened) -> Vec<String> {
-        let Opened { store, presets, hidden_builtins, order, mut warnings, actions: disk } = opened;
+        let Opened { store, presets, hidden_builtins, order, mut warnings, actions: disk, patterns } = opened;
+        // Saved patterns join the library after the built-ins, and a saved built-in (replaced by
+        // an import or renamed) takes the shipped one's place; a pattern defined or imported
+        // before the store finished loading keeps its place (and the same id isn't added twice).
+        let builtins = crate::pattern_cmds::builtin();
+        for p in patterns {
+            match self.patterns.items.iter_mut().find(|q| q.id == p.id) {
+                Some(q) if crate::pattern_cmds::is_pristine_builtin(q, &builtins) => *q = p,
+                // The earlier copy wins; other pixels than the saved ones must still be written,
+                // which its id, name and size don't show.
+                Some(q) => {
+                    if q.surface != p.surface {
+                        self.patterns.pixels_rev += 1;
+                    }
+                }
+                None => self.patterns.items.push(p),
+            }
+        }
         let lib = &mut self.tools.presets;
         lib.retain(|p| !(p.builtin && hidden_builtins.iter().any(|h| h.eq_ignore_ascii_case(&p.name))));
         for p in presets {
@@ -1136,7 +1250,7 @@ impl Session {
         warnings
     }
 
-    /// Write pending brush preset and Actions changes to the attached store (no-op without one).
+    /// Write pending brush preset, Actions and pattern changes to the attached store (no-op without one).
     pub fn sync_preset_store(&mut self) {
         let rev = self.tools.presets_rev;
         let actions_rev = self.actions.rev;
@@ -1151,6 +1265,7 @@ impl Session {
                 }
             }
             st.sync_actions(&self.actions.list, actions_rev);
+            st.sync_patterns(&self.patterns.items, self.patterns.pixels_rev);
         }
     }
 
diff --git a/crates/engine/src/preset_store/tests.rs b/crates/engine/src/preset_store/tests.rs
index 860ebd4fc3..e0080aa4cb 100644
--- a/crates/engine/src/preset_store/tests.rs
+++ b/crates/engine/src/preset_store/tests.rs
@@ -703,3 +703,170 @@ fn an_actions_file_that_failed_to_load_is_not_overwritten() {
     assert_eq!(mem.files.lock().unwrap().get(ACTIONS_FILE), Some(&newer), "an actions file the store could not read was overwritten");
     assert!(!s.preset_store.as_mut().unwrap().take_warnings().is_empty());
 }
+
+/// #9317: a defined or imported pattern survives a restart, as in Photoshop; the built-in
+/// patterns are never written, and deleting the last user pattern removes the file.
+#[test]
+fn user_patterns_survive_a_restart() {
+    let dir = TempDir::new("patterns");
+    let builtin = Session::new().patterns.items.len();
+    let (mut s, w) = session(&dir);
+    assert!(w.is_empty(), "{w:?}");
+    s.execute("file.new", json!({"width": 12, "height": 10})).unwrap();
+    s.execute("edit.fill", json!({"color": "#1ea05a"})).unwrap();
+    let id = s.execute("edit.definePattern", json!({"name": "Green Tile"})).unwrap()["pattern"].as_str().unwrap().to_string();
+    s.sync_preset_store();
+    assert!(dir.files().contains(&PATTERNS_FILE.to_string()), "{:?}", dir.files());
+    // Only the user's pattern is in the file.
+    let bytes = std::fs::read(dir.0.join(PATTERNS_FILE)).unwrap();
+    let saved = photocraft_io::pattern_map::read_pat(&bytes).unwrap();
+    assert_eq!(saved.iter().map(|p| p.name.as_str()).collect::<Vec<_>>(), ["Green Tile"]);
+    drop(s);
+
+    let (mut t, w) = session(&dir);
+    assert!(w.is_empty(), "{w:?}");
+    assert_eq!(t.patterns.items.len(), builtin + 1);
+    let back = t.patterns.items.iter().find(|p| p.id == id).expect("the defined pattern is back after a restart");
+    assert_eq!((back.name.as_str(), back.width, back.height), ("Green Tile", 12, 10));
+    assert_eq!(back.surface, saved[0].surface, "with its pixels");
+    // Renames are kept; deleting the last user pattern removes the file.
+    t.execute("pattern.rename", json!({"pattern": id, "name": "Moss"})).unwrap();
+    t.sync_preset_store();
+    let (u, _) = session(&dir);
+    assert!(u.patterns.items.iter().any(|p| p.id == id && p.name == "Moss"));
+    t.execute("pattern.delete", json!({"pattern": id})).unwrap();
+    t.sync_preset_store();
+    assert!(!dir.files().contains(&PATTERNS_FILE.to_string()), "{:?}", dir.files());
+}
+
+#[test]
+fn a_patterns_file_that_failed_to_load_is_not_overwritten() {
+    let mem = MemBackend::default();
+    let unreadable = b"not a pattern file".to_vec();
+    mem.files.lock().unwrap().insert(PATTERNS_FILE.into(), unreadable.clone());
+    let mut s = Session::new();
+    let w = s.attach_preset_store(open(Box::new(mem.clone())));
+    assert!(w.iter().any(|w| w.contains(PATTERNS_FILE)), "{w:?}");
+    s.execute("file.new", json!({"width": 4, "height": 4})).unwrap();
+    s.execute("edit.definePattern", json!({"name": "New"})).unwrap();
+    s.sync_preset_store();
+    assert_eq!(mem.files.lock().unwrap().get(PATTERNS_FILE), Some(&unreadable), "a patterns file the store could not read was overwritten");
+    assert!(!s.preset_store.as_mut().unwrap().take_warnings().is_empty());
+}
+
+/// A `.pat` of one 4×4 pattern with id `id`, filled with `rgba`.
+fn pat_bytes(id: &str, rgba: [f32; 4]) -> String {
+    use photocraft_geom::Rect;
+    use photocraft_raster::Surface;
+    let mut surface = Surface::new(photocraft_color::PixelFormat::RGBA8);
+    surface.fill_rect(Rect::new(0, 0, 4, 4), &rgba);
+    let mut p = photocraft_doc::Pattern::new("Same", surface, 4, 4);
+    p.id = id.into();
+    photocraft_paint::tile::b64_encode(&photocraft_io::pattern_map::write_pat(&[p]).unwrap())
+}
+
+/// #9318 review: re-importing a pattern under the same id, name and size but with other pixels
+/// (an edited `.pat`) is written, so a restart doesn't bring the old pixels back.
+#[test]
+fn a_same_id_pattern_replacement_survives_a_restart() {
+    let mem = MemBackend::default();
+    let mut s = Session::new();
+    s.attach_preset_store(open(Box::new(mem.clone())));
+    let id = "6f1c2c1e-0000-4000-8000-000000009318";
+    s.execute("pattern.import", json!({"data": pat_bytes(id, [1.0, 0.0, 0.0, 1.0])})).unwrap();
+    s.sync_preset_store();
+    s.execute("pattern.import", json!({"data": pat_bytes(id, [0.0, 0.0, 1.0, 1.0])})).unwrap();
+    s.sync_preset_store();
+    let mut t = Session::new();
+    t.attach_preset_store(open(Box::new(mem.clone())));
+    let back = t.patterns.items.iter().find(|p| p.id == id).expect("the pattern is back");
+    let want = s.patterns.items.iter().find(|p| p.id == id).unwrap();
+    assert_eq!(back.surface, want.surface, "with the replacement's pixels, not the first import's");
+}
+
+/// A [`MemBackend`] whose removals fail while `fail` is set.
+#[derive(Clone, Default)]
+struct FlakyRemove {
+    mem: MemBackend,
+    fail: std::sync::Arc<std::sync::atomic::AtomicBool>,
+}
+
+impl PresetBackend for FlakyRemove {
+    fn list(&self) -> Result<Vec<(String, u64)>, String> {
+        self.mem.list()
+    }
+    fn read(&self, name: &str, max: u64) -> Result<Vec<u8>, String> {
+        self.mem.read(name, max)
+    }
+    fn write(&self, name: &str, bytes: &[u8]) -> Result<(), String> {
+        self.mem.write(name, bytes)
+    }
+    fn remove(&self, name: &str) -> Result<(), String> {
+        if self.fail.load(std::sync::atomic::Ordering::SeqCst) {
+            return Err(format!("{name}: busy"));
+        }
+        self.mem.remove(name)
+    }
+}
+
+/// #9318 review: deleting the last user pattern while `patterns.pat` can't be removed is
+/// warned and retried, so the deleted pattern doesn't come back after a restart.
+#[test]
+fn a_failed_patterns_removal_is_retried() {
+    let backend = FlakyRemove::default();
+    let mut s = Session::new();
+    s.attach_preset_store(open(Box::new(backend.clone())));
+    s.execute("file.new", json!({"width": 4, "height": 4})).unwrap();
+    let id = s.execute("edit.definePattern", json!({"name": "Gone"})).unwrap()["pattern"].as_str().unwrap().to_string();
+    s.sync_preset_store();
+    assert!(backend.mem.files.lock().unwrap().contains_key(PATTERNS_FILE));
+    backend.fail.store(true, std::sync::atomic::Ordering::SeqCst);
+    s.execute("pattern.delete", json!({"pattern": id})).unwrap();
+    s.sync_preset_store();
+    assert!(!s.preset_store.as_mut().unwrap().take_warnings().is_empty(), "the failure is warned");
+    backend.fail.store(false, std::sync::atomic::Ordering::SeqCst);
+    s.execute("file.new", json!({"width": 4, "height": 4})).unwrap();
+    s.sync_preset_store();
+    assert!(!backend.mem.files.lock().unwrap().contains_key(PATTERNS_FILE), "the removal is retried");
+}
+
+/// #9318 review: an imported `.pat` that replaces a built-in pattern's pixels (same id) is saved
+/// and replaces the built-in after a restart, once; untouched built-ins are still never written.
+#[test]
+fn an_imported_builtin_replacement_survives_a_restart() {
+    let mem = MemBackend::default();
+    let mut s = Session::new();
+    s.attach_preset_store(open(Box::new(mem.clone())));
+    let builtin = s.patterns.items[0].id.clone();
+    s.execute("pattern.import", json!({"data": pat_bytes(&builtin, [0.9, 0.1, 0.4, 1.0])})).unwrap();
+    s.sync_preset_store();
+    let saved = photocraft_io::pattern_map::read_pat(mem.files.lock().unwrap().get(PATTERNS_FILE).expect("written")).unwrap();
+    assert_eq!(saved.iter().map(|p| p.id.as_str()).collect::<Vec<_>>(), [builtin.as_str()], "only the replaced built-in");
+    let mut t = Session::new();
+    t.attach_preset_store(open(Box::new(mem.clone())));
+    let back: Vec<_> = t.patterns.items.iter().filter(|p| p.id == builtin).collect();
+    assert_eq!(back.len(), 1, "once");
+    let want = s.patterns.items.iter().find(|p| p.id == builtin).unwrap();
+    assert_eq!(back[0].surface, want.surface, "with the imported pixels");
+}
+
+/// #9318 review: a pattern imported before the store finished loading, with the id, name and
+/// size of a saved one but other pixels, wins the merge and is written, so a restart keeps it.
+#[test]
+fn an_early_same_id_import_wins_and_is_saved() {
+    let mem = MemBackend::default();
+    let id = "6f1c2c1e-0000-4000-8000-00000000e4a1";
+    let mut s = Session::new();
+    s.attach_preset_store(open(Box::new(mem.clone())));
+    s.execute("pattern.import", json!({"data": pat_bytes(id, [1.0, 0.0, 0.0, 1.0])})).unwrap();
+    s.sync_preset_store();
+    // Next start: the same pattern with other pixels arrives before the store is attached.
+    let mut t = Session::new();
+    t.execute("pattern.import", json!({"data": pat_bytes(id, [0.0, 1.0, 0.0, 1.0])})).unwrap();
+    let early = t.patterns.items.iter().find(|p| p.id == id).unwrap().surface.clone();
+    t.attach_preset_store(open(Box::new(mem.clone())));
+    t.sync_preset_store();
+    let mut u = Session::new();
+    u.attach_preset_store(open(Box::new(mem.clone())));
+    assert_eq!(u.patterns.items.iter().find(|p| p.id == id).unwrap().surface, early, "the early import's pixels were saved");
+}
diff --git a/crates/engine/src/print_cmds.rs b/crates/engine/src/print_cmds.rs
index 71efe29735..d115566a7c 100644
--- a/crates/engine/src/print_cmds.rs
+++ b/crates/engine/src/print_cmds.rs
@@ -1143,12 +1143,31 @@ fn package(s: &mut Session, p: &Value) -> Result<Value> {
     for (_, _, l) in doc.walk() {
         let LayerContent::Smart(so) = &l.content else { continue };
         let SmartSource::Linked { path } = &so.source else { continue };
+        if missing.contains(path) {
+            continue;
+        }
         let target = match copied.iter().find(|(src, _)| src == path) {
             Some((_, t)) => t.clone(),
             None => {
-                let mut fname = file_name(path);
-                if copied.iter().any(|(_, t)| file_name(t) == fname) {
-                    fname = format!("{}-{}", copied.len(), fname);
+                // A name no earlier copy has, ignoring case (macOS and Windows folders do): a
+                // renamed copy can't take the name of another link either. A file already in
+                // Links (an earlier package into the same folder) is never overwritten.
+                let base = file_name(path);
+                let taken = |n: &str| {
+                    copied.iter().any(|(_, t)| file_name(t).to_lowercase() == n.to_lowercase())
+                        || std::path::Path::new(&join(&links_dir, n)).exists()
+                        || std::fs::read_dir(&links_dir)
+                            .ok()
+                            .into_iter()
+                            .flatten()
+                            .flatten()
+                            .any(|entry| entry.file_name().to_string_lossy().to_lowercase() == n.to_lowercase())
+                };
+                let mut fname = base.clone();
+                let mut k = copied.len();
+                while taken(&fname) {
+                    fname = format!("{k}-{base}");
+                    k += 1;
                 }
                 let t = join(&links_dir, &fname);
                 // A path that is not followed is packaged as missing, like a file that is gone.
diff --git a/crates/engine/src/print_cmds/tests.rs b/crates/engine/src/print_cmds/tests.rs
index 43f49101a7..c4c211d16e 100644
--- a/crates/engine/src/print_cmds/tests.rs
+++ b/crates/engine/src/print_cmds/tests.rs
@@ -463,6 +463,72 @@ fn package_copies_links_and_relinks() {
     );
 }
 
+/// Links whose names collide get distinct copies, even when a renamed copy's name is already
+/// another link's name (`b/2-x.png` copied before the third `x.png` would be renamed to it).
+#[test]
+fn package_never_overwrites_one_link_copy_with_another() {
+    let dir = tmp("package-collide");
+    let mut s = session("rgb", 8);
+    let mut links = Vec::new();
+    for (sub, name, colour) in [("a", "x.png", "#ff0000"), ("b", "2-x.png", "#00ff00"), ("c", "x.png", "#0000ff")] {
+        std::fs::create_dir_all(format!("{dir}/{sub}")).unwrap();
+        let link = format!("{dir}/{sub}/{name}");
+        let mut src = Session::new();
+        src.execute("file.new", json!({"width": 4, "height": 4, "background": colour})).unwrap();
+        crate::file_cmds::save_doc(&src.active().unwrap().doc, &link, None).unwrap();
+        s.execute("file.placeLinked", json!({"path": link})).unwrap();
+        links.push(std::fs::read(&link).unwrap());
+    }
+    let r = s.execute("file.package", json!({"dir": format!("{dir}/pkg")})).unwrap();
+    let copies: Vec<&str> = r["links"].as_array().unwrap().iter().map(|v| v.as_str().unwrap()).collect();
+    assert_eq!(copies.len(), 3);
+    let unique: std::collections::HashSet<&&str> = copies.iter().collect();
+    assert_eq!(unique.len(), 3, "{copies:?}");
+    for (copy, bytes) in copies.iter().zip(&links) {
+        assert_eq!(&std::fs::read(copy).unwrap(), bytes, "{copy}");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A second package into the same folder copies its links beside the first one's, never over them.
+#[test]
+fn package_keeps_files_already_in_links() {
+    let dir = tmp("package-again");
+    let link = format!("{dir}/art.png");
+    let mut src = Session::new();
+    src.execute("file.new", json!({"width": 4, "height": 4, "background": "#ff0000"})).unwrap();
+    crate::file_cmds::save_doc(&src.active().unwrap().doc, &link, None).unwrap();
+    let mut s = session("rgb", 8);
+    s.execute("file.placeLinked", json!({"path": link})).unwrap();
+    let first = s.execute("file.package", json!({"dir": format!("{dir}/pkg")})).unwrap();
+    let first = first["links"][0].as_str().unwrap().to_string();
+    let kept = std::fs::read(&first).unwrap();
+    let second = s.execute("file.package", json!({"dir": format!("{dir}/pkg")})).unwrap();
+    let second = second["links"][0].as_str().unwrap();
+    assert_ne!(second, first);
+    assert!(second.ends_with("Links/0-art.png"), "{second}");
+    assert_eq!(std::fs::read(&first).unwrap(), kept);
+    assert_eq!(std::fs::read(second).unwrap(), kept);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A missing link placed twice is reported once.
+#[test]
+fn package_lists_a_missing_link_once() {
+    let dir = tmp("package-missing-once");
+    let link = format!("{dir}/gone.png");
+    let mut src = Session::new();
+    src.execute("file.new", json!({"width": 4, "height": 4})).unwrap();
+    crate::file_cmds::save_doc(&src.active().unwrap().doc, &link, None).unwrap();
+    let mut s = session("rgb", 8);
+    s.execute("file.placeLinked", json!({"path": link})).unwrap();
+    s.execute("file.placeLinked", json!({"path": link})).unwrap();
+    std::fs::remove_file(&link).unwrap();
+    let r = s.execute("file.package", json!({"dir": format!("{dir}/pkg")})).unwrap();
+    assert_eq!(r["missing"], json!([link]));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 #[test]
 fn paths_export_as_illustrator_postscript() {
     let mut s = session("rgb", 8);
diff --git a/crates/engine/src/redeye_cmds.rs b/crates/engine/src/redeye_cmds.rs
index f6a71da407..eefd1a37ba 100644
--- a/crates/engine/src/redeye_cmds.rs
+++ b/crates/engine/src/redeye_cmds.rs
@@ -256,7 +256,7 @@ pub fn specs() -> Vec<CommandSpec> {
         label: "Red Eye",
         menu: &[],
         shortcut: None,
-        params: r#"{"x":px, "y":px} | {"points":[[x,y],…] (at most 64)},"pupilSize":1..100=50,"darken":0..100=50,"layer":id?=active,"target":"pixels"|"mask"|"quickMask"|{"channel":i} → {"damage":[x,y,w,h], "pixels":n}"#,
+        params: r#"{"x":px, "y":px} | {"points":[[x,y],…] (at most 64)},"pupilSize":1..100=50,"darken":0..100=50,"layer":id?=active,"target":"pixels"|"mask"|"filterMask"|"quickMask"|{"channel":i} → {"damage":[x,y,w,h], "pixels":n}"#,
         enabled,
         run: red_eye,
         journal: true,
diff --git a/crates/engine/src/retouch_cmds.rs b/crates/engine/src/retouch_cmds.rs
index eae429f8c0..063eca3363 100644
--- a/crates/engine/src/retouch_cmds.rs
+++ b/crates/engine/src/retouch_cmds.rs
@@ -1,5 +1,6 @@
 //! Retouching tools as commands: Clone Stamp, Pattern Stamp, Healing Brush, Spot Healing Brush,
-//! Patch, Content-Aware Move, Remove, Dodge, Burn, Sponge, Blur, Sharpen, Smudge and History Brush.
+//! Patch, Content-Aware Move, Remove, Dodge, Burn, Sponge, Blur, Sharpen, Smudge, History Brush and
+//! Art History Brush.
 //!
 //! Every command takes a Photoshop-style brush (`points`, `size`, `hardness`, `opacity`, `flow`,
 //! `spacing`, `layer`), respects the active selection as a mask and the layer's transparency lock, and
@@ -24,6 +25,7 @@ use serde_json::{Value, json};
 use crate::commands::{CommandSpec, blend_from_str};
 use crate::{EngineError, Result, Session};
 
+mod art_history;
 mod content_aware_move;
 mod patch;
 mod pattern_stamp;
@@ -552,7 +554,7 @@ impl LiveRetouch {
         let bounds = self.bounds();
         let (surf, _) = crate::channel_cmds::target_surface(std::sync::Arc::make_mut(&mut self.doc), self.id, &self.params)?;
         let surface = surf.clone();
-        Ok(crate::brush_cmds::LiveCommit { cmd: self.cmd, base: self.base, params: self.params, seed: None, points: self.points, surface, bounds })
+        Ok(crate::brush_cmds::LiveCommit { mixer: None, cmd: self.cmd, base: self.base, params: self.params, seed: None, points: self.points, surface, bounds })
     }
 
     /// Render more points; returns the rectangle that changed. Each changed area is redrawn from
@@ -1472,7 +1474,16 @@ impl LiveDab {
         self.bounds = self.bounds.union(&dmg);
         let (surf, _) = crate::channel_cmds::target_surface(std::sync::Arc::make_mut(&mut self.doc), self.id, &self.params)?;
         let surface = surf.clone();
-        Ok(crate::brush_cmds::LiveCommit { cmd: self.cmd, base, params: self.params, seed: None, points: self.points, surface, bounds: self.bounds })
+        Ok(crate::brush_cmds::LiveCommit {
+            mixer: None,
+            cmd: self.cmd,
+            base,
+            params: self.params,
+            seed: None,
+            points: self.points,
+            surface,
+            bounds: self.bounds,
+        })
     }
 }
 
@@ -1522,7 +1533,7 @@ impl<'a> AllLayers<'a> {
 /// The brush every retouching command shares, plus the tool's own params.
 macro_rules! brush_params {
     ($extra:literal) => {
-        concat!("{", r#""points":[[x,y,pressure?],…],"size":1..5000 px=tool size,"hardness":0..100=tool hardness,"opacity":1..100=100,"flow":1..100=100,"spacing":1..1000 (% of size)=Brush Settings spacing,"layer":id?=active,"target":"pixels"|"mask"|"quickMask"|{"channel":i}=Channels panel target"#, $extra, "}")
+        concat!("{", r#""points":[[x,y,pressure?],…],"size":1..5000 px=tool size,"hardness":0..100=tool hardness,"opacity":1..100=100,"flow":1..100=100,"spacing":1..1000 (% of size)=Brush Settings spacing,"layer":id?=active,"target":"pixels"|"mask"|"filterMask"|"quickMask"|{"channel":i}=Channels panel target"#, $extra, "}")
     };
 }
 
@@ -1580,7 +1591,7 @@ pub fn specs() -> Vec<CommandSpec> {
             label: "Patch",
             menu: &[],
             shortcut: None,
-            params: r#"{"offset":[dx,dy] (how far the selection was dragged),"mode":"source|destination"="source","contentAware":bool=false (fill the selection content-aware from the dragged-to place; a background job),"structure":1..7=4 (content-aware: 3..7 copy the middle exactly, 1..2 re-synthesise more of it),"color":0..10=0 (content-aware: how far the copy's level adapts to the selection's surroundings),"sampleAllLayers":bool=false (content-aware),"layer":id?=active,"target":"pixels"|"mask"|"quickMask"|{"channel":i}=Channels panel target} → {"damage","offset"}"#,
+            params: r#"{"offset":[dx,dy] (how far the selection was dragged),"mode":"source|destination"="source","contentAware":bool=false (fill the selection content-aware from the dragged-to place; a background job),"structure":1..7=4 (content-aware: 3..7 copy the middle exactly, 1..2 re-synthesise more of it),"color":0..10=0 (content-aware: how far the copy's level adapts to the selection's surroundings),"sampleAllLayers":bool=false (content-aware),"layer":id?=active,"target":"pixels"|"mask"|"filterMask"|"quickMask"|{"channel":i}=Channels panel target} → {"damage","offset"}"#,
             enabled: patch::enabled,
             run: patch::patch,
             journal: true,
@@ -1590,7 +1601,7 @@ pub fn specs() -> Vec<CommandSpec> {
             label: "Content-Aware Move",
             menu: &[],
             shortcut: None,
-            params: r#"{"offset":[dx,dy] (how far the selection was dragged),"mode":"move|extend"="move","structure":1..7=4 (3..7 copy the content exactly but for a band about a patch wide along its edge; 2 widens the band, 1 re-synthesises the content too),"color":0..10=0 (0 keeps the content's level; higher values bring it towards its new place, by up to about 0.04 × color),"sampleAllLayers":bool=false,"scaleX":%=100,"scaleY":%=100 (Transform On Drop: 1..10000, negative flips),"rotate":deg=0 (Transform On Drop, clockwise; scale and rotation are about the selection's centre, before the offset; a transformed patch may reach past the canvas edge),"layer":id?=active,"target":"pixels"|"mask"|"quickMask"|{"channel":i}=Channels panel target} → {"damage","offset","mode","transformed"?} (a background job; the selection moves, and is transformed, with the content)"#,
+            params: r#"{"offset":[dx,dy] (how far the selection was dragged),"mode":"move|extend"="move","structure":1..7=4 (3..7 copy the content exactly but for a band about a patch wide along its edge; 2 widens the band, 1 re-synthesises the content too),"color":0..10=0 (0 keeps the content's level; higher values bring it towards its new place, by up to about 0.04 × color),"sampleAllLayers":bool=false,"scaleX":%=100,"scaleY":%=100 (Transform On Drop: 1..10000, negative flips),"rotate":deg=0 (Transform On Drop, clockwise; scale and rotation are about the selection's centre, before the offset; a transformed patch may reach past the canvas edge),"layer":id?=active,"target":"pixels"|"mask"|"filterMask"|"quickMask"|{"channel":i}=Channels panel target} → {"damage","offset","mode","transformed"?} (a background job; the selection moves, and is transformed, with the content)"#,
             enabled: content_aware_move::enabled,
             run: content_aware_move::content_aware_move,
             journal: true,
@@ -1679,6 +1690,18 @@ pub fn specs() -> Vec<CommandSpec> {
             run: history_brush,
             journal: true,
         },
+        CommandSpec {
+            id: "paint.artHistoryBrush",
+            label: "Art History Brush",
+            menu: &[],
+            shortcut: None,
+            params: brush_params!(
+                r#","state":row (a History panel row, as history.setSource),"snapshot":id (a history.newSnapshot id; default: the History panel's source, as paint.historyBrush; a source of another canvas size is an error),"style":"tightShort|tightMedium|tightLong|looseMedium|looseLong|dab|tightCurl|looseCurl"="tightMedium","area":0..100=50,"tolerance":0..100=0"#
+            ),
+            enabled: has_pixel_layer,
+            run: art_history::run,
+            journal: true,
+        },
     ]
 }
 
diff --git a/crates/engine/src/retouch_cmds/art_history.rs b/crates/engine/src/retouch_cmds/art_history.rs
new file mode 100644
index 0000000000..ab66a8f15c
--- /dev/null
+++ b/crates/engine/src/retouch_cmds/art_history.rs
@@ -0,0 +1,486 @@
+//! Art History Brush: stylized, oriented dabs sampled from a history state.
+
+use photocraft_algo::art_history::{self, Dab, MAX_COVERAGE, MAX_DABS, RNG_SEED, StampError, StampParams, Style};
+use photocraft_color::BlendMode;
+use photocraft_geom::Rect;
+use photocraft_paint::MAX_BRUSH_SIZE;
+use photocraft_paint::retouch::{Region, alpha_index};
+use serde_json::{Value, json};
+
+use super::*;
+
+const CMD: &str = "paint.artHistoryBrush";
+const MAX_POINTS: usize = 4096;
+
+fn err(msg: impl Into<String>) -> EngineError {
+    bad(CMD, msg)
+}
+
+fn object(p: &Value) -> Result<&serde_json::Map<String, Value>> {
+    p.as_object().ok_or_else(|| err("expected an object"))
+}
+
+fn finite(v: Option<&Value>, _key: &str) -> Result<Option<f32>> {
+    match v {
+        None | Some(Value::Null) => Ok(None),
+        Some(v) => v.as_f64().filter(|x| x.is_finite()).map(|x| x as f32).ok_or_else(|| err("invalid number")).map(Some),
+    }
+}
+
+fn finite_key(p: &Value, key: &str, default: f32) -> Result<f32> {
+    match finite(p.get(key), key)? {
+        None => Ok(default),
+        Some(v) => Ok(v),
+    }
+}
+
+fn ranged(p: &Value, key: &str, default: f32, lo: f32, hi: f32) -> Result<f32> {
+    let v = finite_key(p, key, default)?;
+    if (lo..=hi).contains(&v) { Ok(v) } else { Err(err(format!("`{key}` must be a number {lo}..{hi}"))) }
+}
+
+fn points(p: &Value) -> Result<Vec<[f32; 2]>> {
+    let Some(arr) = p.get("points").and_then(Value::as_array) else {
+        return Err(err("no stroke points"));
+    };
+    if arr.is_empty() {
+        return Err(err("no stroke points"));
+    }
+    if arr.len() > MAX_POINTS {
+        return Err(err("too many points"));
+    }
+    let mut out = Vec::with_capacity(arr.len());
+    for q in arr {
+        let Some(a) = q.as_array() else {
+            return Err(err("invalid number"));
+        };
+        let (Some(x), Some(y)) = (a.first(), a.get(1)) else {
+            return Err(err("invalid number"));
+        };
+        let x = x.as_f64().filter(|v| v.is_finite()).ok_or_else(|| err("invalid number"))?;
+        let y = y.as_f64().filter(|v| v.is_finite()).ok_or_else(|| err("invalid number"))?;
+        if let Some(pr) = a.get(2)
+            && pr.as_f64().filter(|v| v.is_finite()).is_none()
+        {
+            return Err(err("invalid number"));
+        }
+        out.push([x as f32, y as f32]);
+    }
+    if out.is_empty() {
+        return Err(err("no stroke points"));
+    }
+    Ok(out)
+}
+
+fn style_of(p: &Value) -> Result<Style> {
+    match p.get("style") {
+        None | Some(Value::Null) => Ok(Style::TightMedium),
+        Some(v) => {
+            let Some(s) = v.as_str() else {
+                return Err(err("unknown Art History style"));
+            };
+            Style::parse(s).ok_or_else(|| err("unknown Art History style"))
+        }
+    }
+}
+
+fn union_bounds(dabs: &[Dab]) -> Result<Rect> {
+    let mut r = Rect::EMPTY;
+    for d in dabs {
+        let (x0, y0, x1, y1) = art_history::dab_bounds(d).ok_or_else(|| err("stroke too large"))?;
+        r = r.union(&Rect::new(x0, y0, x1, y1));
+    }
+    if r.is_empty() {
+        return Err(err("no stroke points"));
+    }
+    Ok(r)
+}
+
+fn selection_mask(sel: Option<&photocraft_raster::Surface>, rect: Rect) -> Option<Vec<f32>> {
+    let sel = sel?;
+    let w = rect.width() as usize;
+    let h = rect.height() as usize;
+    let mut v = vec![0.0f32; w.saturating_mul(h)];
+    for y in rect.y0..rect.y1 {
+        for x in rect.x0..rect.x1 {
+            let i = ((y - rect.y0) as usize).saturating_mul(w).saturating_add((x - rect.x0) as usize);
+            if let Some(slot) = v.get_mut(i) {
+                *slot = sel.sample_channel(x, y, 0);
+            }
+        }
+    }
+    Some(v)
+}
+
+#[allow(clippy::too_many_arguments)]
+fn stamp_region(
+    dest: &mut Region,
+    src: &Region,
+    dabs: &[Dab],
+    hardness: f32,
+    opacity: f32,
+    flow: f32,
+    tolerance: f32,
+    sel: Option<&[f32]>,
+    lock: bool,
+    alpha: Option<usize>,
+) -> Result<u32> {
+    if dest.ch != src.ch {
+        return Err(err("source and destination do not match"));
+    }
+    let dest_w = dest.width();
+    let dest_h = dest.height();
+    let dest_origin = (dest.rect.x0, dest.rect.y0);
+    let src_w = src.width();
+    let src_h = src.height();
+    let src_origin = (src.rect.x0, src.rect.y0);
+    let ch = dest.ch;
+    let mut p = StampParams {
+        dest: &mut dest.data,
+        dest_w,
+        dest_h,
+        dest_origin,
+        src: &src.data,
+        src_w,
+        src_h,
+        src_origin,
+        ch,
+        dabs,
+        hardness,
+        opacity,
+        flow,
+        tolerance,
+        tile: 64,
+        selection: sel,
+        lock_transparent: lock,
+        alpha,
+    };
+    match art_history::stamp(&mut p) {
+        Ok(n) => Ok(n),
+        Err(StampError::Empty) => Err(err("no stroke points")),
+        Err(StampError::Mismatched) => Err(err("source and destination do not match")),
+        Err(StampError::TooLarge) => Err(err("stroke too large")),
+    }
+}
+
+/// Run `paint.artHistoryBrush`.
+pub fn run(s: &mut Session, p: &Value) -> Result<Value> {
+    let _ = object(p)?;
+    if s.active().is_none() {
+        return Err(EngineError::NoDocument);
+    }
+    let pts = points(p)?;
+    if pts.len() > MAX_DABS {
+        return Err(err("too many points"));
+    }
+    let size = finite_key(p, "size", s.tools.brush.size)?;
+    if !size.is_finite() {
+        return Err(err("invalid number"));
+    }
+    if size <= 0.0 || size > MAX_BRUSH_SIZE {
+        return Err(err("stroke too large"));
+    }
+    let hardness = ranged(p, "hardness", s.tools.brush.hardness * 100.0, 0.0, 100.0)? / 100.0;
+    let opacity = ranged(p, "opacity", 100.0, 0.0, 100.0)? / 100.0;
+    let flow = ranged(p, "flow", 100.0, 0.0, 100.0)? / 100.0;
+    let area = ranged(p, "area", 50.0, 0.0, 100.0)?;
+    // Percent of the channel range; 0 (paint everywhere) is the default, as in Photoshop.
+    let tolerance = ranged(p, "tolerance", 0.0, 0.0, 100.0)? / 100.0;
+    let style = style_of(p)?;
+    // The stamp mixes the source in by coverage, so only Normal is right; other modes need a
+    // stroke buffer (blending each dab with the already-mixed result rings every dab edge).
+    if blend_param(p, CMD)? != BlendMode::Normal {
+        return Err(err("only the Normal mode is supported"));
+    }
+    let (stroke, id) = parse_brush(s, p, CMD)?;
+    let _ = stroke;
+    // The same source as the History Brush: the `state` or `snapshot` passed, else the History
+    // panel's source, refused after a canvas size change.
+    let src_surface = super::history_source(s, id, p, CMD)?;
+    // Truncating a huge row index only changes the seed.
+    let seed = RNG_SEED ^ p.get("state").and_then(Value::as_u64).map_or(0, |i| i as u32);
+    let dabs = art_history::place_dabs(&pts, size, area, style, seed).map_err(|e| match e {
+        StampError::TooLarge => err("stroke too large"),
+        _ => err("no stroke points"),
+    })?;
+    if dabs.is_empty() {
+        return Err(err("no stroke points"));
+    }
+    let bounds = union_bounds(&dabs)?;
+    // The stamp reads each dab's bounds plus one pixel for bilinear sampling,
+    // so only that margin counts against the coverage limit.
+    let outer = bounds.inflate(1);
+    let area_px = (outer.width() as u64).saturating_mul(outer.height() as u64);
+    if outer.is_empty() || area_px > MAX_COVERAGE {
+        return Err(err("stroke too large"));
+    }
+
+    // Nothing written (every dab under the tolerance, outside the selection or on locked
+    // transparency): a no-op stroke, with no history step.
+    let mut nothing_written = false;
+    let dmg = run_stroke(s, "Art History Brush", id, p, |_, surf, sel, lock| {
+        let fmt = surf.format();
+        let src = if src_surface.format() == fmt { src_surface.clone() } else { src_surface.convert(fmt) };
+        if src.channels() != surf.channels() {
+            return Err(err("source and destination do not match"));
+        }
+        let mut dest = Region::read(surf, outer);
+        let src_reg = Region::read(&src, outer);
+        if dest.ch != src_reg.ch || dest.width() != src_reg.width() || dest.height() != src_reg.height() {
+            return Err(err("source and destination do not match"));
+        }
+        let sel_mask = selection_mask(sel, outer);
+        let n = stamp_region(&mut dest, &src_reg, &dabs, hardness, opacity, flow, tolerance, sel_mask.as_deref(), lock, alpha_index(&fmt))?;
+        if n == 0 {
+            nothing_written = true;
+            return Err(err("the stroke changed no pixel"));
+        }
+        dest.write(surf);
+        Ok(bounds)
+    });
+    let dmg = match dmg {
+        Err(_) if nothing_written => return Ok(json!({ "damage": Value::Null })),
+        r => r?,
+    };
+    Ok(json!({ "damage": damage_json(dmg) }))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use photocraft_color::ColorMode;
+    use photocraft_doc::LayerContent;
+    use serde_json::json;
+
+    fn session(w: u32, h: u32, depth: u64, mode: &str) -> Session {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": w, "height": h, "depth": depth, "mode": mode})).unwrap();
+        s
+    }
+
+    fn rgba(s: &Session, x: i32, y: i32) -> [f32; 4] {
+        let d = s.active().unwrap();
+        d.doc.layer(d.active_layer.unwrap()).unwrap().surface().unwrap().rgba(x, y)
+    }
+
+    fn paint_layer(s: &mut Session, f: impl Fn(i32, i32) -> [f32; 4]) {
+        s.edit("setup", |doc, active| {
+            let b = doc.bounds();
+            let surf = doc.layer_mut(active.unwrap()).unwrap().surface_mut().unwrap();
+            let fmt = surf.format();
+            let mut data = Vec::new();
+            for y in b.y0..b.y1 {
+                for x in b.x0..b.x1 {
+                    data.extend(photocraft_raster::from_rgba(&fmt, f(x, y)));
+                }
+            }
+            surf.write_region(b, &data);
+            Ok(())
+        })
+        .unwrap();
+    }
+
+    fn stroke(s: &mut Session, extra: Value) -> std::result::Result<Value, EngineError> {
+        let mut p = json!({"points": [[8, 16], [40, 16]], "size": 12, "hardness": 100, "area": 50, "tolerance": 0, "style": "tightMedium"});
+        if let Some(map) = extra.as_object() {
+            for (k, v) in map {
+                p[k] = v.clone();
+            }
+        }
+        s.execute("paint.artHistoryBrush", p)
+    }
+
+    #[test]
+    fn restores_open_state_at_every_depth_and_undoes() {
+        for (depth, mode) in [(8u64, "rgb"), (16, "rgb"), (32, "rgb"), (16, "gray")] {
+            let mut s = session(48, 32, depth, mode);
+            paint_layer(&mut s, |_, _| [0.1, 0.8, 0.2, 1.0]);
+            s.execute("edit.fill", json!({"color": "#2030c0"})).unwrap();
+            let before = rgba(&s, 20, 16);
+            stroke(&mut s, json!({"state": 1})).unwrap();
+            let after = rgba(&s, 20, 16);
+            if mode == "gray" {
+                assert!(after[0] > before[0] + 0.1, "restored lighter gray {depth}: before {before:?} after {after:?}");
+            } else {
+                assert!(before[2] > 0.5, "{mode} {depth} {before:?}");
+                assert!(after[1] > after[2], "restored green {mode} {depth}: {after:?}");
+            }
+            let steps = s.active().unwrap().history.past_len();
+            stroke(&mut s, json!({"style": "looseCurl"})).unwrap();
+            assert_eq!(s.active().unwrap().history.past_len(), steps + 1, "one mouse-up = one step");
+            assert!(s.undo());
+            assert!(s.undo());
+            let undone = rgba(&s, 20, 16);
+            for c in 0..3 {
+                assert!((undone[c] - before[c]).abs() < 0.05, "undo {mode} {depth}");
+            }
+            assert!(s.redo());
+        }
+    }
+
+    #[test]
+    fn default_tolerance_paints_a_moderate_history_edit() {
+        let mut s = session(48, 32, 8, "rgb");
+        paint_layer(&mut s, |_, _| [0.5, 0.5, 0.5, 1.0]);
+        paint_layer(&mut s, |_, _| [0.6, 0.6, 0.6, 1.0]);
+        let steps = s.active().unwrap().history.past_len();
+        let p = json!({"points": [[8, 16], [40, 16]], "size": 12, "hardness": 100, "style": "tightMedium", "state": 1});
+        s.execute("paint.artHistoryBrush", p).unwrap();
+        assert_eq!(s.active().unwrap().history.past_len(), steps + 1);
+        assert!(rgba(&s, 24, 16)[0] < 0.55, "{:?}", rgba(&s, 24, 16));
+    }
+
+    #[test]
+    fn stroke_under_the_tolerance_records_no_step() {
+        let mut s = session(48, 32, 8, "rgb");
+        paint_layer(&mut s, |_, _| [0.5, 0.5, 0.5, 1.0]);
+        paint_layer(&mut s, |_, _| [0.6, 0.6, 0.6, 1.0]);
+        let steps = s.active().unwrap().history.past_len();
+        let r = stroke(&mut s, json!({"state": 1, "tolerance": 50})).unwrap();
+        assert!(r["damage"].is_null(), "{r}");
+        assert_eq!(s.active().unwrap().history.past_len(), steps);
+        assert!((rgba(&s, 24, 16)[0] - 0.6).abs() < 0.01);
+    }
+
+    #[test]
+    fn large_brush_click_is_not_too_large() {
+        let mut s = session(2600, 2600, 8, "rgb");
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("edit.fill", json!({"color": "#00ff00"})).unwrap();
+        for (style, size) in [("looseCurl", 2000), ("tightMedium", 2400)] {
+            let r = stroke(&mut s, json!({"state": 1, "points": [[1300, 1300]], "size": size, "style": style}));
+            assert!(r.is_ok(), "{style} size {size}: {r:?}");
+        }
+    }
+
+    #[test]
+    fn state_one_uses_that_snapshot() {
+        let mut s = session(40, 24, 8, "rgb");
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("edit.fill", json!({"color": "#00ff00"})).unwrap();
+        stroke(&mut s, json!({"state": 1, "points": [[4, 12], [20, 12]], "size": 10})).unwrap();
+        let p = rgba(&s, 10, 12);
+        assert!(p[0] > 0.9 && p[1] < 0.2, "state 1 is red, got {p:?}");
+    }
+
+    /// With no `state`, the brush paints from the History panel's source, like the History Brush.
+    #[test]
+    fn paints_from_the_history_panel_source() {
+        let mut s = session(40, 24, 8, "rgb");
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("edit.fill", json!({"color": "#00ff00"})).unwrap();
+        s.execute("history.setSource", json!({"state": 1})).unwrap();
+        s.execute("paint.artHistoryBrush", json!({"points": [[4, 12], [30, 12]], "size": 10, "hardness": 100})).unwrap();
+        let p = rgba(&s, 12, 12);
+        assert!(p[0] > 0.9 && p[1] < 0.2, "the source row is red, got {p:?}");
+    }
+
+    /// A source of another canvas size is refused, not painted shifted.
+    #[test]
+    fn a_source_of_another_canvas_size_is_refused() {
+        let mut s = session(40, 24, 8, "rgb");
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("image.canvasSize", json!({"width": 60, "height": 30, "anchor": "center"})).unwrap();
+        let steps = s.active().unwrap().history.past_len();
+        let e = stroke(&mut s, json!({"state": 1})).unwrap_err().to_string();
+        assert!(e.contains("canvas size"), "{e}");
+        assert_eq!(s.active().unwrap().history.past_len(), steps);
+    }
+
+    /// A stroke that writes nothing (wholly outside the selection, or on transparent pixels
+    /// with Lock Transparency) does nothing, as with the tolerance: no error, no History step.
+    #[test]
+    fn a_stroke_that_writes_nothing_is_a_quiet_no_op() {
+        let mut s = session(48, 32, 8, "rgb");
+        s.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        s.execute("edit.fill", json!({"color": "#0000ff"})).unwrap();
+        s.execute("select.rect", json!({"x": 0, "y": 0, "width": 4, "height": 4})).unwrap();
+        let steps = s.active().unwrap().history.past_len();
+        let r = stroke(&mut s, json!({"state": 1})).unwrap();
+        assert!(r["damage"].is_null(), "{r}");
+        assert_eq!(s.active().unwrap().history.past_len(), steps);
+        assert!(rgba(&s, 24, 16)[2] > 0.9, "still blue");
+
+        let mut s = session(48, 32, 8, "rgb");
+        s.execute("layer.new.layer", json!({})).unwrap();
+        s.edit("lock", |doc, active| {
+            doc.layer_mut(active.unwrap()).unwrap().locks.transparency = true;
+            Ok(())
+        })
+        .unwrap();
+        let steps = s.active().unwrap().history.past_len();
+        // Row 1: the new, transparent layer.
+        let r = stroke(&mut s, json!({"state": 1})).unwrap();
+        assert!(r["damage"].is_null(), "{r}");
+        assert_eq!(s.active().unwrap().history.past_len(), steps);
+    }
+
+    #[test]
+    fn only_the_normal_mode_paints() {
+        let mut s = session(48, 32, 8, "rgb");
+        paint_layer(&mut s, |_, _| [1.0, 1.0, 1.0, 1.0]);
+        paint_layer(&mut s, |_, _| [0.5, 0.5, 0.5, 1.0]);
+        let steps = s.active().unwrap().history.past_len();
+        // Multiply by a white source would leave the grey as it is, but blending each dab with the
+        // already-mixed result darkened every dab edge: refused until a stroke buffer exists.
+        assert!(stroke(&mut s, json!({"state": 1, "mode": "multiply"})).is_err());
+        assert_eq!(s.active().unwrap().history.past_len(), steps);
+        assert!((rgba(&s, 24, 16)[0] - 0.5).abs() < 0.01);
+        stroke(&mut s, json!({"state": 1, "mode": "normal"})).unwrap();
+        assert!(rgba(&s, 24, 16)[0] > 0.9, "{:?}", rgba(&s, 24, 16));
+    }
+
+    #[test]
+    fn bad_params_are_errors() {
+        let mut s = session(32, 24, 8, "rgb");
+        paint_layer(&mut s, |_, _| [0.2, 0.3, 0.4, 1.0]);
+        assert!(s.execute("paint.artHistoryBrush", json!([])).is_err());
+        assert!(s.execute("paint.artHistoryBrush", json!({})).is_err());
+        assert!(s.execute("paint.artHistoryBrush", json!({"points": []})).is_err());
+        assert!(
+            s.execute("paint.artHistoryBrush", json!({"points": [[0, 0]], "style": "nope"})).unwrap_err().to_string().contains("unknown Art History style")
+        );
+        assert!(s.execute("paint.artHistoryBrush", json!({"points": [[0, 0]], "state": 99})).is_err());
+        assert!(s.execute("paint.artHistoryBrush", json!({"points": [[0, 0]], "state": u64::MAX})).is_err());
+        assert!(s.execute("paint.artHistoryBrush", json!({"points": [[0, 0]], "area": -1})).is_err());
+        assert!(s.execute("paint.artHistoryBrush", json!({"points": [[0, 0]], "size": "nan"})).is_err());
+        let many: Vec<[f32; 2]> = (0..10_000).map(|i| [i as f32, 0.0]).collect();
+        assert!(s.execute("paint.artHistoryBrush", json!({"points": many})).unwrap_err().to_string().contains("too many points"));
+        assert!(s.execute("paint.artHistoryBrush", json!({"points": [[5, 5]], "size": 8000})).unwrap_err().to_string().contains("stroke too large"));
+        assert!(!Session::new().is_enabled("paint.artHistoryBrush"));
+        assert!(crate::commands::find("paint.artHistoryBrush").is_some());
+    }
+
+    #[test]
+    fn pixel_lock_and_type_layer_error() {
+        let mut s = session(24, 24, 8, "rgb");
+        s.execute("layer.setProps", json!({"locks": {"pixels": true}})).unwrap();
+        let e = stroke(&mut s, json!({})).unwrap_err().to_string();
+        assert!(e.contains("locked"), "{e}");
+        s.execute("layer.setProps", json!({"locks": {"pixels": false}})).unwrap();
+        s.execute("type.create", json!({"x": 8, "y": 16, "text": "Hi", "size": 12})).unwrap();
+        assert!(stroke(&mut s, json!({})).is_err());
+        let kind = s.active().and_then(|d| d.active_layer.and_then(|id| d.doc.layer(id))).map(|l| matches!(l.content, LayerContent::Text(_)));
+        assert_eq!(kind, Some(true));
+    }
+
+    #[test]
+    fn cmyk_does_not_panic() {
+        let mut s = session(32, 24, 8, "cmyk");
+        paint_layer(&mut s, |_, _| [0.2, 0.3, 0.4, 1.0]);
+        s.execute("edit.fill", json!({"color": "#404040"})).ok();
+        let _ = stroke(&mut s, json!({"tolerance": 0}));
+        assert_eq!(s.active().unwrap().doc.mode, ColorMode::Cmyk);
+    }
+
+    #[test]
+    fn command_is_registered() {
+        let spec = crate::commands::find("paint.artHistoryBrush").expect("registered");
+        assert_eq!(spec.label, "Art History Brush");
+        assert!(spec.params.contains("style"));
+        assert!(spec.journal);
+        assert!(!Session::new().is_enabled("paint.artHistoryBrush"));
+        let s = session(16, 16, 8, "rgb");
+        assert!(s.is_enabled("paint.artHistoryBrush"));
+    }
+}
diff --git a/crates/engine/src/retouch_cmds/tests.rs b/crates/engine/src/retouch_cmds/tests.rs
index 524e12f080..b0d5c7bb18 100644
--- a/crates/engine/src/retouch_cmds/tests.rs
+++ b/crates/engine/src/retouch_cmds/tests.rs
@@ -690,6 +690,7 @@ fn retouch_commands_are_registered_and_need_a_pixel_layer() {
         "paint.smudge",
         "paint.historyBrush",
         "paint.remove",
+        "paint.artHistoryBrush",
     ];
     for id in ids {
         let spec = crate::commands::find(id).unwrap_or_else(|| panic!("{id} missing"));
@@ -706,7 +707,7 @@ fn retouch_commands_are_registered_and_need_a_pixel_layer() {
 // Paint target (#207): mask, alpha channel, Quick Mask
 // ---------------------------------------------------------------------------------------------
 
-const RETOUCH_IDS: [&str; 12] = [
+const RETOUCH_IDS: [&str; 13] = [
     "paint.cloneStamp",
     "paint.patternStamp",
     "paint.healingBrush",
@@ -719,6 +720,7 @@ const RETOUCH_IDS: [&str; 12] = [
     "paint.smudge",
     "paint.historyBrush",
     "paint.remove",
+    "paint.artHistoryBrush",
 ];
 
 /// Grey noise in 0.3..0.7 (no period along the clone offset used below).
@@ -769,6 +771,10 @@ fn retouch_params(id: &str, history_state: usize, target: Value) -> Value {
     match id {
         "paint.cloneStamp" | "paint.healingBrush" => p["offset"] = json!([-13, 3]),
         "paint.historyBrush" => p["state"] = json!(history_state),
+        "paint.artHistoryBrush" => {
+            p["state"] = json!(history_state);
+            p["tolerance"] = json!(0);
+        }
         "paint.sponge" => p["mode"] = json!("saturate"),
         _ => {}
     }
diff --git a/crates/engine/src/shell_commands.rs b/crates/engine/src/shell_commands.rs
index 33383d1045..61c33bb8cf 100644
--- a/crates/engine/src/shell_commands.rs
+++ b/crates/engine/src/shell_commands.rs
@@ -18,6 +18,12 @@ pub const SHELL_COMMANDS: &[(&str, &str, &[&str], Option<&str>)] = &[
     ("window.panel.dock", "Dock Panel", &[], None),
     ("window.panel.activate", "Activate Panel", &[], None),
     ("window.panel.close", "Close Panel", &[], None),
+    ("window.panel.closeGroup", "Close Tab Group", &[], None),
+    ("window.panel.closeOthers", "Close Other Panels in Group", &[], None),
+    ("window.panel.minimize", "Minimize Panel", &[], None),
+    ("window.panel.iconic", "Collapse to Icons", &[], None),
+    ("window.panel.window", "Open Panel in Own Window", &[], None),
+    ("ui.dock", "Arrange Panels", &[], None),
     ("file.open", "Open…", &["File"], Some("Cmd+O")),
     ("file.save", "Save", &["File"], Some("Cmd+S")),
     ("file.saveAs", "Save As…", &["File"], Some("Cmd+Shift+S")),
@@ -138,6 +144,7 @@ pub const TOOLS: &[(&str, &str, Option<&str>)] = &[
     ("tools.select.cloneStamp", "Clone Stamp Tool", Some("S")),
     ("tools.select.patternStamp", "Pattern Stamp Tool", Some("S")),
     ("tools.select.historyBrush", "History Brush Tool", Some("Y")),
+    ("tools.select.artHistoryBrush", "Art History Brush Tool", Some("Y")),
     ("tools.select.blur", "Blur Tool", None),
     ("tools.select.sharpen", "Sharpen Tool", None),
     ("tools.select.smudge", "Smudge Tool", None),
diff --git a/crates/engine/src/smart_cmds.rs b/crates/engine/src/smart_cmds.rs
index 9949bddea0..1205c82e4c 100644
--- a/crates/engine/src/smart_cmds.rs
+++ b/crates/engine/src/smart_cmds.rs
@@ -644,6 +644,40 @@ fn smart_mut(doc: &mut Document, id: LayerId) -> Result<&mut SmartObject> {
     }
 }
 
+/// Whether `l`'s filter mask can be painted (`"target":"filterMask"`): a smart object with smart
+/// filters. Its filter mask need not exist yet: painting starts it white (Reveal All), the mask
+/// Photoshop adds with the first smart filter.
+pub(crate) fn filter_mask_paintable(l: &Layer) -> std::result::Result<(), String> {
+    match &l.content {
+        LayerContent::Smart(sm) if !sm.smart_filters.is_empty() => Ok(()),
+        LayerContent::Smart(_) => Err(format!("smart object \"{}\" has no smart filters, so no filter mask", l.name)),
+        other => Err(format!("the active layer is {} {} layer, not a smart object", other.article(), other.kind_name())),
+    }
+}
+
+/// The filter mask surface of smart object `id` for painting into, made white (Reveal All) first
+/// when the object has smart filters but no filter mask yet. The caller re-renders the object
+/// afterwards ([`refresh_after_filter_mask_edit`]).
+pub(crate) fn filter_mask_surface(doc: &mut Document, id: LayerId) -> Result<&mut Surface> {
+    let l = doc.layer_mut(id).ok_or(EngineError::NoLayer(id))?;
+    filter_mask_paintable(l).map_err(EngineError::Other)?;
+    let sm = smart_mut_of(l)?;
+    Ok(&mut sm.filter_mask.get_or_insert_with(LayerMask::reveal_all).surface)
+}
+
+/// Re-renders smart object `id` after its filter mask was painted, filled or filtered, so the
+/// stroke shows (where the mask is black the smart filters don't). Part of the same history step.
+pub(crate) fn refresh_after_filter_mask_edit(doc: &mut Document, id: LayerId) -> Result<()> {
+    if matches!(doc.layer(id).map(|l| &l.content), Some(LayerContent::Smart(_))) { refresh_or_fail(doc, id) } else { Ok(()) }
+}
+
+fn smart_mut_of(l: &mut Layer) -> Result<&mut SmartObject> {
+    match &mut l.content {
+        LayerContent::Smart(sm) => Ok(sm),
+        _ => Err(other("the layer is not a smart object")),
+    }
+}
+
 fn mask_from_selection(sel: &Surface) -> LayerMask {
     LayerMask { surface: sel.clone(), enabled: true, linked: true, density: 1.0, feather: 0.0 }
 }
@@ -1068,6 +1102,7 @@ pub fn commit_child(s: &mut Session, index: usize) -> Result<bool> {
     let bytes = Arc::new(encode_source(&child)?);
     let prev = s.active;
     s.active = Some(parent);
+    s.note_active_change();
     let r = s.edit("Edit Contents", |doc, _| {
         let ids = instances(doc, link.contents_id);
         if ids.is_empty() {
@@ -1087,6 +1122,7 @@ pub fn commit_child(s: &mut Session, index: usize) -> Result<bool> {
         Ok(())
     });
     s.active = prev;
+    s.note_active_change();
     r?;
     if let Some(st) = s.docs.get_mut(index) {
         st.saved_revision = st.revision;
diff --git a/crates/engine/src/smart_cmds/tests.rs b/crates/engine/src/smart_cmds/tests.rs
index 585c762977..594d8ac3dd 100644
--- a/crates/engine/src/smart_cmds/tests.rs
+++ b/crates/engine/src/smart_cmds/tests.rs
@@ -1,5 +1,6 @@
 use super::*;
 
+mod filter_mask_paint;
 mod selection;
 mod stack_cache;
 
diff --git a/crates/engine/src/smart_cmds/tests/filter_mask_paint.rs b/crates/engine/src/smart_cmds/tests/filter_mask_paint.rs
new file mode 100644
index 0000000000..cae9f91409
--- /dev/null
+++ b/crates/engine/src/smart_cmds/tests/filter_mask_paint.rs
@@ -0,0 +1,201 @@
+//! FILE-215-3: painting a smart object's filter mask (`"target":"filterMask"`) hides the smart
+//! filters where it is black, in one undo step, and the painted mask is saved.
+
+use super::*;
+
+/// A vertical black stroke over x = 8 into the filter mask, as the Brush tool sends it.
+fn stroke(s: &mut Session, target: Option<&str>) -> Result<Value> {
+    let mut p = json!({"points": [[8, 2], [8, 46]], "size": 8, "hardness": 1, "color": "#000000"});
+    if let Some(t) = target {
+        p["target"] = json!(t);
+    }
+    s.execute("paint.stroke", p)
+}
+
+#[test]
+fn painting_the_filter_mask_hides_the_filters_there_in_one_undo_step() {
+    for depth in DEPTHS {
+        let mut s = session(depth);
+        paint(&mut s);
+        let original = flat(&s);
+        convert(&mut s);
+        // Without smart filters there is no filter mask to paint.
+        let before = s.active().unwrap().doc.clone();
+        let steps = s.active().unwrap().history.past_len();
+        assert!(matches!(stroke(&mut s, Some("filterMask")), Err(EngineError::Disabled(..))), "depth {depth}");
+        assert!(std::sync::Arc::ptr_eq(&s.active().unwrap().doc, &before));
+        assert_eq!(s.active().unwrap().history.past_len(), steps);
+        s.execute("filter.blur.gaussianBlur", json!({"radius": 3})).unwrap();
+        let blurred = flat(&s);
+        assert!(active_smart(&s).filter_mask.is_none());
+        let steps = s.active().unwrap().history.past_len();
+
+        stroke(&mut s, Some("filterMask")).unwrap();
+        let mask = active_smart(&s).filter_mask.expect("painting starts a white filter mask");
+        assert_eq!((mask.value(8, 20), mask.value(30, 20)), (0.0, 1.0), "depth {depth}");
+        let px = flat(&s);
+        let at = |v: &Vec<[f32; 4]>, x: i32, y: i32| v[(y * W + x) as usize];
+        assert!(max_diff(&[at(&px, 8, 20)], &[at(&original, 8, 20)]) < 1e-6, "depth {depth}: black hides the blur");
+        assert_eq!(at(&px, 30, 20), at(&blurred, 30, 20), "depth {depth}: white keeps it");
+        assert!(active_smart(&s).smart_filters.len() == 1, "the stroke is no smart filter");
+
+        assert_eq!(s.active().unwrap().history.past_len(), steps + 1, "one step");
+        s.execute("edit.undo", json!({})).unwrap();
+        assert!(active_smart(&s).filter_mask.is_none());
+        assert_eq!(flat(&s), blurred, "depth {depth}: undo brings the blur back");
+        s.execute("edit.redo", json!({})).unwrap();
+        assert_eq!(flat(&s), px);
+
+        // The painted mask is saved: .pcraft and PSD give it back.
+        let doc = s.active().unwrap().doc.clone();
+        let id = s.active().unwrap().active_layer.unwrap();
+        let back = photocraft_format::load_from_bytes(&photocraft_format::save_to_bytes(&doc, &Default::default()).unwrap()).unwrap();
+        assert_eq!(smart(&back, id).unwrap().filter_mask, smart(&doc, id).unwrap().filter_mask, "depth {depth}: .pcraft");
+        let psd = photocraft_io::export(&doc, "psd", &Default::default()).unwrap();
+        let back = photocraft_io::import("x.psd", &psd.bytes).unwrap().document;
+        let sm = back.walk().into_iter().find_map(|(_, _, l)| if let LayerContent::Smart(sm) = &l.content { Some(sm.clone()) } else { None }).unwrap();
+        let (mut a, mut b) = (Vec::new(), Vec::new());
+        sm.filter_mask.as_ref().unwrap().values_into(doc.bounds(), &mut a);
+        mask.values_into(doc.bounds(), &mut b);
+        assert_eq!(a, b, "depth {depth}: PSD");
+    }
+}
+
+/// ⌥-click on the filter mask thumbnail shows it; painting then goes into it without a target.
+#[test]
+fn a_shown_filter_mask_takes_the_paint() {
+    let mut s = session(8);
+    paint(&mut s);
+    convert(&mut s);
+    s.execute("filter.blur.gaussianBlur", json!({"radius": 3})).unwrap();
+    let before = s.active().unwrap().channel_view.clone();
+    assert!(s.execute("view.layerMask", json!({"mode": "gray", "mask": "filter"})).is_err(), "no filter mask yet");
+    assert_eq!(s.active().unwrap().channel_view, before);
+    stroke(&mut s, Some("filterMask")).unwrap();
+    let v = s.execute("view.layerMask", json!({"mode": "gray", "mask": "filter"})).unwrap();
+    assert_eq!(v["mode"], "gray");
+    assert!(s.active().unwrap().channel_view.shown_layer_mask(&s.active().unwrap().doc).is_some());
+    s.execute("paint.stroke", json!({"points": [[30, 2], [30, 46]], "size": 8, "hardness": 1, "color": "#000000"})).unwrap();
+    let mask = active_smart(&s).filter_mask.unwrap();
+    assert_eq!(mask.value(30, 20), 0.0, "the stroke went into the filter mask");
+    let d = s.active().unwrap();
+    assert!(matches!(d.doc.layer(d.active_layer.unwrap()).unwrap().content, LayerContent::Smart(_)), "still a smart object");
+    // Bad params are refused, not a panic.
+    let before = s.active().unwrap().channel_view.clone();
+    assert!(s.execute("view.layerMask", json!({"mask": 3})).is_err());
+    assert_eq!(s.active().unwrap().channel_view, before);
+}
+
+#[test]
+fn copying_the_filter_mask_never_copies_the_layer_mask() {
+    for depth in DEPTHS {
+        let mut s = session(depth);
+        paint(&mut s);
+        convert(&mut s);
+        s.execute("filter.blur.gaussianBlur", json!({"radius": 3})).unwrap();
+        stroke(&mut s, Some("filterMask")).unwrap();
+        for layer_mask in [false, true] {
+            if layer_mask {
+                s.execute("layer.layerMask.revealAll", json!({})).unwrap();
+            }
+            let before = s.active().unwrap().doc.clone();
+            let steps = s.active().unwrap().history.past_len();
+            let result = s.execute("edit.copy", json!({"target": "filterMask"})).unwrap();
+            assert_eq!(result["target"], "filterMask");
+            let clip = s.clipboard.as_ref().unwrap();
+            assert_eq!(clip.surface.rgba(8, 20), [0.0, 0.0, 0.0, 1.0]);
+            assert_eq!(clip.surface.rgba(30, 20), [1.0; 4]);
+            assert!(std::sync::Arc::ptr_eq(&s.active().unwrap().doc, &before));
+            assert_eq!(s.active().unwrap().history.past_len(), steps);
+        }
+    }
+}
+
+#[test]
+fn an_explicit_layer_checks_filter_mask_eligibility() {
+    let mut s = session(8);
+    paint(&mut s);
+    let id = convert(&mut s);
+    s.execute("filter.blur.gaussianBlur", json!({"radius": 3})).unwrap();
+    s.execute("shape.create", json!({"kind": "rect", "rect": [1, 1, 20, 20], "fill": "#ff0000"})).unwrap();
+    let active = s.active().unwrap().active_layer;
+    s.execute("paint.cloneStamp", json!({"layer": id, "target": "filterMask", "source": [8, 8], "points": [[20, 20]], "size": 4})).unwrap();
+    assert_eq!(s.active().unwrap().active_layer, active);
+    // A shape has no filter mask: rejection must precede recoloring its fill.
+    let before = s.active().unwrap().doc.clone();
+    let steps = s.active().unwrap().history.past_len();
+    assert!(s.execute("edit.fillForeground", json!({"layer": active.unwrap().0, "target": "filterMask"})).is_err());
+    assert!(std::sync::Arc::ptr_eq(&s.active().unwrap().doc, &before));
+    assert_eq!(s.active().unwrap().history.past_len(), steps);
+}
+
+/// With its filter mask targeted, the commands that don't edit a filter mask act on the smart
+/// object as without the target: Edit › Transform flips it, and Convert for Smart Filters stays
+/// disabled (it would nest the smart object).
+#[test]
+fn the_filter_mask_target_leaves_the_smart_object_commands_alone() {
+    let mut s = session(8);
+    paint(&mut s);
+    convert(&mut s);
+    s.execute("filter.blur.gaussianBlur", json!({"radius": 3})).unwrap();
+    stroke(&mut s, Some("filterMask")).unwrap();
+    let steps = s.active().unwrap().history.past_len();
+    assert!(
+        matches!(s.execute("filter.convertForSmartFilters", json!({"target": "filterMask"})), Err(EngineError::Disabled(..))),
+        "the layer is already a smart object"
+    );
+    assert_eq!(s.active().unwrap().history.past_len(), steps);
+    let before = active_smart(&s).transform;
+    s.execute("edit.transform.flipHorizontal", json!({"target": "filterMask"})).unwrap();
+    assert_ne!(active_smart(&s).transform, before, "the smart object flips");
+    // A shown filter mask doesn't send them the target either.
+    s.execute("view.layerMask", json!({"mode": "gray", "mask": "filter"})).unwrap();
+    assert_eq!(crate::channel_cmds::inject_target(&s, "edit.transform.flipHorizontal", json!({})), json!({}));
+    assert_eq!(crate::channel_cmds::inject_target(&s, "filter.convertForSmartFilters", json!({})), json!({}));
+    assert_eq!(crate::channel_cmds::inject_target(&s, "paint.stroke", json!({}))["target"], "filterMask");
+    // Curves on the shown filter mask edits that gray plane, not the layer mask or the colours.
+    let curve = crate::channel_cmds::isolated_curve_channel(s.active().unwrap()).expect("a gray target");
+    assert_eq!(curve.gray, Some(crate::channel_cmds::GraySurface::FilterMask));
+    let flipped = active_smart(&s).transform;
+    s.execute("edit.transform.flipHorizontal", json!({})).unwrap();
+    assert_ne!(active_smart(&s).transform, flipped, "the smart object flips again");
+    // Moving the smart object doesn't re-render its filters as a filter-mask edit.
+    let p = json!({"dx": 2, "target": "filterMask"});
+    assert_eq!(crate::channel_cmds::filter_mask_layer(&s, "layer.translate", &p), None);
+    assert!(crate::channel_cmds::filter_mask_layer(&s, "paint.stroke", &p).is_some());
+    // Every other routed command edits it and re-renders the object: Equalize too, though it
+    // takes no layer mask target by default.
+    for cmd in ["image.adjustments.shadowsHighlights", "plugin.run", "filter.blur.average"] {
+        assert!(crate::channel_cmds::filter_mask_layer(&s, cmd, &p).is_some(), "{cmd}");
+    }
+    let steps = s.active().unwrap().history.past_len();
+    s.execute("image.adjustments.equalize", json!({"target": "filterMask"})).unwrap();
+    assert_eq!(s.active().unwrap().history.past_len(), steps + 1);
+    assert_eq!(active_smart(&s).smart_filters.len(), 1, "no new smart filter: the filter mask was equalized");
+}
+
+/// Gaussian Blur with the filter mask targeted softens the mask's edge (the usual way to feather
+/// it), re-renders the smart object, and adds no second smart filter.
+#[test]
+fn blurring_the_filter_mask_feathers_it() {
+    for depth in DEPTHS {
+        let mut s = session(depth);
+        paint(&mut s);
+        convert(&mut s);
+        s.execute("filter.blur.gaussianBlur", json!({"radius": 3})).unwrap();
+        stroke(&mut s, Some("filterMask")).unwrap();
+        let hard = active_smart(&s).filter_mask.unwrap();
+        let edge = (9..W).find(|&x| hard.value(x, 20) == 1.0).expect("white right of the stroke");
+        let px = flat(&s);
+        let steps = s.active().unwrap().history.past_len();
+
+        s.execute("filter.blur.gaussianBlur", json!({"radius": 3, "target": "filterMask"})).unwrap();
+        let soft = active_smart(&s).filter_mask.unwrap();
+        let v = soft.value(edge, 20);
+        assert!(v > 0.0 && v < 1.0, "depth {depth}: the mask edge is soft, got {v}");
+        assert_eq!(soft.value(30, 20), 1.0, "depth {depth}: far from the stroke stays white");
+        assert_eq!(active_smart(&s).smart_filters.len(), 1, "depth {depth}: no second smart filter");
+        assert_ne!(flat(&s), px, "depth {depth}: the smart object is re-rendered");
+        assert_eq!(s.active().unwrap().history.past_len(), steps + 1, "depth {depth}: one step");
+    }
+}
diff --git a/crates/engine/src/style_asl_cmds.rs b/crates/engine/src/style_asl_cmds.rs
index 8d80c816a1..840459bf6d 100644
--- a/crates/engine/src/style_asl_cmds.rs
+++ b/crates/engine/src/style_asl_cmds.rs
@@ -55,10 +55,7 @@ fn import(s: &mut Session, p: &Value) -> Result<Value> {
     let mut pattern_ids = Vec::new();
     for pat in imp.patterns {
         pattern_ids.push(pat.id.clone());
-        match s.patterns.items.iter_mut().find(|q| q.id == pat.id) {
-            Some(q) => *q = pat,
-            None => s.patterns.items.push(pat),
-        }
+        s.patterns.upsert(pat);
     }
     let styles = &mut s.presets.styles;
     if replace {
@@ -241,6 +238,24 @@ mod tests {
         assert!((f.opacity - l.opacity).abs() < 1e-4);
     }
 
+    /// #9318 review: an ASL that replaces a library pattern by id marks its pixels changed, so the
+    /// preset store writes the replacement (see `PatternLibrary::pixels_rev`).
+    #[test]
+    fn an_asl_pattern_replacement_bumps_pixels_rev() {
+        let mut s = session();
+        let mut pat = s.patterns.items[1].clone();
+        pat.id = "asl-replaced-pattern".into();
+        let asl = |p: &photocraft_doc::Pattern| {
+            let style = AslStyle { name: "Pat".into(), effects: vec![], blend: None, opacity: None, fill_opacity: None };
+            b64_encode(&asl_map::write_asl(&[style], std::slice::from_ref(p)).unwrap())
+        };
+        s.execute(IMPORT, json!({"data": asl(&pat), "group": "A"})).unwrap();
+        let rev = s.patterns.pixels_rev;
+        pat.surface = s.patterns.items[2].surface.clone();
+        s.execute(IMPORT, json!({"data": asl(&pat), "group": "B"})).unwrap();
+        assert!(s.patterns.pixels_rev > rev, "the same-id replacement is marked");
+    }
+
     #[test]
     fn embedded_patterns_reach_the_library_and_the_document() {
         let mut s = session();
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 9e06c966de..954d0c4635 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1823,3 +1823,25 @@ fn history_states_share_large_document_payloads() {
     };
     assert!(std::sync::Arc::ptr_eq(&raw(now), &raw(then)), "the adjustment's bytes are shared");
 }
+
+#[test]
+fn the_document_activation_generation_bumps_on_switch_and_back() {
+    let mut s = session_with_doc();
+    let first = s.active().unwrap().doc.id;
+    let g1 = s.active_generation();
+    s.execute("file.new", json!({"width": 8, "height": 8})).unwrap();
+    let second = s.active().unwrap().doc.id;
+    assert_ne!(second, first);
+    let g2 = s.active_generation();
+    assert!(g2 > g1, "opening a document activates it");
+    let i = s.documents().iter().position(|d| d.doc.id == first).expect("the first document");
+    assert!(s.set_active(i));
+    let g3 = s.active_generation();
+    assert!(g3 > g2, "switching back is a new activation");
+    // Re-selecting the already-active document is not a switch; neither is an edit.
+    assert!(s.set_active(i));
+    assert_eq!(s.active_generation(), g3);
+    s.execute("layer.new.layer", json!({})).unwrap();
+    assert_eq!(s.active_generation(), g3);
+    assert_eq!(s.active().unwrap().doc.id, first);
+}
diff --git a/crates/engine/src/transform_cmds.rs b/crates/engine/src/transform_cmds.rs
index 1df4b1acee..c634441394 100644
--- a/crates/engine/src/transform_cmds.rs
+++ b/crates/engine/src/transform_cmds.rs
@@ -194,6 +194,8 @@ pub fn lone_target<'a>(doc: &'a Document, layer: Option<LayerId>, p: &Value) ->
             let m = l.mask.as_ref().ok_or_else(|| EngineError::Other("layer has no mask".into()))?;
             Ok((!m.linked).then_some(&m.surface))
         }
+        // A filter mask is not transformed on its own: the smart object transforms, as in Photoshop.
+        Target::FilterMask => Ok(None),
         Target::Alpha(i) => doc
             .channels
             .get(i)
diff --git a/crates/engine/src/variables_cmds.rs b/crates/engine/src/variables_cmds.rs
index 67aa1fe4f4..9c89c4756e 100644
--- a/crates/engine/src/variables_cmds.rs
+++ b/crates/engine/src/variables_cmds.rs
@@ -421,7 +421,16 @@ pub fn export_data_sets_with(s: &Session, p: &Value, mut write: impl FnMut(&str,
     }
     // Filename template: `{name}` (sanitised data-set name), `{index}` (1-based). Default `{name}`.
     let template = p.get("naming").and_then(Value::as_str).unwrap_or("{name}");
-    let doc_stem = original.name.rsplit_once('.').map_or(original.name.as_str(), |(a, _)| a).to_string();
+    // A document name is not a path: a separator in it, or a stem of `.` / `..` before a `/` in
+    // the template, must not leave `dir`.
+    let doc_stem: String = original
+        .name
+        .rsplit_once('.')
+        .map_or(original.name.as_str(), |(a, _)| a)
+        .chars()
+        .map(|c| if c.is_control() || "/\\<>:\"|?*".contains(c) { '_' } else { c })
+        .collect();
+    let doc_stem = if matches!(doc_stem.as_str(), "" | "." | "..") { "_".to_string() } else { doc_stem };
     // Plan the whole batch before writing: sanitised names or a constant template may collide.
     // Match the case-insensitive comparison used by the other batch exporters.
     let mut claimed = std::collections::HashMap::new();
@@ -429,7 +438,15 @@ pub fn export_data_sets_with(s: &Session, p: &Value, mut write: impl FnMut(&str,
     for (n, set) in sets.iter().enumerate() {
         let safe: String = set.name.chars().map(|c| if c.is_alphanumeric() || c == '-' || c == '_' { c } else { '_' }).collect();
         let stem = template.replace("{name}", &safe).replace("{index}", &format!("{:03}", n + 1)).replace("{document}", &doc_stem);
-        let name = format!("{stem}.{format}");
+        // Each folder the template makes is checked too: `{document}/{name}` of `nul.psd` would
+        // otherwise write into the `nul` device.
+        let name: String = format!("{stem}.{format}")
+            .split_inclusive(['/', '\\'])
+            .map(|part| {
+                let sep = ["/", "\\"].into_iter().find(|s| part.ends_with(s)).unwrap_or("");
+                crate::file_cmds::portable_device_name(part.strip_suffix(sep).unwrap_or(part).to_string()) + sep
+            })
+            .collect();
         if let Some(first) = claimed.insert(name.to_lowercase(), &set.name) {
             return Err(bad(
                 "file.export.dataSetsAsFiles",
diff --git a/crates/engine/src/variables_cmds/tests.rs b/crates/engine/src/variables_cmds/tests.rs
index 8a0c591e71..ec5b728e71 100644
--- a/crates/engine/src/variables_cmds/tests.rs
+++ b/crates/engine/src/variables_cmds/tests.rs
@@ -421,6 +421,39 @@ fn export_data_sets_rejects_collisions_before_writing() {
     }
 }
 
+#[test]
+fn export_data_sets_keeps_document_derived_names_inside_the_folder() {
+    // A document name is not a path: `{document}` must not climb out of `dir` or into a subfolder,
+    // and a data set named after a Windows device gets the `_` every other exporter gives it.
+    let root = tempfile::tempdir().unwrap();
+    let root = root.path().to_string_lossy().into_owned();
+    let dir = format!("{root}/out");
+    let mut s = visibility_export_session(&["nul", "b"]);
+    s.execute("image.duplicate", json!({"name": "../esc/aped.psd"})).unwrap();
+    let r = s.execute("file.export.dataSetsAsFiles", json!({"dir": dir, "naming": "{document}_{index}"})).unwrap();
+    assert_eq!(r["files"], json!([format!("{dir}/.._esc_aped_001.png"), format!("{dir}/.._esc_aped_002.png")]));
+    let r = s.execute("file.export.dataSetsAsFiles", json!({"dir": dir, "dataSets": ["nul"]})).unwrap();
+    assert_eq!(r["files"], json!([format!("{dir}/nul_.png")]));
+    // `...` has the stem `..`: before a folder in the caller's template it would climb out too.
+    s.execute("image.duplicate", json!({"name": "..."})).unwrap();
+    let r = s.execute("file.export.dataSetsAsFiles", json!({"dir": dir, "dataSets": ["b"], "naming": "{document}/{name}"})).unwrap();
+    assert_eq!(r["files"], json!([format!("{dir}/_/b.png")]));
+    // `.` has an empty stem: `{document}` alone would be a nameless `.png`.
+    s.execute("image.duplicate", json!({"name": "."})).unwrap();
+    let r = s.execute("file.export.dataSetsAsFiles", json!({"dir": dir, "dataSets": ["b"], "naming": "{document}"})).unwrap();
+    assert_eq!(r["files"], json!([format!("{dir}/_.png")]));
+    // A folder the template makes from a device-named document gets the `_` as well.
+    s.execute("image.duplicate", json!({"name": "nul.psd"})).unwrap();
+    let r = s.execute("file.export.dataSetsAsFiles", json!({"dir": dir, "dataSets": ["b"], "naming": "{document}/{name}"})).unwrap();
+    assert_eq!(r["files"], json!([format!("{dir}/nul_/b.png")]));
+    let mut written: Vec<String> = std::fs::read_dir(&dir).unwrap().map(|e| e.unwrap().file_name().to_string_lossy().into_owned()).collect();
+    written.sort();
+    assert_eq!(written, [".._esc_aped_001.png", ".._esc_aped_002.png", "_", "_.png", "nul_", "nul_.png"]);
+    assert!(std::path::Path::new(&format!("{dir}/nul_/b.png")).is_file());
+    assert!(!std::path::Path::new(&format!("{root}/esc")).exists());
+    assert!(!std::path::Path::new(&format!("{root}/b.png")).exists());
+}
+
 #[test]
 fn export_data_sets_unique_paths_preserve_variations_and_document() {
     for (label, names, naming, selected, expected) in [
diff --git a/crates/engine/src/vector_cmds.rs b/crates/engine/src/vector_cmds.rs
index ccfc3a472a..989f312db8 100644
--- a/crates/engine/src/vector_cmds.rs
+++ b/crates/engine/src/vector_cmds.rs
@@ -163,6 +163,11 @@ pub(crate) fn color(v: &Value) -> Option<Color> {
                 _ => None,
             }
         }
+        // A stored `Color` (mode + components), so a CMYK or Lab gradient stop survives a
+        // read-modify-write through the shape swatches.
+        Value::Object(_) => serde_json::from_value::<Color>(v.clone())
+            .ok()
+            .filter(|c| c.c.iter().all(|x| x.is_finite()) && c.alpha.is_finite() && (0.0..=1.0).contains(&c.alpha)),
         _ => None,
     }
 }
@@ -247,15 +252,21 @@ pub fn path_json(p: &Path) -> Value {
 fn fill_json(f: &Fill) -> Value {
     match f {
         Fill::Solid(c) => json!(hex(c)),
-        Fill::Gradient { stops, angle, scale, style, reverse, .. } => json!({ "gradient": {
+        Fill::Gradient { stops, angle, scale, style, reverse, opacity_stops, midpoints, offset, dither, align } => json!({ "gradient": {
             "stops": stops.iter().map(|(t, c)| json!([t, hex(c)])).collect::<Vec<_>>(),
-            "angle": angle, "scale": scale * 100.0, "style": format!("{style:?}").to_ascii_lowercase(), "reverse": reverse } }),
+            "angle": angle, "scale": scale * 100.0, "style": format!("{style:?}").to_ascii_lowercase(), "reverse": reverse,
+            "opacityStops": opacity_stops, "midpoints": midpoints, "offset": [offset.0, offset.1], "dither": dither, "align": align } }),
         Fill::Pattern { name, scale, .. } => json!({ "pattern": name, "scale": scale * 100.0 }),
     }
 }
 
-/// `"#rrggbb"` / `[r,g,b,a]` / `{"gradient":{"stops":[[t,"#hex"],…],"angle","scale","style","reverse"}}` /
-/// `{"pattern":name,"scale"}`. `null` → `Ok(None)` (no fill).
+/// The most colour stops, opacity stops or midpoints a gradient fill takes, as the gradient stop
+/// edits (`gradient.fill.stop`, `gradient.presets.stop`) cap them.
+const MAX_GRADIENT_STOPS: usize = 1024;
+
+/// `"#rrggbb"` / `[r,g,b,a]` / `{"gradient":{"stops":[[t,"#hex"|[r,g,b,a]],…],"angle","scale","style","reverse",
+/// "opacityStops":[[t,0..1],…],"midpoints":[0..1,…],"offset":[x,y],"dither","align"}}` / `{"pattern":name,"scale"}`.
+/// `null` → `Ok(None)` (no fill).
 fn parse_fill(v: &Value) -> std::result::Result<Option<Fill>, String> {
     if v.is_null() {
         return Ok(None);
@@ -264,9 +275,14 @@ fn parse_fill(v: &Value) -> std::result::Result<Option<Fill>, String> {
         return Ok(Some(Fill::Solid(c)));
     }
     if let Some(g) = v.get("gradient") {
-        let stops: Vec<(f32, Color)> = g
-            .get("stops")
-            .and_then(Value::as_array)
+        // Stop lists are capped as `gradient.fill.stop` caps them: more is an error, not a cut.
+        let list = |key: &str, what: &str| match g.get(key) {
+            None | Some(Value::Null) => Ok(None),
+            Some(Value::Array(a)) if a.len() > MAX_GRADIENT_STOPS => Err(format!("too many {what} (max {MAX_GRADIENT_STOPS})")),
+            Some(Value::Array(a)) => Ok(Some(a)),
+            Some(_) => Err(format!("gradient `{key}` must be an array")),
+        };
+        let stops: Vec<(f32, Color)> = list("stops", "colour stops")?
             .map(|a| a.iter().filter_map(|s| Some((s.get(0)?.as_f64()? as f32, color(s.get(1)?)?))).collect())
             .unwrap_or_else(|| vec![(0.0, Color::BLACK), (1.0, Color::WHITE)]);
         let style = match g.get("style").and_then(Value::as_str).unwrap_or("linear") {
@@ -276,13 +292,35 @@ fn parse_fill(v: &Value) -> std::result::Result<Option<Fill>, String> {
             "diamond" => GradientStyle::Diamond,
             _ => GradientStyle::Linear,
         };
-        return Ok(Some(Fill::gradient(
+        let mut fill = Fill::gradient(
             stops,
             f64p(g, "angle").unwrap_or(90.0) as f32,
             f64p(g, "scale").unwrap_or(100.0) as f32 / 100.0,
             style,
             g.get("reverse").and_then(Value::as_bool).unwrap_or(false),
-        )));
+        );
+        // The rest of a gradient, so a read-modify-write (the shape swatches) loses nothing.
+        if let Fill::Gradient { opacity_stops, midpoints, offset, dither, align, .. } = &mut fill {
+            let unit = |v: &Value| v.as_f64().map(|n| n.clamp(0.0, 1.0) as f32);
+            if let Some(a) = list("opacityStops", "opacity stops")? {
+                *opacity_stops = a.iter().filter_map(|s| Some((unit(s.get(0)?)?, unit(s.get(1)?)?))).collect();
+                opacity_stops.sort_by(|a, b| a.0.total_cmp(&b.0));
+            }
+            if let Some(a) = list("midpoints", "midpoints")? {
+                *midpoints = a.iter().filter_map(unit).collect();
+            }
+            if let Some(o) = g.get("offset") {
+                let at = |i: usize| o.get(i).and_then(Value::as_f64).map(|n| n.clamp(-1000.0, 1000.0) as f32);
+                *offset = (at(0).ok_or("gradient offset must be [x, y]")?, at(1).ok_or("gradient offset must be [x, y]")?);
+            }
+            if let Some(d) = g.get("dither").and_then(Value::as_bool) {
+                *dither = d;
+            }
+            if let Some(a) = g.get("align").and_then(Value::as_bool) {
+                *align = a;
+            }
+        }
+        return Ok(Some(fill));
     }
     if let Some(name) = v.get("pattern").and_then(Value::as_str) {
         return Ok(Some(Fill::Pattern {
@@ -1756,7 +1794,7 @@ pub(crate) fn leak(s: String) -> &'static str {
 
 pub fn specs() -> Vec<CommandSpec> {
     let stroke = r##""stroke":{"width":px,"color":"#rrggbb"|fill,"opacity":0..100,"align":"inside|center|outside","cap":"butt|round|square","join":"miter|round|bevel","miterLimit":n,"dashes":[multiples of width],"dashOffset":n}|null"##;
-    let fill = r##""fill":"#rrggbb"|[r,g,b,a]|{"gradient":{"stops":[[t,"#hex"]],"angle":deg,"scale":%,"style":"linear|radial|angle|reflected|diamond","reverse":bool}}|{"pattern":name}|null (no fill)"##;
+    let fill = r##""fill":"#rrggbb"|[r,g,b,a]|{"gradient":{"stops":[[t,"#hex"|[r,g,b,a]|stored Color]],"angle":deg,"scale":%,"style":"linear|radial|angle|reflected|diamond","reverse":bool,"opacityStops":[[t,0..1]]?,"midpoints":[0..1]?,"offset":[x,y]?,"dither":bool?,"align":bool?}}|{"pattern":name}|null (no fill)"##;
     vec![
         spec!(
             "shape.create",
diff --git a/crates/engine/src/vector_cmds/tests.rs b/crates/engine/src/vector_cmds/tests.rs
index a204c8f8fc..0b5b89aae9 100644
--- a/crates/engine/src/vector_cmds/tests.rs
+++ b/crates/engine/src/vector_cmds/tests.rs
@@ -27,15 +27,83 @@ fn stroke_validation_rejects_hostile_values_without_editing_history() {
         json!({"dashOffset": 1e100}),
         json!({"width": "4"}),
         json!({"width": 0.00001, "dashes": [0.01, 0.01]}),
+        json!({"color": {"gradient": {"offset": [0.5]}}}),
+        json!({"color": {"gradient": {"offset": "centre"}}}),
+        // Stop lists past the gradient stop edits' 1024 cap are refused, not cut.
+        json!({"color": {"gradient": {"stops": vec![json!([0.5, "#ff0000"]); 1025]}}}),
+        json!({"color": {"gradient": {"opacityStops": vec![json!([0.5, 1.0]); 1025]}}}),
+        json!({"color": {"gradient": {"midpoints": vec![0.5; 1025]}}}),
+        // A stop list that is not an array is an error, not the default black-to-white.
+        json!({"color": {"gradient": {"stops": "red"}}}),
+        json!({"color": {"gradient": {"opacityStops": {}}}}),
+        json!({"color": {"gradient": {"midpoints": 1}}}),
     ];
     for stroke in invalid {
         assert!(s.execute("shape.edit", json!({"layer": id, "stroke": stroke})).is_err(), "{stroke}");
         assert_eq!(s.active().unwrap().doc, before);
         assert_eq!(s.active().unwrap().history.past_len(), history);
         assert!(s.execute("shape.create", json!({"rect": [20, 20, 50, 30], "stroke": stroke})).is_err(), "{stroke}");
+        assert_eq!(s.active().unwrap().doc, before, "{stroke}: a rejected create adds no layer");
+        assert_eq!(s.active().unwrap().history.past_len(), history, "{stroke}: nor a history state");
     }
     assert!(s.execute("shape.edit", json!({"layer": id, "rect": [1e100, 0, 20, 20]})).is_err());
     assert_eq!(s.active().unwrap().doc, before);
+    // The cap itself is accepted.
+    let at_cap = json!({"color": {"gradient": {"opacityStops": vec![json!([0.5, 1.0]); 1024], "midpoints": vec![0.5; 1024]}}});
+    s.execute("shape.edit", json!({"layer": id, "stroke": at_cap})).unwrap();
+}
+
+/// A gradient stop given as a stored `Color` keeps its colour model: a CMYK stop stays CMYK.
+#[test]
+fn gradient_stops_take_a_stored_color_and_keep_its_model() {
+    let mut s = session(100, 80, 8);
+    let id = s.execute("shape.create", json!({"rect": [20, 20, 50, 30], "stroke": {"width": 6}})).unwrap()["layer"].as_u64().unwrap();
+    let cmyk = Color { mode: photocraft_doc::ColorMode::Cmyk, c: [0.1, 0.2, 0.3, 0.9], alpha: 0.75 };
+    let stops = json!([[0.0, cmyk], [1.0, "#ffffff"]]);
+    s.execute("shape.edit", json!({"layer": id, "stroke": {"color": {"gradient": {"stops": stops}}}})).unwrap();
+    let doc = &s.active().unwrap().doc;
+    let LayerContent::Shape(sh) = &doc.layer(LayerId(id)).unwrap().content else { panic!("a shape layer") };
+    let Fill::Gradient { stops, .. } = &sh.stroke.as_ref().unwrap().paint else { panic!("a gradient stroke") };
+    assert_eq!(stops[0], (0.0, cmyk));
+    assert_eq!(stops[1], (1.0, Color::WHITE), "hex stops still parse as before");
+    // A stored colour that isn't finite or has alpha past 1 is not a colour: the stop is dropped,
+    // as an unparseable hex stop is.
+    let bad = json!({"mode": "Cmyk", "c": [0.1, 0.2, 0.3, 0.9], "alpha": 2.0});
+    s.execute("shape.edit", json!({"layer": id, "stroke": {"color": {"gradient": {"stops": [[0.0, bad], [1.0, "#000000"]]}}}})).unwrap();
+    let doc = &s.active().unwrap().doc;
+    let LayerContent::Shape(sh) = &doc.layer(LayerId(id)).unwrap().content else { panic!("a shape layer") };
+    let Fill::Gradient { stops, .. } = &sh.stroke.as_ref().unwrap().paint else { panic!("a gradient stroke") };
+    assert_eq!(stops.as_slice(), [(1.0, Color::BLACK)]);
+}
+
+/// A gradient stroke keeps every gradient field through `shape.edit`, and `shape.info` reports
+/// them, so the shape swatches can change one setting without dropping the rest.
+#[test]
+fn gradient_stroke_round_trips_every_gradient_field() {
+    let mut s = session(100, 80, 16);
+    let id = s.execute("shape.create", json!({"rect": [20, 20, 50, 30], "stroke": {"width": 6}})).unwrap()["layer"].as_u64().unwrap();
+    let gradient = json!({"gradient": {
+        "stops": [[0.0, [0.25, 0.5, 0.75, 1.0]], [1.0, [1.0, 0.125, 0.0, 0.5]]],
+        "angle": 30.0, "scale": 50.0, "style": "radial", "reverse": true,
+        "opacityStops": [[1.0, 0.25], [0.0, 1.0]], "midpoints": [0.25], "offset": [0.125, -0.25], "dither": true, "align": false,
+    }});
+    let r = s.execute("shape.edit", json!({"layer": id, "stroke": {"color": gradient}})).unwrap();
+    let Some(Fill::Gradient { stops, angle, scale, style, reverse, opacity_stops, midpoints, offset, dither, align }) = shape(&s, id).stroke.map(|st| st.paint)
+    else {
+        panic!("a gradient stroke")
+    };
+    assert_eq!(stops, vec![(0.0, Color::rgba(0.25, 0.5, 0.75, 1.0)), (1.0, Color::rgba(1.0, 0.125, 0.0, 0.5))]);
+    assert_eq!((angle, scale, style, reverse), (30.0, 0.5, GradientStyle::Radial, true));
+    assert_eq!(opacity_stops, vec![(0.0, 1.0), (1.0, 0.25)], "opacity stops are sorted");
+    assert_eq!((midpoints, offset, dither, align), (vec![0.25], (0.125, -0.25), true, false));
+    let g = &r["stroke"]["fill"]["gradient"];
+    assert_eq!((g["style"].as_str(), g["midpoints"].clone(), g["align"].as_bool()), (Some("radial"), json!([0.25]), Some(false)));
+    // A partial gradient keeps the defaults it always had.
+    s.execute("shape.edit", json!({"layer": id, "stroke": {"color": {"gradient": {"stops": [[0, "#000000"], [1, "#ffffff"]]}}}})).unwrap();
+    let Some(Fill::Gradient { opacity_stops, midpoints, offset, dither, align, .. }) = shape(&s, id).stroke.map(|st| st.paint) else {
+        panic!("a gradient stroke")
+    };
+    assert_eq!((opacity_stops, midpoints, offset, dither, align), (Vec::new(), Vec::new(), (0.0, 0.0), false, true));
 }
 
 #[test]
diff --git a/crates/engine/src/vp_cmds.rs b/crates/engine/src/vp_cmds.rs
index 185930298a..eb713d9141 100644
--- a/crates/engine/src/vp_cmds.rs
+++ b/crates/engine/src/vp_cmds.rs
@@ -3,7 +3,7 @@
 //! ([`photocraft_algo::vanishing`]). The edit lands on the active pixel layer, or on a new layer
 //! with `"newLayer": true` (Photoshop's advice for non-destructive Vanishing Point work).
 
-use photocraft_algo::vanishing::{Edge, PlaneCheck, Scene, VpPlane, clone_stroke, paste};
+use photocraft_algo::vanishing::{Edge, PlaneCheck, Scene, VpPlane, clone_dabs, paste};
 use photocraft_doc::{Document, Layer, LayerContent, LayerId};
 use photocraft_geom::Rect;
 use photocraft_raster::Surface;
@@ -13,6 +13,11 @@ use crate::commands::CommandSpec;
 use crate::{EngineError, Result, Session};
 
 pub const VP: &str = "filter.vanishingPoint";
+/// Most planes a scene holds.
+pub const MAX_PLANES: usize = 64;
+/// Most clone strokes, and dabs over all of them, one run paints.
+pub const MAX_CLONE_STROKES: usize = 4096;
+pub const MAX_CLONE_DABS: usize = 200_000;
 
 fn bad(msg: impl Into<String>) -> EngineError {
     EngineError::BadParams { cmd: VP.into(), msg: msg.into() }
@@ -29,6 +34,9 @@ pub fn scene(p: &Value, canvas: Rect) -> Result<Scene> {
         .and_then(Value::as_array)
         .filter(|a| !a.is_empty())
         .ok_or_else(|| bad("pass `planes`: [{\"corners\":[[x,y]×4]}, {\"from\":0,\"edge\":\"top\",\"angle\":90}]"))?;
+    if planes.len() > MAX_PLANES {
+        return Err(bad(format!("at most {MAX_PLANES} planes")));
+    }
     let center = [(canvas.x0 + canvas.x1) as f64 / 2.0, (canvas.y0 + canvas.y1) as f64 / 2.0];
     let corners = |v: &Value| -> Option<[[f64; 2]; 4]> {
         let a = v.get("corners")?.as_array()?;
@@ -67,6 +75,12 @@ pub fn scene(p: &Value, canvas: Rect) -> Result<Scene> {
         };
         let angle = pl.get("angle").and_then(Value::as_f64).unwrap_or(90.0);
         let depth = pl.get("depth").and_then(Value::as_f64).unwrap_or(1.0);
+        if !angle.is_finite() || !(0.0..=360.0).contains(&angle) {
+            return Err(bad(format!("plane {i}: `angle` must be 0..360 degrees")));
+        }
+        if !depth.is_finite() || depth <= 0.0 || depth > 1000.0 {
+            return Err(bad(format!("plane {i}: `depth` must be above 0 and at most 1000")));
+        }
         sc.tear_off(from, edge, angle, depth).ok_or_else(|| bad(format!("plane {i} would lie behind the camera")))?;
     }
     if sc.planes.iter().any(|p| p.homography().is_none()) {
@@ -75,6 +89,88 @@ pub fn scene(p: &Value, canvas: Rect) -> Result<Scene> {
     Ok(sc)
 }
 
+/// One stroke of `"clone"`.
+#[derive(Clone, Debug, PartialEq)]
+pub struct CloneSpec {
+    pub source: [f64; 2],
+    pub points: Vec<[f64; 2]>,
+    pub size: f64,
+    pub hardness: f64,
+    pub opacity: f64,
+}
+
+/// Reads `"clone"`: finite points, at most [`MAX_CLONE_STROKES`] strokes and
+/// [`MAX_CLONE_DABS`] dabs in all.
+pub fn clone_specs(p: &Value) -> Result<Vec<CloneSpec>> {
+    let Some(v) = p.get("clone").filter(|v| !v.is_null()) else { return Ok(Vec::new()) };
+    let strokes = v.as_array().ok_or_else(|| bad("`clone` is a list of strokes"))?;
+    if strokes.len() > MAX_CLONE_STROKES {
+        return Err(bad(format!("at most {MAX_CLONE_STROKES} clone strokes")));
+    }
+    let finite = |q: [f64; 2]| q.iter().all(|v| v.is_finite() && v.abs() < 1e7);
+    let num = |c: &Value, k: &str, default: f64, lo: f64, hi: f64| -> Result<f64> {
+        match c.get(k) {
+            None | Some(Value::Null) => Ok(default),
+            Some(v) => v.as_f64().filter(|x| x.is_finite()).map(|x| x.clamp(lo, hi)).ok_or_else(|| bad(format!("clone `{k}` must be a number"))),
+        }
+    };
+    let mut dabs = 0usize;
+    let mut out = Vec::with_capacity(strokes.len());
+    for (k, c) in strokes.iter().enumerate() {
+        let source = c.get("source").and_then(pt).filter(|q| finite(*q)).ok_or_else(|| bad(format!("clone {k}: `source` [x,y]")))?;
+        let raw = c.get("points").and_then(Value::as_array).ok_or_else(|| bad(format!("clone {k}: `points` [[x,y], …]")))?;
+        dabs = dabs.saturating_add(raw.len());
+        if dabs > MAX_CLONE_DABS {
+            return Err(bad(format!("at most {MAX_CLONE_DABS} clone points in all")));
+        }
+        let points =
+            raw.iter().map(|q| pt(q).filter(|q| finite(*q))).collect::<Option<Vec<_>>>().ok_or_else(|| bad(format!("clone {k}: every point is [x,y]")))?;
+        out.push(CloneSpec {
+            source,
+            points,
+            size: num(c, "size", 40.0, 1.0, 2000.0)?,
+            hardness: num(c, "hardness", 50.0, 0.0, 100.0)? / 100.0,
+            opacity: num(c, "opacity", 100.0, 0.0, 100.0)? / 100.0,
+        });
+    }
+    Ok(out)
+}
+
+/// Paints clone stroke `c` on `surf` inside `canvas`, or, with `work` (the image it samples), on
+/// `work` and copies the pixels it changed to `surf`. Returns the dabs painted.
+pub fn clone_into(sc: &Scene, surf: &mut Surface, work: Option<&mut Surface>, c: &CloneSpec, canvas: Rect) -> usize {
+    let Some(first) = c.points.first() else { return 0 };
+    let Some(work) = work else {
+        return clone_dabs(sc, surf, c.source, *first, &c.points, c.size, c.hardness, c.opacity as f32, Some(canvas)).0;
+    };
+    let before = work.clone();
+    // The dabs are cut to the canvas before they touch `work` or `surf`: points up to 1e7 px off
+    // it would otherwise allocate tiles there (and reading their union back, without bound).
+    let (dabs, area) = clone_dabs(sc, work, c.source, *first, &c.points, c.size, c.hardness, c.opacity as f32, Some(canvas));
+    copy_changed(surf, &before, work, area.intersect(&canvas));
+    dabs
+}
+
+/// Copies to `dst` the pixels of `area` where `after` differs from `before` (same format).
+pub fn copy_changed(dst: &mut Surface, before: &Surface, after: &Surface, area: Rect) {
+    if area.is_empty() {
+        return;
+    }
+    let n = dst.format().channels();
+    let (nw, ow, mut cur) = (after.read_region(area), before.read_region(area), dst.read_region(area));
+    for ((c, a), b) in cur.chunks_exact_mut(n).zip(nw.chunks_exact(n)).zip(ow.chunks_exact(n)) {
+        if a != b {
+            c.copy_from_slice(a);
+        }
+    }
+    dst.write_region(area, &cur);
+}
+
+/// The image a `"newLayer"` run's clone strokes sample: the visible document.
+pub fn visible_image(doc: &Document) -> Surface {
+    crate::file_cmds::flattened(doc, doc.pixel_format())
+}
+
 fn has_layer(s: &Session) -> std::result::Result<(), String> {
     let d = s.active().ok_or("no document open")?;
     match d.active_layer.and_then(|id| d.doc.layer(id)).map(|l| &l.content) {
@@ -84,8 +180,16 @@ fn has_layer(s: &Session) -> std::result::Result<(), String> {
     }
 }
 
+/// Pastes `src` (content in `rect`) onto plane `plane` of `sc` over `surf`, as the command's
+/// `"paste"` does. Returns the area the paste covers.
+pub fn paste_onto(sc: &Scene, surf: &mut Surface, plane: usize, src: &Surface, rect: Rect, at: [f64; 2], width: f64) -> Result<Rect> {
+    let Some(out) = paste(sc, plane, src, rect, at, width)? else { return Ok(Rect::EMPTY) };
+    over(surf, &out);
+    Ok(out.content_bounds())
+}
+
 /// Composites `top` over `dst` (premultiplied source-over), same format.
-fn over(dst: &mut Surface, top: &Surface) {
+pub fn over(dst: &mut Surface, top: &Surface) {
     let b = top.content_bounds();
     if b.is_empty() {
         return;
@@ -134,20 +238,31 @@ fn vanishing_point(s: &mut Session, p: &Value) -> Result<Value> {
         let width = item.get("width").and_then(Value::as_f64).unwrap_or(0.5).clamp(0.01, 10.0);
         pastes.push((plane, surf, rect, at, width));
     }
-    let clones: Vec<Value> = p.get("clone").and_then(Value::as_array).cloned().unwrap_or_default();
+    let clones = clone_specs(p)?;
     let new_layer = p.get("newLayer").and_then(Value::as_bool).unwrap_or(false);
+    // The layer the mode was opened on (the UI passes it: other layers can be picked meanwhile).
+    let layer = crate::commands::explicit_layer(s, p)?;
     let mut dabs = 0usize;
     let target = s.edit("Vanishing Point", |doc: &mut Document, active| {
+        if let Some(l) = layer
+            && doc.layer(l).is_none()
+        {
+            return Err(EngineError::NoLayer(l));
+        }
+        let on = layer.or(*active);
         let id = if new_layer {
             let l = Layer::raster(doc.next_layer_name("Vanishing Point"), doc.pixel_format());
-            let nid = doc.insert_above(*active, l);
+            let nid = doc.insert_above(on, l);
             *active = Some(nid);
             nid
         } else {
-            active.ok_or_else(|| EngineError::Other("no active layer".into()))?
+            // The painted layer becomes active, so Fade and a colour-channel target follow it.
+            let id = on.ok_or_else(|| EngineError::Other("no active layer".into()))?;
+            *active = Some(id);
+            id
         };
         // A new layer clones from the visible image; otherwise from the layer itself.
-        let base: Option<Surface> = new_layer.then(|| crate::file_cmds::flattened(doc, doc.pixel_format()));
+        let base: Option<Surface> = new_layer.then(|| visible_image(doc));
         let locks = doc.effective_locks(id);
         let l = doc.layer_mut(id).ok_or(EngineError::NoLayer(id))?;
         if locks.all || locks.pixels {
@@ -155,40 +270,16 @@ fn vanishing_point(s: &mut Session, p: &Value) -> Result<Value> {
         }
         let surf = l.surface_mut().ok_or_else(|| EngineError::Other("Vanishing Point needs a pixel layer".into()))?;
         for (plane, src, rect, at, width) in &pastes {
-            if let Some(out) = paste(&sc, *plane, src, *rect, *at, *width)? {
-                over(surf, &out);
-            }
+            paste_onto(&sc, surf, *plane, src, *rect, *at, *width)?;
         }
-        for (k, c) in clones.iter().enumerate() {
-            let source = c.get("source").and_then(pt).ok_or_else(|| bad(format!("clone {k}: `source` [x,y]")))?;
-            let points: Vec<[f64; 2]> = c.get("points").and_then(Value::as_array).map(|a| a.iter().filter_map(pt).collect()).unwrap_or_default();
-            let size = c.get("size").and_then(Value::as_f64).unwrap_or(40.0).clamp(1.0, 2000.0);
-            let hardness = c.get("hardness").and_then(Value::as_f64).unwrap_or(50.0).clamp(0.0, 100.0) / 100.0;
-            let opacity = (c.get("opacity").and_then(Value::as_f64).unwrap_or(100.0).clamp(0.0, 100.0) / 100.0) as f32;
-            // Sample from the original pixels (merged with what's been pasted).
-            let mut work = match &base {
-                Some(b) => {
-                    let mut w = b.clone();
-                    over(&mut w, surf);
-                    w
-                }
-                None => surf.clone(),
-            };
-            let before = work.clone();
-            dabs += clone_stroke(&sc, &mut work, source, &points, size, hardness, opacity);
-            // Copy back only what the stroke changed.
-            let b = work.content_bounds().union(&before.content_bounds());
-            if !b.is_empty() {
-                let (nw, ow) = (work.read_region(b), before.read_region(b));
-                let n = surf.format().channels();
-                let mut cur = surf.read_region(b);
-                for i in 0..cur.len() / n {
-                    if nw[i * n..(i + 1) * n] != ow[i * n..(i + 1) * n] {
-                        cur[i * n..(i + 1) * n].copy_from_slice(&nw[i * n..(i + 1) * n]);
-                    }
-                }
-                surf.write_region(b, &cur);
-            }
+        // A new layer samples the visible image (merged with what's been pasted) and takes only
+        // the pixels the strokes change; otherwise the strokes paint the layer itself.
+        let mut work = base.map(|mut w| {
+            over(&mut w, surf);
+            w
+        });
+        for c in &clones {
+            dabs += clone_into(&sc, surf, work.as_mut(), c, canvas);
         }
         surf.prune();
         Ok(id)
@@ -211,7 +302,7 @@ pub fn specs() -> Vec<CommandSpec> {
         label: "Vanishing Point…",
         menu: &["Filter"],
         shortcut: Some("Cmd+Alt+V"),
-        params: r##"{"planes":[{"corners":[[x,y]×4]} | {"from":plane,"edge":"top|right|bottom|left","angle":deg=90,"depth":1}],"focalLength":px=0,"paste":[{"plane":0,"layer":id? (else the clipboard),"at":[u,v]=[0.25,0.25],"width":0..1=0.5}],"clone":[{"source":[x,y],"points":[[x,y]],"size":px=40,"hardness":0..100=50,"opacity":0..100=100}],"newLayer":bool=false}"##,
+        params: r##"{"planes":[{"corners":[[x,y]×4]} | {"from":plane,"edge":"top|right|bottom|left","angle":deg=90,"depth":1}],"focalLength":px=0,"paste":[{"plane":0,"layer":id? (else the clipboard),"at":[u,v]=[0.25,0.25],"width":0..1=0.5}],"clone":[{"source":[x,y],"points":[[x,y]],"size":px=40,"hardness":0..100=50,"opacity":0..100=100}],"newLayer":bool=false,"layer":id|name? (else the active layer)}"##,
         enabled: has_layer,
         run: vanishing_point,
         journal: true,
@@ -282,4 +373,123 @@ mod tests {
         }
         assert!(s.execute(VP, json!({"planes": [{"corners": square}]})).is_ok());
     }
+
+    #[test]
+    fn rejects_hostile_clone_and_tear_off_params() {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 200, "height": 200, "depth": 32})).unwrap();
+        s.execute("layer.new.layer", json!({})).unwrap();
+        let floor = json!({"corners": [[60, 60], [140, 60], [190, 190], [10, 190]]});
+        let before = s.active().unwrap().doc.clone();
+        let steps = s.active().unwrap().history.past_len();
+        for torn in [json!({"from": 0, "angle": 1e9}), json!({"from": 0, "depth": -1}), json!({"from": 0, "depth": 1e300})] {
+            let e = s.execute(VP, json!({"planes": [floor, torn]})).unwrap_err().to_string();
+            assert!(e.contains("plane 1"), "{e}");
+            assert!(std::sync::Arc::ptr_eq(&s.active().unwrap().doc, &before));
+            assert_eq!(s.active().unwrap().history.past_len(), steps);
+        }
+        let many: Vec<[f64; 2]> = vec![[100.0, 150.0]; MAX_CLONE_DABS + 1];
+        for clone in [
+            json!([{"points": [[100, 150]]}]),
+            json!([{"source": [100, 180], "points": [[100, 150], "x"]}]),
+            json!([{"source": [100, 180], "points": [[100, 150]], "size": "big"}]),
+            json!([{"source": [100, 180], "points": many}]),
+            json!({"source": [100, 180]}),
+        ] {
+            let label: String = clone.to_string().chars().take(80).collect();
+            assert!(s.execute(VP, json!({"planes": [floor], "clone": clone, "newLayer": true})).is_err(), "{label}");
+            assert!(std::sync::Arc::ptr_eq(&s.active().unwrap().doc, &before));
+            assert_eq!(s.active().unwrap().history.past_len(), steps);
+        }
+        let planes: Vec<Value> = std::iter::repeat_n(floor.clone(), MAX_PLANES + 1).collect();
+        assert!(s.execute(VP, json!({"planes": planes})).is_err());
+        assert!(std::sync::Arc::ptr_eq(&s.active().unwrap().doc, &before));
+        assert_eq!(s.active().unwrap().history.past_len(), steps);
+        // A clone on a torn-off wall, at 32 bits, sampling the floor.
+        let r = s
+            .execute(VP, json!({"planes": [floor, {"from": 0, "edge": "top", "angle": 90, "depth": 0.5}], "clone": [{"source": [100, 150], "points": [[100, 50], [104, 50]], "size": 8}]}))
+            .unwrap();
+        assert_eq!(r["planes"].as_array().unwrap().len(), 2);
+        assert!(r["dabs"].as_u64().unwrap() >= 1, "{r}");
+    }
+
+    #[test]
+    fn new_layer_clone_stays_on_the_canvas() {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 200, "height": 200})).unwrap();
+        s.execute("layer.new.layer", json!({})).unwrap();
+        s.execute("edit.fill", json!({"color": "#40c040"})).unwrap();
+        // A red stripe where the first dab samples, so cloning it changes pixels.
+        s.edit("stripe", |doc, active| {
+            doc.layer_mut(active.unwrap()).unwrap().surface_mut().unwrap().fill_rect(Rect::new(140, 80, 160, 120), &[1.0, 0.0, 0.0, 1.0]);
+            Ok(())
+        })
+        .unwrap();
+        let planes = json!([{"corners": [[0, 0], [200, 0], [200, 200], [0, 200]]}]);
+        // The second dab lies left of the canvas and samples the canvas 50 px to its right; the
+        // third is far off it (its box joined with the first's once asked for petabytes).
+        for points in [json!([[100, 100], [-30, 100]]), json!([[100, 100], [-30, 100], [9_000_000, 9_000_000]])] {
+            let r = s.execute(VP, json!({"planes": planes, "newLayer": true, "clone": [{"source": [150, 100], "points": points, "size": 20}]})).unwrap();
+            let l = s.active().unwrap().doc.layer(LayerId(r["layer"].as_u64().unwrap())).unwrap().surface().unwrap();
+            let b = l.content_bounds();
+            assert!(!b.is_empty() && Rect::new(0, 0, 200, 200).contains_rect(&b), "{b:?}");
+            assert!(l.rgba(100, 100)[0] > 0.9, "{:?}", l.rgba(100, 100));
+            s.undo();
+        }
+    }
+
+    /// Without a new layer the strokes paint the layer itself, and only inside the canvas, as in
+    /// Photoshop: a dab off it painted pixels there (and allocated tiles for every dab, up to
+    /// 1e7 px away).
+    #[test]
+    fn layer_clone_stays_on_the_canvas() {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 200, "height": 200})).unwrap();
+        s.execute("layer.new.layer", json!({})).unwrap();
+        s.execute("edit.fill", json!({"color": "#40c040"})).unwrap();
+        let id = s.active().unwrap().active_layer.unwrap();
+        let planes = json!([{"corners": [[0, 0], [200, 0], [200, 200], [0, 200]]}]);
+        // The second dab lies left of the canvas and samples the canvas 50 px to its right; the
+        // third is far off it.
+        let points = json!([[100, 100], [-30, 100], [9_000_000, 9_000_000]]);
+        let r = s.execute(VP, json!({"planes": planes, "clone": [{"source": [150, 100], "points": points, "size": 20}]})).unwrap();
+        assert_eq!(r["dabs"].as_u64(), Some(1), "{r}");
+        let b = s.active().unwrap().doc.layer(id).unwrap().surface().unwrap().content_bounds();
+        assert!(Rect::new(0, 0, 200, 200).contains_rect(&b), "{b:?}");
+    }
+
+    #[test]
+    fn layer_param_paints_that_layer_not_the_active_one() {
+        let mut s = Session::new();
+        s.execute("file.new", json!({"width": 200, "height": 200})).unwrap();
+        s.execute("layer.new.layer", json!({"name": "floor"})).unwrap();
+        s.execute("edit.fill", json!({"color": "#40c040"})).unwrap();
+        s.edit("stripe", |doc, active| {
+            doc.layer_mut(active.unwrap()).unwrap().surface_mut().unwrap().fill_rect(Rect::new(140, 80, 160, 120), &[1.0, 0.0, 0.0, 1.0]);
+            Ok(())
+        })
+        .unwrap();
+        let floor = s.active().unwrap().active_layer.unwrap();
+        s.execute("layer.new.layer", json!({"name": "other"})).unwrap();
+        let other = s.active().unwrap().active_layer.unwrap();
+        let planes = json!([{"corners": [[0, 0], [200, 0], [200, 200], [0, 200]]}]);
+        let clone = json!([{"source": [150, 100], "points": [[100, 100]], "size": 20}]);
+        let surf = |s: &Session, id| s.active().unwrap().doc.layer(id).unwrap().surface().unwrap().clone();
+        let r = s.execute(VP, json!({"planes": planes, "clone": clone, "layer": floor.0})).unwrap();
+        assert_eq!(r["layer"].as_u64(), Some(floor.0));
+        assert!(surf(&s, floor).rgba(100, 100)[0] > 0.9, "{:?}", surf(&s, floor).rgba(100, 100));
+        assert!(surf(&s, other).content_bounds().is_empty(), "the active layer stays untouched");
+        s.undo();
+        // A new layer goes right above the named layer.
+        let r = s.execute(VP, json!({"planes": planes, "clone": clone, "layer": floor.0, "newLayer": true})).unwrap();
+        let d = &s.active().unwrap().doc;
+        let ids: Vec<u64> = d.layers.iter().map(|l| l.id.0).collect();
+        let at = |id: u64| ids.iter().position(|&i| i == id).unwrap();
+        assert_eq!(at(r["layer"].as_u64().unwrap()), at(floor.0) + 1, "{ids:?}");
+        s.undo();
+        let before = s.active().unwrap().doc.clone();
+        assert!(s.execute(VP, json!({"planes": planes, "clone": clone, "layer": 999_999})).is_err());
+        assert!(s.execute(VP, json!({"planes": planes, "clone": clone, "layer": 999_999, "newLayer": true})).is_err());
+        assert!(std::sync::Arc::ptr_eq(&s.active().unwrap().doc, &before));
+    }
 }
diff --git a/crates/engine/src/web_cmds.rs b/crates/engine/src/web_cmds.rs
index 3738aa6ca3..121cfe36b8 100644
--- a/crates/engine/src/web_cmds.rs
+++ b/crates/engine/src/web_cmds.rs
@@ -1491,12 +1491,12 @@ pub fn generate_assets(doc: &Document, dir: &str) -> (Vec<String>, Vec<Value>) {
     (files, errors)
 }
 
-/// `<document folder>/<document name>-assets`.
 /// Whether any pixel of `doc` is not fully transparent.
 fn has_pixels(doc: &Document) -> bool {
     photocraft_compose::render(doc, doc.bounds()).px.iter().any(|q| q[3] > 0.0)
 }
 
+/// `<document folder>/<document name>-assets`.
 pub fn assets_dir(doc_path: &str) -> String {
     let p = std::path::Path::new(doc_path);
     let dir = p.parent().map(|d| d.to_string_lossy().into_owned()).unwrap_or_default();
diff --git a/crates/engine/tests/it/crop_content_aware.rs b/crates/engine/tests/it/crop_content_aware.rs
index f41d46a9b5..0cc3dbdeca 100644
--- a/crates/engine/tests/it/crop_content_aware.rs
+++ b/crates/engine/tests/it/crop_content_aware.rs
@@ -157,3 +157,62 @@ fn bad_params_and_unfillable_crops_fail_cleanly() {
         assert_eq!(s.active().unwrap().history.past_len(), past, "{p}");
     }
 }
+
+/// `doc` with its left 16 columns red, then cropped to x = 16 keeping the cropped pixels: the red
+/// lies hidden past the canvas's left edge.
+fn hidden_red(background: &str) -> Session {
+    let mut s = doc("rgb", 8, background);
+    s.execute("tools.setColors", json!({"foreground": "#ff0000", "background": "#000000"})).unwrap();
+    s.execute("select.rect", json!({"x": 0, "y": 0, "width": 16, "height": 48})).unwrap();
+    s.execute("edit.fill", json!({"contents": "foreground"})).unwrap();
+    s.execute("select.deselect", json!({})).unwrap();
+    s.execute("image.crop", json!({"x": 16, "y": 0, "width": 48, "height": 48, "deleteCroppedPixels": false})).unwrap();
+    assert_eq!(size(&s), (48, 48));
+    s
+}
+
+const RED: [f32; 4] = [1.0, 0.0, 0.0, 1.0];
+
+/// A straight frame pulled back out over pixels a Delete Cropped Pixels off crop hid fills over
+/// them from the canvas, as Photoshop does with Delete Cropped Pixels off or on (#8060).
+#[test]
+fn extending_crop_fills_over_the_hidden_pixels() {
+    for background in ["transparent", "white"] {
+        for delete in [false, true] {
+            let mut s = hidden_red(background);
+            let green = layer(&s).rgba(24, 24);
+            crop(&mut s, json!({"x": -24, "y": 0, "width": 72, "height": 48, "deleteCroppedPixels": delete}), true).unwrap();
+            assert_eq!(size(&s), (72, 48));
+            let surf = layer(&s);
+            for y in 0..48 {
+                for x in 0..24 {
+                    let px = surf.rgba(x, y);
+                    assert!(close(px, green, 0.06), "{background} delete {delete}: ({x}, {y}) is filled from the canvas, not the hidden red: {px:?}");
+                }
+                assert!(close(surf.rgba(40, y), green, 1e-6), "{background} delete {delete}: the canvas is unchanged");
+            }
+        }
+    }
+}
+
+/// A turned frame that reaches over the Background's hidden pixels shows them, not a fill
+/// from the canvas (#8060).
+#[test]
+fn rotated_crop_keeps_the_hidden_pixels() {
+    let mut s = hidden_red("white");
+    // A diamond on the canvas's left edge: its left half lies over the hidden red, all of it inside
+    // the turned canvas (so nothing takes the background colour).
+    crop(&mut s, json!({"x": -10, "y": 14, "width": 20, "height": 20, "angle": 45, "deleteCroppedPixels": false}), true).unwrap();
+    assert_eq!(size(&s), (20, 20));
+    let (w, h) = size(&s);
+    let surf = layer(&s);
+    let mut red = 0;
+    for y in 0..h as i32 {
+        for x in 0..w as i32 {
+            let px = surf.rgba(x, y);
+            assert!(px[0] > 0.5 && px[3] > 0.99, "no background colour or transparency at ({x}, {y}): {px:?}");
+            red += usize::from(close(px, RED, 0.06));
+        }
+    }
+    assert!(red >= 100, "the hidden red shows in the turned frame: {red} red pixels");
+}
diff --git a/crates/format/src/autosave.rs b/crates/format/src/autosave.rs
index cb09e27cb8..c5ba725edc 100644
--- a/crates/format/src/autosave.rs
+++ b/crates/format/src/autosave.rs
@@ -9,6 +9,7 @@
 //! [`RecoveryStore`] is the app-facing lifecycle: an entry is only deleted once
 //! the document is saved or closed, never just because it was recovered.
 
+use std::collections::BTreeSet;
 #[cfg(not(target_arch = "wasm32"))]
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
@@ -247,41 +248,51 @@ fn read_sidecar_bounded(path: &Path, max: usize) -> Option<Vec<u8>> {
 
 /// Recoverable documents in `recovery_dir`, newest first. A sidecar must be named after its own
 /// (sanitized) key, so a stray or hand-edited one can never point outside the directory.
+///
+/// Each key is looked at once, after the directory has been read: an autosave may publish a
+/// document's first sidecar while the listing runs, and judging the bundle and the sidecar as
+/// each name came up listed that bundle twice, or not at all.
 pub fn list_recovery(recovery_dir: &Path) -> Vec<RecoveryEntry> {
-    let mut out = Vec::new();
     let Ok(rd) = std::fs::read_dir(recovery_dir) else {
-        return out;
+        return Vec::new();
     };
-    for e in rd.flatten() {
-        let p = e.path();
-        if e.file_type().is_ok_and(|ft| ft.is_file())
-            && p.extension().is_some_and(|x| x == "json")
-            && let Some(bytes) = read_sidecar_bounded(&p, 1 << 20)
-            && let Ok(info) = serde_json::from_slice::<RecoveryInfo>(&bytes)
-            && sanitize(&info.key) == info.key
-            && p.file_stem().is_some_and(|stem| *stem == *info.key)
-        {
-            let bundle = recovery_dir.join(format!("{}.pcraft", info.key));
-            if bundle.join(crate::store::MANIFEST).is_file() {
-                out.push(RecoveryEntry { info, bundle });
-            }
-        } else if e.file_type().is_ok_and(|ft| ft.is_dir())
-            && let Some(entry) = sidecarless_entry(recovery_dir, &p)
-        {
-            out.push(entry);
-        }
-    }
+    let keys: BTreeSet<String> = rd
+        .flatten()
+        .filter_map(|e| {
+            let name = e.file_name().into_string().ok()?;
+            name.strip_suffix(".json").or_else(|| name.strip_suffix(".pcraft")).map(str::to_string)
+        })
+        .collect();
+    let mut out: Vec<RecoveryEntry> = keys.iter().filter_map(|key| recovery_entry(recovery_dir, key)).collect();
     out.sort_by(|a, b| b.info.saved_at.cmp(&a.info.saved_at).then(a.info.key.cmp(&b.info.key)));
     out
 }
 
+/// `key`'s entry. The sidecar is tried again last: it can appear after the first look, once the
+/// bundle it describes is committed, and is never removed by a save.
+fn recovery_entry(recovery_dir: &Path, key: &str) -> Option<RecoveryEntry> {
+    let bundle = recovery_dir.join(format!("{key}.pcraft"));
+    sidecar_entry(recovery_dir, key, &bundle).or_else(|| sidecarless_entry(recovery_dir, &bundle)).or_else(|| sidecar_entry(recovery_dir, key, &bundle))
+}
+
+fn sidecar_entry(recovery_dir: &Path, key: &str, bundle: &Path) -> Option<RecoveryEntry> {
+    let bytes = read_sidecar_bounded(&recovery_dir.join(format!("{key}.json")), 1 << 20)?;
+    let info = serde_json::from_slice::<RecoveryInfo>(&bytes).ok()?;
+    (sanitize(&info.key) == info.key && info.key == key && bundle.join(crate::store::MANIFEST).is_file())
+        .then(|| RecoveryEntry { info, bundle: bundle.to_path_buf() })
+}
+
 /// A committed `<key>.pcraft` bundle (its manifest is written last) whose sidecar was never
 /// published, e.g. a crash during a document's first autosave. The metadata is rebuilt from the
 /// manifest (read like a load reads it) and its modification time. Incomplete bundles (no
 /// readable manifest) and bundles with anything at the sidecar's path are not entries.
 fn sidecarless_entry(recovery_dir: &Path, bundle: &Path) -> Option<RecoveryEntry> {
     let key = bundle.file_name()?.to_str()?.strip_suffix(".pcraft")?;
-    if key.is_empty() || sanitize(key) != key || std::fs::symlink_metadata(recovery_dir.join(format!("{key}.json"))).is_ok() {
+    if !std::fs::symlink_metadata(bundle).is_ok_and(|m| m.is_dir())
+        || key.is_empty()
+        || sanitize(key) != key
+        || std::fs::symlink_metadata(recovery_dir.join(format!("{key}.json"))).is_ok()
+    {
         return None;
     }
     let meta = std::fs::symlink_metadata(bundle.join(crate::store::MANIFEST)).ok().filter(|m| m.is_file())?;
diff --git a/crates/format/src/store.rs b/crates/format/src/store.rs
index 84124407e4..fb73819e32 100644
--- a/crates/format/src/store.rs
+++ b/crates/format/src/store.rs
@@ -126,10 +126,17 @@ pub fn read_entry(file: &mut impl std::io::Read, len: u64, max: usize, path: &st
 /// The saver checks the same bound, so every bundle it writes loads again.
 const MAX_MANIFEST_DEPTH: usize = 3 * (convert::MAX_GROUP_DEPTH + 1) + 64;
 
-/// Rejects JSON nested deeper than [`MAX_MANIFEST_DEPTH`] with a linear scan (no recursion), so
-/// parsing with serde_json's recursion limit disabled can't exhaust the stack on hostile input.
+/// Most JSON items (arrays and objects opened, plus elements and members after a comma) a
+/// manifest may hold. Parsing builds a `serde_json::Value` tree of tens of bytes per item, so
+/// `[0,0,…]` costs about 16× its size in memory; a typical manifest spends 20 bytes or more per
+/// item, so this still admits manifests of about 80 MiB.
+const MAX_MANIFEST_ITEMS: usize = 4 << 20;
+
+/// Rejects JSON nested deeper than [`MAX_MANIFEST_DEPTH`] or holding more than
+/// [`MAX_MANIFEST_ITEMS`] items with a linear scan (no recursion), so parsing with serde_json's
+/// recursion limit disabled can't exhaust the stack, nor tiny values the memory, on hostile input.
 fn check_manifest_depth(json: &[u8]) -> Result<()> {
-    let (mut depth, mut in_str, mut escaped) = (0usize, false, false);
+    let (mut depth, mut items, mut in_str, mut escaped) = (0usize, 0usize, false, false);
     for &b in json {
         if in_str {
             match b {
@@ -151,6 +158,12 @@ fn check_manifest_depth(json: &[u8]) -> Result<()> {
             b']' | b'}' => depth = depth.saturating_sub(1),
             _ => {}
         }
+        if matches!(b, b'[' | b'{' | b',') {
+            items += 1;
+            if items > MAX_MANIFEST_ITEMS {
+                return Err(FormatError::LimitExceeded(format!("manifest JSON holds more than {MAX_MANIFEST_ITEMS} values")));
+            }
+        }
     }
     Ok(())
 }
diff --git a/crates/format/src/store/durability_tests.rs b/crates/format/src/store/durability_tests.rs
index 5f60db2948..477c476a99 100644
--- a/crates/format/src/store/durability_tests.rs
+++ b/crates/format/src/store/durability_tests.rs
@@ -1,10 +1,14 @@
 //! Exercise the real directory save, including cached-object reuse and garbage collection.
-use super::*;
-use crate::atomic::{AtomicFs, RealFs};
-use photocraft_color::{ColorMode, SampleType};
-use photocraft_doc::{Layer, Size};
 use std::cell::{Cell, RefCell};
 use std::io;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use photocraft_color::{ColorMode, SampleType};
+use photocraft_doc::{Document, Layer, Size};
+
+use super::{MANIFEST, PcraftWriter, SaveOptions, list_objects};
+use crate::atomic::{AtomicFs, RealFs};
 
 /// The object or manifest directory barrier at which to inject one publication failure.
 #[derive(Clone, Copy, Debug)]
diff --git a/crates/format/tests/it/corruption.rs b/crates/format/tests/it/corruption.rs
index fd2d0602f6..1a69a60055 100644
--- a/crates/format/tests/it/corruption.rs
+++ b/crates/format/tests/it/corruption.rs
@@ -128,6 +128,24 @@ fn over_deep_manifest_fails_cleanly() {
     assert!(matches!(e, FormatError::Corrupt(_)), "{e}");
 }
 
+/// A manifest of millions of tiny values (`[0,0,…]` deflates about 1000:1) is refused before
+/// it is parsed into a JSON tree, which would cost about 16 bytes of memory per input byte.
+#[test]
+fn manifest_with_too_many_values_is_refused() {
+    let n = (4 << 20) + 16;
+    let mut m = Vec::with_capacity(2 * n + 1);
+    m.push(b'[');
+    for i in 0..n {
+        m.extend_from_slice(if i == 0 { b"0" } else { b",0" });
+    }
+    m.push(b']');
+    let b = rebuild(&sample(), |name, d| Some(if name == "manifest.json" { m.clone() } else { d }));
+    let e = load_from_bytes(&b).unwrap_err();
+    assert!(matches!(e, FormatError::LimitExceeded(_)), "{e}");
+    let e = read_manifest(&b).unwrap_err();
+    assert!(matches!(e, FormatError::LimitExceeded(_)), "{e}");
+}
+
 #[test]
 fn too_new_version_rejected() {
     let b = rebuild(&sample(), |n, d| {
diff --git a/crates/gpu/Cargo.toml b/crates/gpu/Cargo.toml
index 81b51f4c35..e33ec9c01a 100644
--- a/crates/gpu/Cargo.toml
+++ b/crates/gpu/Cargo.toml
@@ -14,6 +14,9 @@ photocraft-color = { workspace = true }
 photocraft-raster = { workspace = true }
 photocraft-doc = { workspace = true }
 photocraft-compose = { workspace = true }
+# Camera Raw's per-pixel stages (`camera_raw.rs`) take their constants from the CPU develop.
+photocraft-algo = { workspace = true }
+bytemuck = { workspace = true }
 # Same major version as eframe's wgpu so the app's device can be shared.
 wgpu = { version = "30", default-features = false, features = ["std", "wgsl"] }
 log = { workspace = true }
diff --git a/crates/gpu/examples/bench_camera_raw.rs b/crates/gpu/examples/bench_camera_raw.rs
new file mode 100644
index 0000000000..be206fe382
--- /dev/null
+++ b/crates/gpu/examples/bench_camera_raw.rs
@@ -0,0 +1,116 @@
+//! Camera Raw's preview develop on the 858×572 proxy of a 6000×4000 image: the CPU develop
+//! against the GPU pass (upload, render, readback), for per-pixel settings.
+//! `cargo run --release -p photocraft-gpu --example bench_camera_raw [-- --quick]`
+use std::time::Instant;
+
+use photocraft_algo::camera_raw::{CameraRaw, Wheel, develop, per_pixel, white_black_points};
+use photocraft_gpu::CameraRawDevelop;
+
+fn median(mut v: Vec<f64>) -> f64 {
+    v.sort_by(f64::total_cmp);
+    v[v.len() / 2]
+}
+
+fn time(runs: usize, mut f: impl FnMut()) -> f64 {
+    f();
+    median(
+        (0..runs)
+            .map(|_| {
+                let t = Instant::now();
+                f();
+                t.elapsed().as_secs_f64() * 1e3
+            })
+            .collect(),
+    )
+}
+
+/// [`time`] for a call that can fail: its first error ends the benchmark instead of being timed.
+fn try_time<E>(runs: usize, mut f: impl FnMut() -> Result<(), E>) -> Result<f64, E> {
+    let mut failed = None;
+    let ms = time(runs, || {
+        if failed.is_none() {
+            failed = f().err();
+        }
+    });
+    failed.map_or(Ok(ms), Err)
+}
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let runs = if std::env::args().any(|a| a == "--quick") { 5 } else { 40 };
+    let (w, h) = (858usize, 572usize);
+    let instance = wgpu::Instance::new(wgpu::InstanceDescriptor::new_without_display_handle_from_env());
+    let options = wgpu::RequestAdapterOptions { power_preference: wgpu::PowerPreference::HighPerformance, ..Default::default() };
+    let adapter = pollster::block_on(instance.request_adapter(&options))?;
+    let (device, queue) = pollster::block_on(adapter.request_device(&Default::default()))?;
+    let info = adapter.get_info();
+    println!("adapter: {} ({:?}), proxy {w}x{h}, median of {runs}", info.name, info.backend);
+    let built = Instant::now();
+    let mut pass = CameraRawDevelop::new(&device)?;
+    println!("pipeline build: {:.1} ms", built.elapsed().as_secs_f64() * 1e3);
+    let src: Vec<[f32; 4]> = (0..w * h)
+        .map(|i| {
+            let (x, y) = ((i % w) as f32 / w as f32, (i / w) as f32 / h as f32);
+            [0.1 + 0.8 * x, 0.2 + 0.6 * y, 0.6 - 0.5 * x * y, 1.0]
+        })
+        .collect();
+    let scale = w as f32 / 6000.0;
+    let mut hsl = [0.0; 8];
+    hsl[1] = 30.0;
+    hsl[5] = -40.0;
+    let sets = [
+        (
+            "Basic (WB, Exposure, Contrast, Whites, Blacks)",
+            CameraRaw { temperature: 20.0, exposure: 0.4, contrast: 25.0, whites: 30.0, blacks: -20.0, pixel_scale: scale, ..Default::default() },
+        ),
+        (
+            "every per-pixel stage",
+            CameraRaw {
+                temperature: 20.0,
+                tint: 5.0,
+                exposure: 0.4,
+                contrast: 25.0,
+                whites: 30.0,
+                blacks: -20.0,
+                vibrance: 30.0,
+                saturation: 10.0,
+                curve_lights: 20.0,
+                point_curve: vec![[0.0, 8.0], [128.0, 140.0], [255.0, 250.0]],
+                hsl_hue: hsl,
+                hsl_sat: hsl,
+                hsl_lum: hsl,
+                grade_shadows: Wheel { hue: 210.0, sat: 30.0, lum: 0.0 },
+                grade_highlights: Wheel { hue: 40.0, sat: 20.0, lum: 5.0 },
+                vignette_amount: -30.0,
+                grain_amount: 25.0,
+                pixel_scale: scale,
+                ..Default::default()
+            },
+        ),
+    ];
+    for (name, p) in &sets {
+        let cpu = time(runs, || {
+            let mut px = src.clone();
+            develop(&mut px, w, h, p, false);
+        });
+        let points_ms = time(runs, || {
+            std::hint::black_box(white_black_points(&src, w, h, p));
+        });
+        let points = white_black_points(&src, w, h, p);
+        let stages = per_pixel(p, w, h, false, points).ok_or("not per pixel")?;
+        let size = [w as u32, h as u32];
+        let upload = try_time(runs, || pass.develop(&device, &queue, None, &src, None, size, &stages).map(drop))?;
+        let cached = try_time(runs, || pass.develop(&device, &queue, None, &src, Some(1), size, &stages).map(drop))?;
+        println!("{name}:");
+        println!("  CPU develop                          {cpu:7.2} ms");
+        println!("  GPU, source uploaded every time      {upload:7.2} ms");
+        println!("  GPU, source cached (slider drag)     {cached:7.2} ms");
+        println!("  Whites/Blacks points on the CPU      {points_ms:7.2} ms (cached per WB/Exposure/Contrast in the dialog)");
+    }
+    let shadows = CameraRaw { shadows: 50.0, pixel_scale: scale, ..Default::default() };
+    let cpu = time(runs.min(10), || {
+        let mut px = src.clone();
+        develop(&mut px, w, h, &shadows, false);
+    });
+    println!("for reference, Shadows +50 (CPU only): {cpu:.2} ms");
+    Ok(())
+}
diff --git a/crates/gpu/src/camera_raw.rs b/crates/gpu/src/camera_raw.rs
new file mode 100644
index 0000000000..3f1833a54b
--- /dev/null
+++ b/crates/gpu/src/camera_raw.rs
@@ -0,0 +1,418 @@
+//! Camera Raw's per-pixel develop on the GPU, for the dialog's interactive preview (#6916).
+//!
+//! One fragment pass (`camera_raw.wgsl`) runs the stages that read only their own pixel: white
+//! balance and exposure, Contrast without Texture or Clarity, Whites and Blacks, Vibrance and
+//! Saturation, the tone curves, the Color Mixer, Color Grading, the vignette and grain. Their
+//! constants and tables come from [`photocraft_algo::camera_raw::per_pixel`], which the CPU
+//! develop builds its own from, so both evaluate the same maths; the curves and the Whites and
+//! Blacks rows are rows of one `R32Float` texture. Settings with a spatial stage (Dehaze, Shadows
+//! and Highlights, Texture, Clarity, Detail) have no [`PerPixel`] and stay on the CPU.
+//!
+//! The pipeline is built on demand ([`CameraRawDevelop::new`]), not with the compositor (#6419).
+//! It renders into `Rgba32Float`; [`CameraRawDevelop::supported`] says whether the adapter can.
+
+use photocraft_algo::camera_raw::{CURVE_LUT, PerPixel, VignetteStyle, WB_STEPS};
+
+use crate::Unsupported;
+
+/// The pass's WGSL source.
+pub const CAMERA_RAW_SHADER: &str = include_str!("camera_raw.wgsl");
+
+const FORMAT: wgpu::TextureFormat = wgpu::TextureFormat::Rgba32Float;
+/// `Params` in the shader: 19 rows of 16 bytes.
+const PARAMS_SIZE: u64 = 19 * 16;
+/// Rows of the table texture: parametric, master, red, green, blue curves; Whites, Blacks.
+const LUT_ROWS: u32 = 7;
+const LUT_WIDTH: u32 = CURVE_LUT as u32;
+const BYTES_PER_PIXEL: u32 = 16;
+
+struct Image {
+    key: Option<u64>,
+    size: [u32; 2],
+    texture: wgpu::Texture,
+    view: wgpu::TextureView,
+}
+
+impl Image {
+    fn new(device: &wgpu::Device, label: &str, size: [u32; 2], usage: wgpu::TextureUsages) -> Self {
+        let texture = device.create_texture(&wgpu::TextureDescriptor {
+            label: Some(label),
+            size: wgpu::Extent3d { width: size[0], height: size[1], depth_or_array_layers: 1 },
+            mip_level_count: 1,
+            sample_count: 1,
+            dimension: wgpu::TextureDimension::D2,
+            format: FORMAT,
+            usage,
+            view_formats: &[],
+        });
+        let view = texture.create_view(&Default::default());
+        Image { key: None, size, texture, view }
+    }
+}
+
+/// The Camera Raw preview pass and its textures (reused while the size stays).
+pub struct CameraRawDevelop {
+    pipeline: wgpu::RenderPipeline,
+    layout: wgpu::BindGroupLayout,
+    params: wgpu::Buffer,
+    luts: wgpu::Texture,
+    luts_view: wgpu::TextureView,
+    source: Option<Image>,
+    target: Option<Image>,
+    #[cfg(not(target_arch = "wasm32"))]
+    readback: Option<wgpu::Buffer>,
+}
+
+impl CameraRawDevelop {
+    /// Whether `adapter` can render the pass's `Rgba32Float` output.
+    pub fn supported(adapter: &wgpu::Adapter) -> bool {
+        adapter.get_texture_format_features(FORMAT).allowed_usages.contains(wgpu::TextureUsages::RENDER_ATTACHMENT)
+    }
+
+    /// Builds the pipeline. A shader or pipeline the driver can't build is an `Err`, so the
+    /// caller keeps the CPU develop (where errors only arrive asynchronously, on WebGPU, creation
+    /// is assumed to have worked).
+    pub fn new(device: &wgpu::Device) -> Result<Self, Unsupported> {
+        match crate::first_error(device, || Self::build(device)) {
+            (dev, None) => Ok(dev),
+            (_, Some(e)) => Err(Unsupported(format!("couldn't build the Camera Raw pipeline: {e}"))),
+        }
+    }
+
+    fn build(device: &wgpu::Device) -> Self {
+        let module = device
+            .create_shader_module(wgpu::ShaderModuleDescriptor { label: Some("pc_camera_raw"), source: wgpu::ShaderSource::Wgsl(CAMERA_RAW_SHADER.into()) });
+        let layout = device.create_bind_group_layout(&wgpu::BindGroupLayoutDescriptor {
+            label: Some("pc_camera_raw"),
+            entries: &[
+                wgpu::BindGroupLayoutEntry {
+                    binding: 0,
+                    visibility: wgpu::ShaderStages::FRAGMENT,
+                    ty: wgpu::BindingType::Buffer {
+                        ty: wgpu::BufferBindingType::Uniform,
+                        has_dynamic_offset: false,
+                        min_binding_size: wgpu::BufferSize::new(PARAMS_SIZE),
+                    },
+                    count: None,
+                },
+                crate::tex_entry(1),
+                crate::tex_entry(2),
+            ],
+        });
+        let pipeline_layout = device.create_pipeline_layout(&wgpu::PipelineLayoutDescriptor {
+            label: Some("pc_camera_raw"),
+            bind_group_layouts: &[Some(&layout)],
+            immediate_size: 0,
+        });
+        let pipeline = device.create_render_pipeline(&wgpu::RenderPipelineDescriptor {
+            label: Some("pc_camera_raw"),
+            layout: Some(&pipeline_layout),
+            vertex: wgpu::VertexState { module: &module, entry_point: Some("vs"), buffers: &[], compilation_options: Default::default() },
+            primitive: wgpu::PrimitiveState::default(),
+            depth_stencil: None,
+            multisample: wgpu::MultisampleState::default(),
+            fragment: Some(wgpu::FragmentState {
+                module: &module,
+                entry_point: Some("fs"),
+                targets: &[Some(wgpu::ColorTargetState { format: FORMAT, blend: None, write_mask: wgpu::ColorWrites::ALL })],
+                compilation_options: Default::default(),
+            }),
+            multiview_mask: None,
+            cache: None,
+        });
+        let params = device.create_buffer(&wgpu::BufferDescriptor {
+            label: Some("pc_camera_raw_params"),
+            size: PARAMS_SIZE,
+            usage: wgpu::BufferUsages::UNIFORM | wgpu::BufferUsages::COPY_DST,
+            mapped_at_creation: false,
+        });
+        let luts = device.create_texture(&wgpu::TextureDescriptor {
+            label: Some("pc_camera_raw_luts"),
+            size: wgpu::Extent3d { width: LUT_WIDTH, height: LUT_ROWS, depth_or_array_layers: 1 },
+            mip_level_count: 1,
+            sample_count: 1,
+            dimension: wgpu::TextureDimension::D2,
+            format: wgpu::TextureFormat::R32Float,
+            usage: wgpu::TextureUsages::TEXTURE_BINDING | wgpu::TextureUsages::COPY_DST,
+            view_formats: &[],
+        });
+        let luts_view = luts.create_view(&Default::default());
+        CameraRawDevelop {
+            pipeline,
+            layout,
+            params,
+            luts,
+            luts_view,
+            source: None,
+            target: None,
+            #[cfg(not(target_arch = "wasm32"))]
+            readback: None,
+        }
+    }
+
+    /// Records the develop of `source` (`w × h` straight RGBA, display-encoded) with `stages`
+    /// into `encoder` and returns the `Rgba32Float` texture it renders. The source is uploaded
+    /// unless the last one had the same `key` and size (`None` always uploads).
+    #[allow(clippy::too_many_arguments)]
+    pub fn encode(
+        &mut self,
+        device: &wgpu::Device,
+        queue: &wgpu::Queue,
+        encoder: &mut wgpu::CommandEncoder,
+        source: &[[f32; 4]],
+        key: Option<u64>,
+        size: [u32; 2],
+        stages: &PerPixel,
+    ) -> Result<&wgpu::Texture, Unsupported> {
+        check_size(device, source, size)?;
+        let [w, h] = size;
+        let usage = wgpu::TextureUsages::TEXTURE_BINDING | wgpu::TextureUsages::COPY_DST;
+        let src = match self.source.take() {
+            Some(s) if s.size == size => s,
+            _ => Image::new(device, "pc_camera_raw_source", size, usage),
+        };
+        let src = self.source.insert(src);
+        if key.is_none() || src.key != key {
+            queue.write_texture(
+                wgpu::TexelCopyTextureInfo { texture: &src.texture, mip_level: 0, origin: wgpu::Origin3d::ZERO, aspect: wgpu::TextureAspect::All },
+                bytemuck::cast_slice(source),
+                wgpu::TexelCopyBufferLayout { offset: 0, bytes_per_row: Some(w * BYTES_PER_PIXEL), rows_per_image: Some(h) },
+                wgpu::Extent3d { width: w, height: h, depth_or_array_layers: 1 },
+            );
+            src.key = key;
+        }
+        queue.write_buffer(&self.params, 0, &params(size, stages));
+        queue.write_texture(
+            wgpu::TexelCopyTextureInfo { texture: &self.luts, mip_level: 0, origin: wgpu::Origin3d::ZERO, aspect: wgpu::TextureAspect::All },
+            bytemuck::cast_slice(&tables(stages)),
+            wgpu::TexelCopyBufferLayout { offset: 0, bytes_per_row: Some(LUT_WIDTH * 4), rows_per_image: Some(LUT_ROWS) },
+            wgpu::Extent3d { width: LUT_WIDTH, height: LUT_ROWS, depth_or_array_layers: 1 },
+        );
+        let target = match self.target.take() {
+            Some(t) if t.size == size => t,
+            _ => Image::new(device, "pc_camera_raw_target", size, wgpu::TextureUsages::RENDER_ATTACHMENT | wgpu::TextureUsages::COPY_SRC),
+        };
+        let target = self.target.insert(target);
+        let group = device.create_bind_group(&wgpu::BindGroupDescriptor {
+            label: Some("pc_camera_raw"),
+            layout: &self.layout,
+            entries: &[
+                wgpu::BindGroupEntry { binding: 0, resource: self.params.as_entire_binding() },
+                wgpu::BindGroupEntry { binding: 1, resource: wgpu::BindingResource::TextureView(&src.view) },
+                wgpu::BindGroupEntry { binding: 2, resource: wgpu::BindingResource::TextureView(&self.luts_view) },
+            ],
+        });
+        {
+            let mut pass = encoder.begin_render_pass(&wgpu::RenderPassDescriptor {
+                label: Some("pc_camera_raw"),
+                color_attachments: &[Some(wgpu::RenderPassColorAttachment {
+                    view: &target.view,
+                    depth_slice: None,
+                    resolve_target: None,
+                    ops: wgpu::Operations { load: wgpu::LoadOp::Clear(wgpu::Color::TRANSPARENT), store: wgpu::StoreOp::Store },
+                })],
+                depth_stencil_attachment: None,
+                timestamp_writes: None,
+                occlusion_query_set: None,
+                multiview_mask: None,
+            });
+            pass.set_pipeline(&self.pipeline);
+            pass.set_bind_group(0, &group, &[]);
+            pass.draw(0..3, 0..1);
+        }
+        Ok(&target.texture)
+    }
+
+    /// Develops `source` and reads the result back (blocking; native only, the web has no
+    /// blocking wait). GPU errors and a lost device are `Err`; `health`, when the device is
+    /// watched, records a loss.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[allow(clippy::too_many_arguments)]
+    pub fn develop(
+        &mut self,
+        device: &wgpu::Device,
+        queue: &wgpu::Queue,
+        health: Option<&crate::DeviceHealth>,
+        source: &[[f32; 4]],
+        key: Option<u64>,
+        size: [u32; 2],
+        stages: &PerPixel,
+    ) -> Result<Vec<[f32; 4]>, Unsupported> {
+        if let Some(f) = health.and_then(crate::DeviceHealth::fault) {
+            return Err(Unsupported(f.to_string()));
+        }
+        let (result, error) = crate::first_error(device, || self.develop_inner(device, queue, health, source, key, size, stages));
+        match error {
+            Some(e) => {
+                // A half-done upload must not be taken for the cached source next time.
+                self.source = None;
+                Err(Unsupported(format!("GPU Camera Raw develop failed: {e}")))
+            }
+            None => result,
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[allow(clippy::too_many_arguments)]
+    fn develop_inner(
+        &mut self,
+        device: &wgpu::Device,
+        queue: &wgpu::Queue,
+        health: Option<&crate::DeviceHealth>,
+        source: &[[f32; 4]],
+        key: Option<u64>,
+        size: [u32; 2],
+        stages: &PerPixel,
+    ) -> Result<Vec<[f32; 4]>, Unsupported> {
+        check_size(device, source, size)?;
+        let [w, h] = size;
+        let row = (w * BYTES_PER_PIXEL).div_ceil(wgpu::COPY_BYTES_PER_ROW_ALIGNMENT) * wgpu::COPY_BYTES_PER_ROW_ALIGNMENT;
+        let bytes = u64::from(row) * u64::from(h);
+        let mut encoder = device.create_command_encoder(&wgpu::CommandEncoderDescriptor { label: Some("pc_camera_raw") });
+        self.encode(device, queue, &mut encoder, source, key, size, stages)?;
+        let Some(target) = self.target.as_ref().map(|t| &t.texture) else { return Err(Unsupported("no Camera Raw target".into())) };
+        let buffer = match self.readback.take() {
+            Some(b) if b.size() == bytes => b,
+            _ => device.create_buffer(&wgpu::BufferDescriptor {
+                label: Some("pc_camera_raw_readback"),
+                size: bytes,
+                usage: wgpu::BufferUsages::COPY_DST | wgpu::BufferUsages::MAP_READ,
+                mapped_at_creation: false,
+            }),
+        };
+        encoder.copy_texture_to_buffer(
+            wgpu::TexelCopyTextureInfo { texture: target, mip_level: 0, origin: wgpu::Origin3d::ZERO, aspect: wgpu::TextureAspect::All },
+            wgpu::TexelCopyBufferInfo { buffer: &buffer, layout: wgpu::TexelCopyBufferLayout { offset: 0, bytes_per_row: Some(row), rows_per_image: Some(h) } },
+            wgpu::Extent3d { width: w, height: h, depth_or_array_layers: 1 },
+        );
+        let index = queue.submit([encoder.finish()]);
+        buffer.slice(..).map_async(wgpu::MapMode::Read, |_| {});
+        match health {
+            Some(hl) => {
+                if !hl.wait(device, Some(index)) {
+                    return Err(Unsupported(hl.fault().map_or_else(|| "GPU device lost".into(), |f| f.to_string())));
+                }
+            }
+            None => {
+                device.poll(wgpu::PollType::Wait { submission_index: Some(index), timeout: None }).map_err(|e| Unsupported(format!("GPU wait failed: {e}")))?;
+            }
+        }
+        let mut out = Vec::with_capacity(source.len());
+        {
+            let data = buffer.slice(..).get_mapped_range().map_err(|e| Unsupported(format!("GPU readback failed: {e:?}")))?;
+            let width = w as usize * BYTES_PER_PIXEL as usize;
+            for y in 0..h as usize {
+                let start = y * row as usize;
+                let line = data.get(start..start + width).ok_or_else(|| Unsupported("short GPU readback".into()))?;
+                out.extend(bytemuck::pod_collect_to_vec::<u8, [f32; 4]>(line));
+            }
+        }
+        buffer.unmap();
+        self.readback = Some(buffer);
+        Ok(out)
+    }
+}
+
+fn check_size(device: &wgpu::Device, source: &[[f32; 4]], [w, h]: [u32; 2]) -> Result<(), Unsupported> {
+    let max = device.limits().max_texture_dimension_2d;
+    if w == 0 || h == 0 || w > max || h > max {
+        return Err(Unsupported(format!("a {w}×{h} Camera Raw preview doesn't fit the GPU's {max} px textures")));
+    }
+    if source.len() as u64 != u64::from(w) * u64::from(h) {
+        return Err(Unsupported(format!("{} Camera Raw preview pixels for {w}×{h}", source.len())));
+    }
+    Ok(())
+}
+
+/// Flags of `Params.flags`, in the shader's bit order.
+fn flags(s: &PerPixel) -> u32 {
+    let wb = s.whites_blacks.as_ref();
+    let on = [
+        s.gains.is_some(),
+        s.contrast.is_some(),
+        wb.is_some_and(|w| w.whites.is_some()),
+        wb.is_some_and(|w| w.blacks.is_some()),
+        wb.is_some_and(|w| w.per_channel),
+        s.presence.is_some(),
+        s.parametric.is_some(),
+        s.point[0].is_some(),
+        s.point[1].is_some(),
+        s.point[2].is_some(),
+        s.point[3].is_some(),
+        s.hsl.is_some(),
+        s.grade.is_some(),
+        s.vignette.is_some(),
+        s.grain.is_some(),
+        s.clamp,
+    ];
+    on.iter().enumerate().fold(0, |f, (bit, on)| if *on { f | 1 << bit } else { f })
+}
+
+/// The shader's `Params` for a `size` image.
+fn params(size: [u32; 2], s: &PerPixel) -> Vec<u8> {
+    let g = s.gains.unwrap_or([1.0; 3]);
+    let presence = s.presence.unwrap_or_default();
+    let hsl = s.hsl.unwrap_or_default();
+    let grade = s.grade.as_ref();
+    let vig = s.vignette.as_ref();
+    let grain = s.grain.as_ref();
+    let mut out: Vec<u8> = Vec::with_capacity(PARAMS_SIZE as usize);
+    out.extend([size[0], size[1], flags(s)].iter().flat_map(|v| v.to_le_bytes()).chain(s.encoding.to_le_bytes()));
+    let mut f = |v: [f32; 4]| out.extend(v.iter().flat_map(|x| x.to_le_bytes()));
+    f([g[0], g[1], g[2], s.contrast.unwrap_or(0.0)]);
+    f([presence[0], presence[1], 0.0, 0.0]);
+    for row in hsl {
+        f([row[0], row[1], row[2], row[3]]);
+        f([row[4], row[5], row[6], row[7]]);
+    }
+    for k in 0..4 {
+        let (t, l) = grade.map_or(([0.0; 3], 0.0), |gr| (gr.tints[k], gr.lums[k]));
+        f([t[0], t[1], t[2], l]);
+    }
+    f(grade.map_or([0.0; 4], |gr| [gr.blend, gr.balance, 0.0, 0.0]));
+    let style = |v: VignetteStyle| match v {
+        VignetteStyle::HighlightPriority => 0.0,
+        VignetteStyle::ColorPriority => 1.0,
+        VignetteStyle::PaintOverlay => 2.0,
+    };
+    f(vig.map_or([0.0, 0.0, 0.0, 2.0], |v| [v.amount, v.highlights, style(v.style), v.power]));
+    f(vig.map_or([0.0, 0.0, 1.0, 1.0], |v| [v.centre[0], v.centre[1], v.axes[0], v.axes[1]]));
+    f(vig.map_or([0.0; 4], |v| [v.edges[0], v.edges[1], 0.0, 0.0]));
+    f(grain.map_or([1.0, 0.0, 0.0, 1.0], |gr| [gr.cell, gr.roughness, gr.amount, gr.scale]));
+    let seed = grain.map_or(0, |gr| gr.seed);
+    let fine = seed.wrapping_add(7);
+    out.extend([seed as u32, (seed >> 32) as u32, fine as u32, (fine >> 32) as u32].iter().flat_map(|v| v.to_le_bytes()));
+    out
+}
+
+/// The table texture's rows (see [`LUT_ROWS`]); rows of stages that are off stay zero.
+fn tables(s: &PerPixel) -> Vec<f32> {
+    let mut t = vec![0.0f32; (LUT_WIDTH * LUT_ROWS) as usize];
+    let mut put = |row: usize, v: &[f32]| {
+        let start = row * LUT_WIDTH as usize;
+        let n = v.len().min(LUT_WIDTH as usize);
+        if let (Some(dst), Some(src)) = (t.get_mut(start..start + n), v.get(..n)) {
+            dst.copy_from_slice(src);
+        }
+    };
+    if let Some(l) = &s.parametric {
+        put(0, l);
+    }
+    for (k, l) in s.point.iter().enumerate() {
+        if let Some(l) = l {
+            put(1 + k, l);
+        }
+    }
+    if let Some(wb) = &s.whites_blacks {
+        if let Some(r) = &wb.whites {
+            put(5, r);
+        }
+        if let Some(r) = &wb.blacks {
+            put(6, r);
+        }
+    }
+    t
+}
+
+// The Whites and Blacks rows fit a table row.
+const _: () = assert!(WB_STEPS <= CURVE_LUT);
diff --git a/crates/gpu/src/camera_raw.wgsl b/crates/gpu/src/camera_raw.wgsl
new file mode 100644
index 0000000000..abad7cbbc1
--- /dev/null
+++ b/crates/gpu/src/camera_raw.wgsl
@@ -0,0 +1,416 @@
+// Camera Raw's per-pixel develop stages (`photocraft_algo::camera_raw::develop`, constants from
+// `camera_raw::per_pixel`), one fragment per pixel. Each function mirrors the CPU code it is
+// named after, in the same order of operations; `camera_raw.rs` holds the bindings.
+
+struct Params {
+    size: vec2<u32>,
+    flags: u32,
+    // The document's transfer curve: 0 for sRGB's, else a power-law gamma.
+    encoding: f32,
+    // White balance gains (rgb), Contrast's strength (w).
+    gains: vec4<f32>,
+    // Vibrance, Saturation.
+    presence: vec4<f32>,
+    // Color Mixer bands 0-3 and 4-7: hue, saturation, luminance.
+    hsl: array<vec4<f32>, 6>,
+    // Color Grading wheels: tint (rgb), luminance (w).
+    tints: array<vec4<f32>, 4>,
+    // Blending, Balance.
+    grade: vec4<f32>,
+    // [amount, highlights, style, power], [centre, axes], [edges].
+    vignette: array<vec4<f32>, 3>,
+    // Cell, roughness, amount, full-resolution pixels per pixel.
+    grain: vec4<f32>,
+    // The two octaves' seeds as (low, high) words.
+    seeds: vec4<u32>,
+}
+
+@group(0) @binding(0) var<uniform> P: Params;
+@group(0) @binding(1) var src: texture_2d<f32>;
+// R32Float rows of `LUT_WIDTH`: parametric, master, red, green, blue curves; Whites, Blacks rows.
+@group(0) @binding(2) var luts: texture_2d<f32>;
+
+const GAINS: u32 = 0u;
+const CONTRAST: u32 = 1u;
+const WHITES: u32 = 2u;
+const BLACKS: u32 = 3u;
+const PER_CHANNEL: u32 = 4u;
+const PRESENCE: u32 = 5u;
+const PARAMETRIC: u32 = 6u;
+const MASTER: u32 = 7u;
+const RED: u32 = 8u;
+const HSL: u32 = 11u;
+const GRADE: u32 = 12u;
+const VIGNETTE: u32 = 13u;
+const GRAIN: u32 = 14u;
+const CLAMP: u32 = 15u;
+
+const CURVE_LUT: i32 = 1024;
+const WB_STEPS: i32 = 33;
+const TAU: f32 = 6.2831855;
+
+struct VOut {
+    @builtin(position) pos: vec4<f32>,
+}
+
+@vertex
+fn vs(@builtin(vertex_index) vi: u32) -> VOut {
+    let uv = vec2(f32((vi << 1u) & 2u), f32(vi & 2u));
+    return VOut(vec4(uv.x * 2.0 - 1.0, 1.0 - uv.y * 2.0, 0.0, 1.0));
+}
+
+fn on(flag: u32) -> bool {
+    return (P.flags & (1u << flag)) != 0u;
+}
+
+fn luma(c: vec3<f32>) -> f32 {
+    return 0.2126 * c.x + 0.7152 * c.y + 0.0722 * c.z;
+}
+
+fn smoothstep_(e0: f32, e1: f32, x: f32) -> f32 {
+    let t = clamp((x - e0) / (e1 - e0), 0.0, 1.0);
+    return t * t * (3.0 - 2.0 * t);
+}
+
+fn rem_euclid(x: f32, m: f32) -> f32 {
+    let r = x % m;
+    return select(r, r + m, r < 0.0);
+}
+
+fn srgb_to_linear(v: f32) -> f32 {
+    if v <= 0.04045 {
+        return v / 12.92;
+    }
+    return pow((v + 0.055) / 1.055, 2.4);
+}
+
+fn linear_to_srgb(v: f32) -> f32 {
+    if v <= 0.0031308 {
+        return v * 12.92;
+    }
+    return 1.055 * pow(v, 1.0 / 2.4) - 0.055;
+}
+
+fn decode(v: f32) -> f32 {
+    if P.encoding > 0.0 {
+        return pow(max(v, 0.0), P.encoding);
+    }
+    return srgb_to_linear(v);
+}
+
+fn encode(v: f32) -> f32 {
+    if P.encoding > 0.0 {
+        return pow(max(v, 0.0), 1.0 / P.encoding);
+    }
+    return linear_to_srgb(v);
+}
+
+fn lut_at(row: i32, i: i32) -> f32 {
+    return textureLoad(luts, vec2(i, row), 0).r;
+}
+
+// `lut_eval`: linear inside 0..1, extended linearly outside (float documents).
+fn lut_eval(row: i32, v: f32) -> f32 {
+    if v < 0.0 {
+        return v + lut_at(row, 0);
+    }
+    if v > 1.0 {
+        return lut_at(row, CURVE_LUT - 1) + (v - 1.0);
+    }
+    let x = v * f32(CURVE_LUT - 1);
+    let i = min(i32(x), CURVE_LUT - 2);
+    let t = x - f32(i);
+    let a = lut_at(row, i);
+    return a + (lut_at(row, i + 1) - a) * t;
+}
+
+// `whites_blacks::curve` on one row.
+fn wb_curve(row: i32, v: f32) -> f32 {
+    if v >= 1.0 {
+        return 1.0;
+    }
+    let p = max(v, 0.0) * f32(WB_STEPS - 1);
+    let j = min(i32(p), WB_STEPS - 2);
+    let s = p - f32(j);
+    let a = lut_at(row, j);
+    return a + (lut_at(row, j + 1) - a) * s;
+}
+
+fn grey(v: f32) -> f32 {
+    var g = v;
+    if on(WHITES) {
+        g = wb_curve(5, g);
+    }
+    if on(BLACKS) {
+        g = wb_curve(6, g);
+    }
+    return g;
+}
+
+// `whites_blacks::apply`.
+fn whites_blacks(q: vec3<f32>) -> vec3<f32> {
+    let lin = vec3(decode(q.x), decode(q.y), decode(q.z));
+    var out = q;
+    if on(PER_CHANNEL) {
+        for (var c = 0; c < 3; c++) {
+            let over = max(lin[c] - 1.0, 0.0);
+            out[c] = encode(srgb_to_linear(grey(linear_to_srgb(min(lin[c], 1.0)))) + over);
+        }
+        return out;
+    }
+    let y = max(luma(lin), 0.0);
+    if y <= 1e-7 {
+        return q;
+    }
+    let y2 = srgb_to_linear(grey(linear_to_srgb(min(y, 1.0)))) + max(y - 1.0, 0.0);
+    let k = y2 / y;
+    for (var c = 0; c < 3; c++) {
+        out[c] = encode(lin[c] * k);
+    }
+    return out;
+}
+
+fn rgb_to_hsv(c: vec3<f32>) -> vec3<f32> {
+    let mx = max(max(c.x, c.y), c.z);
+    let mn = min(min(c.x, c.y), c.z);
+    let d = mx - mn;
+    var h = 0.0;
+    if d <= 1e-9 {
+        h = 0.0;
+    } else if mx == c.x {
+        h = 60.0 * rem_euclid((c.y - c.z) / d, 6.0);
+    } else if mx == c.y {
+        h = 60.0 * ((c.z - c.x) / d + 2.0);
+    } else {
+        h = 60.0 * ((c.x - c.y) / d + 4.0);
+    }
+    return vec3(h, select(0.0, d / mx, mx > 1e-9), mx);
+}
+
+fn hsv_to_rgb(hue: f32, s: f32, v: f32) -> vec3<f32> {
+    let h = rem_euclid(hue, 360.0) / 60.0;
+    let c = v * s;
+    let x = c * (1.0 - abs((h % 2.0) - 1.0));
+    var rgb: vec3<f32>;
+    switch u32(h) {
+        case 0u: { rgb = vec3(c, x, 0.0); }
+        case 1u: { rgb = vec3(x, c, 0.0); }
+        case 2u: { rgb = vec3(0.0, c, x); }
+        case 3u: { rgb = vec3(0.0, x, c); }
+        case 4u: { rgb = vec3(x, 0.0, c); }
+        default: { rgb = vec3(c, 0.0, x); }
+    }
+    let m = v - c;
+    return rgb + vec3(m);
+}
+
+const HSL_BANDS = array<f32, 8>(0.0, 30.0, 60.0, 120.0, 180.0, 240.0, 270.0, 300.0);
+
+fn band(k: i32, row: i32) -> f32 {
+    return P.hsl[row * 2 + k / 4][k % 4];
+}
+
+// `band_weights` folded into the three sums.
+fn hsl_shift(h: f32) -> vec3<f32> {
+    var bands = HSL_BANDS;
+    var d = vec3(0.0);
+    for (var k = 0; k < 8; k++) {
+        let c = bands[k];
+        let prev = bands[(k + 7) % 8];
+        let next = bands[(k + 1) % 8];
+        let diff = ((h - c + 540.0) % 360.0) - 180.0;
+        let span = select(rem_euclid(c - prev, 360.0), rem_euclid(next - c, 360.0), diff >= 0.0);
+        let w = max(1.0 - abs(diff) / max(span, 1e-3), 0.0);
+        d += w * vec3(band(k, 0), band(k, 1), band(k, 2));
+    }
+    return d;
+}
+
+// `photo_util::hash01`: 64-bit words as (low, high).
+fn mul_wide(a: u32, b: u32) -> vec2<u32> {
+    let a0 = a & 0xffffu;
+    let a1 = a >> 16u;
+    let b0 = b & 0xffffu;
+    let b1 = b >> 16u;
+    let p00 = a0 * b0;
+    let p01 = a0 * b1;
+    let p10 = a1 * b0;
+    let p11 = a1 * b1;
+    let mid = (p00 >> 16u) + (p01 & 0xffffu) + (p10 & 0xffffu);
+    return vec2((p00 & 0xffffu) | (mid << 16u), p11 + (p01 >> 16u) + (p10 >> 16u) + (mid >> 16u));
+}
+
+fn mul64(a: vec2<u32>, b: vec2<u32>) -> vec2<u32> {
+    let w = mul_wide(a.x, b.x);
+    return vec2(w.x, w.y + a.x * b.y + a.y * b.x);
+}
+
+fn shr64(z: vec2<u32>, n: u32) -> vec2<u32> {
+    return vec2((z.x >> n) | (z.y << (32u - n)), z.y >> n);
+}
+
+fn i64_(v: i32) -> vec2<u32> {
+    return vec2(bitcast<u32>(v), select(0u, 0xffffffffu, v < 0));
+}
+
+fn hash01(x: i32, y: i32, seed: vec2<u32>) -> f32 {
+    var z = mul64(i64_(x), vec2(0x7f4a7c15u, 0x9e3779b9u)) ^ mul64(i64_(y), vec2(0x27d4eb4fu, 0xc2b2ae3du)) ^ mul64(seed, vec2(0x9e3779f9u, 0x165667b1u));
+    z = mul64(z ^ shr64(z, 30u), vec2(0x1ce4e5b9u, 0xbf58476du));
+    z = mul64(z ^ shr64(z, 27u), vec2(0x133111ebu, 0x94d049bbu));
+    z = z ^ shr64(z, 31u);
+    return f32(z.y >> 8u) / 16777216.0;
+}
+
+fn value_noise(x: f32, y: f32, seed: vec2<u32>) -> f32 {
+    let xi = floor(x);
+    let yi = floor(y);
+    let tx = x - xi;
+    let ty = y - yi;
+    let sx = tx * tx * (3.0 - 2.0 * tx);
+    let sy = ty * ty * (3.0 - 2.0 * ty);
+    let ix = i32(xi);
+    let iy = i32(yi);
+    let h00 = hash01(ix, iy, seed);
+    let h10 = hash01(ix + 1, iy, seed);
+    let h01 = hash01(ix, iy + 1, seed);
+    let h11 = hash01(ix + 1, iy + 1, seed);
+    let top = h00 + (h10 - h00) * sx;
+    let bot = h01 + (h11 - h01) * sx;
+    return top + (bot - top) * sy;
+}
+
+@fragment
+fn fs(@builtin(position) pos: vec4<f32>) -> @location(0) vec4<f32> {
+    let p = vec2<i32>(floor(pos.xy));
+    let q = textureLoad(src, p, 0);
+    var c = q.rgb;
+    // 1. White balance and exposure.
+    if on(GAINS) {
+        for (var i = 0; i < 3; i++) {
+            c[i] = linear_to_srgb(max(srgb_to_linear(c[i]) * P.gains[i], 0.0));
+        }
+    }
+    // 3. Contrast (without Texture and Clarity).
+    if on(CONTRAST) {
+        let l0 = max(luma(c), 0.0);
+        let lc = min(l0, 1.0);
+        var lv = lc;
+        let xx = clamp(lv, 0.0, 1.0);
+        lv += -P.gains.w * sin(TAU * xx) / TAU;
+        lv = max(lv, 0.0) + (l0 - lc);
+        if l0 > 1e-5 {
+            c = c * (lv / l0);
+        } else {
+            c = c + vec3(lv - l0);
+        }
+    }
+    // 3b. Whites and Blacks.
+    if on(WHITES) || on(BLACKS) {
+        c = whites_blacks(c);
+    }
+    // 4. Vibrance and Saturation.
+    if on(PRESENCE) {
+        let l = luma(c);
+        let mx = max(max(c.x, c.y), c.z);
+        let mn = min(min(c.x, c.y), c.z);
+        let sat = select(0.0, (mx - mn) / mx, mx > 1e-6);
+        let hue = rgb_to_hsv(c).x;
+        let skin = clamp(1.0 - (abs(hue - 25.0) / 25.0), 0.0, 1.0) * 0.5;
+        let k = 1.0 + P.presence.y + P.presence.x * (1.0 - sat) * (1.0 - skin);
+        c = vec3(l) + (c - vec3(l)) * max(k, 0.0);
+    }
+    // 5. Tone curves.
+    if on(PARAMETRIC) {
+        c = vec3(lut_eval(0, c.x), lut_eval(0, c.y), lut_eval(0, c.z));
+    }
+    if on(MASTER) {
+        c = vec3(lut_eval(1, c.x), lut_eval(1, c.y), lut_eval(1, c.z));
+    }
+    for (var i = 0; i < 3; i++) {
+        if on(RED + u32(i)) {
+            c[i] = lut_eval(2 + i, c[i]);
+        }
+    }
+    // 6. Color Mixer.
+    if on(HSL) {
+        let hsv = rgb_to_hsv(max(c, vec3(0.0)));
+        let s = hsv.y;
+        if s > 1e-4 {
+            let d = hsl_shift(hsv.x);
+            let nh = hsv.x + d.x / 100.0 * 30.0;
+            let ns = clamp(s * (1.0 + d.y / 100.0), 0.0, 1.0);
+            var out = hsv_to_rgb(nh, ns, hsv.z);
+            let l0 = luma(c);
+            let l1 = luma(out);
+            if l1 > 1e-6 {
+                out = out * l0 / l1;
+            }
+            let k = exp2(d.z / 100.0 * 1.0 * s);
+            c = out * k;
+        }
+    }
+    // 7. Color Grading.
+    if on(GRADE) {
+        let l = clamp(luma(c), 0.0, 1.0);
+        let blend = P.grade.x;
+        let bal = P.grade.y;
+        let sh = 1.0 - smoothstep_(0.0, 0.5 + bal + blend, l);
+        let hi = smoothstep_(0.5 + bal - blend, 1.0, l);
+        let mid = max(1.0 - sh - hi, 0.0);
+        let masks = vec4(sh, mid, hi, 1.0);
+        for (var k = 0; k < 4; k++) {
+            c += masks[k] * P.tints[k].xyz;
+            if P.tints[k].w != 0.0 {
+                c = c * exp2(masks[k] * P.tints[k].w / 100.0 * 0.6);
+            }
+        }
+    }
+    // 9. Vignette.
+    if on(VIGNETTE) {
+        let amt = P.vignette[0].x;
+        let hl = P.vignette[0].y;
+        let style = u32(P.vignette[0].z);
+        let pw = P.vignette[0].w;
+        let centre = P.vignette[1].xy;
+        let axes = P.vignette[1].zw;
+        let dx = abs((f32(p.x) + 0.5 - centre.x) / axes.x);
+        let dy = abs((f32(p.y) + 0.5 - centre.y) / axes.y);
+        let r = pow(pow(dx, pw) + pow(dy, pw), 1.0 / pw);
+        let m = smoothstep_(P.vignette[2].x, P.vignette[2].y, r);
+        if m > 0.0 {
+            let l = clamp(luma(c), 0.0, 1.0);
+            if style == 2u {
+                let goal = select(1.0, 0.0, amt < 0.0);
+                let k = m * abs(amt);
+                c += (vec3(goal) - c) * k;
+            } else {
+                var k = exp2(amt * 2.0 * m);
+                if amt < 0.0 && hl > 0.0 {
+                    let protect = smoothstep_(0.6, 1.0, l) * hl;
+                    k += (1.0 - k) * protect;
+                }
+                if style == 1u {
+                    let nl = l * k;
+                    c += vec3(nl - l);
+                } else {
+                    c = c * k;
+                }
+            }
+        }
+    }
+    // 9. Grain, in full-resolution coordinates.
+    if on(GRAIN) {
+        let cell = P.grain.x;
+        let rough = P.grain.y;
+        let fx = f32(p.x) * P.grain.w / cell;
+        let fy = f32(p.y) * P.grain.w / cell;
+        let n = value_noise(fx, fy, P.seeds.xy) * (1.0 - rough) + (value_noise(fx * 2.3, fy * 2.3, P.seeds.zw) - 0.0) * rough;
+        let l = clamp(luma(c), 0.0, 1.0);
+        let g = (n - 0.5) * 2.0 * P.grain.z * (0.4 + 2.4 * l * (1.0 - l));
+        c += vec3(g);
+    }
+    if on(CLAMP) {
+        c = clamp(c, vec3(0.0), vec3(1.0));
+    }
+    return vec4(c, q.a);
+}
diff --git a/crates/gpu/src/health.rs b/crates/gpu/src/health.rs
index 18e255feb0..5c07fbc180 100644
--- a/crates/gpu/src/health.rs
+++ b/crates/gpu/src/health.rs
@@ -211,16 +211,29 @@ impl DeviceHealth {
     /// wait).
     #[cfg(not(target_arch = "wasm32"))]
     pub fn wait(&self, device: &wgpu::Device, index: Option<wgpu::SubmissionIndex>) -> bool {
+        self.wait_idle(device, index);
+        self.is_ok()
+    }
+
+    /// Like [`Self::wait`], but returns whether the wait completed: `false` also when the poll
+    /// itself failed, so the work may still be running.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn wait_idle(&self, device: &wgpu::Device, index: Option<wgpu::SubmissionIndex>) -> bool {
         if !self.is_ok() {
             return false;
         }
         let poll = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| device.poll(wgpu::PollType::Wait { submission_index: index, timeout: None })));
         match poll {
-            Ok(Ok(_)) => {}
-            Ok(Err(e)) => log::warn!("wgpu poll: {e}"),
-            Err(_) => self.lost_by_poll(),
+            Ok(Ok(_)) => self.is_ok(),
+            Ok(Err(e)) => {
+                log::warn!("wgpu poll: {e}");
+                false
+            }
+            Err(_) => {
+                self.lost_by_poll();
+                false
+            }
         }
-        self.is_ok()
     }
 
     /// Non-blocking poll (reclaims staging memory), skipped once the device is unusable.
diff --git a/crates/gpu/src/lib.rs b/crates/gpu/src/lib.rs
index f9b6f11e57..7770662b15 100644
--- a/crates/gpu/src/lib.rs
+++ b/crates/gpu/src/lib.rs
@@ -34,10 +34,14 @@
 //! (Multichannel documents, patterns larger than the texture limit, uncached gradients with
 //! coincident colour or opacity stops) returns [`Unsupported`];
 //! callers fall back to the CPU compositor.
+//!
+//! [`CameraRawDevelop`] (`camera_raw.rs`) is a separate pass, not part of the compositor: Camera
+//! Raw's per-pixel develop stages for the dialog's preview, built the first time the dialog opens.
 #![forbid(unsafe_code)]
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 pub mod bounds;
+mod camera_raw;
 mod fx;
 pub mod health;
 pub mod plan;
@@ -54,6 +58,7 @@ use photocraft_doc::{DocId, Document, LayerContent, LayerId, Pattern};
 use photocraft_geom::{Rect, TILE_SIZE, TileCoord};
 use photocraft_raster::{Surface, Tile};
 
+pub use camera_raw::{CAMERA_RAW_SHADER, CameraRawDevelop};
 pub use health::{DeviceHealth, Fault};
 pub use plan::{Kernel, Plan, Role, Unsupported, plan};
 pub use timing::{GpuTimer, GpuTiming};
@@ -488,6 +493,9 @@ pub struct Compositor {
     layer_alloc: Option<String>,
     /// Bytes of pages dropped to admit new ones, not yet counted towards an intermediate submit.
     admit_freed: u64,
+    /// Test hook ([`Compositor::fail_layer_allocs`]): how many more layer page textures fail as
+    /// out of memory.
+    fail_allocs: u32,
     acc_format: wgpu::TextureFormat,
     /// Whether the effect-map pipelines could be built (else documents with layer effects are
     /// [`Unsupported`] and use the CPU compositor).
@@ -802,6 +810,7 @@ impl Compositor {
             recorded: 0,
             layer_alloc: None,
             admit_freed: 0,
+            fail_allocs: 0,
             acc_format,
             effect_maps: map_error.is_none(),
             cmyk: 0,
@@ -842,6 +851,13 @@ impl Compositor {
         self.page
     }
 
+    /// Test hook: the next `n` layer page textures fail as if the device were out of memory
+    /// (a real one can't be forced), so the fallback paths of #6563 can be tested.
+    #[doc(hidden)]
+    pub fn fail_layer_allocs(&mut self, n: u32) {
+        self.fail_allocs = n;
+    }
+
     /// Set the GPU memory resident layer pages may hold (default [`RESIDENT_BUDGET`]), exactly:
     /// nothing is lent to it ([`Self::fit_layers`]) until the next [`Self::set_memory_budget`].
     pub fn set_resident_budget(&mut self, bytes: u64) {
@@ -1353,12 +1369,15 @@ impl Compositor {
                 self.layer_alloc = None;
                 submit_batch(device, queue, encoder, self.health.as_ref(), self.timer.as_mut(), &mut last_submit);
                 #[cfg(not(target_arch = "wasm32"))]
-                match self.health.as_ref() {
-                    Some(h) => {
-                        h.wait(device, last_submit.clone());
-                    }
-                    None => {
-                        let _ = device.poll(wgpu::PollType::Wait { submission_index: last_submit.clone(), timeout: None });
+                {
+                    let idle = match self.health.as_ref() {
+                        Some(h) => h.wait_idle(device, last_submit.clone()),
+                        None => device.poll(wgpu::PollType::Wait { submission_index: last_submit.clone(), timeout: None }).is_ok(),
+                    };
+                    // The GPU has run every timestamp submitted so far, so a retry that fails too
+                    // can drop this measurement without switching timing off for good.
+                    if idle && let Some(t) = self.timer.as_mut() {
+                        t.drained();
                     }
                 }
                 self.staged = 0;
@@ -1501,7 +1520,11 @@ impl Compositor {
             return Some(device.create_texture(desc));
         }
         for retry in [false, true] {
-            let (texture, error) = first_error(device, || device.create_texture(desc));
+            let (texture, mut error) = first_error(device, || device.create_texture(desc));
+            if error.is_none() && self.fail_allocs > 0 {
+                self.fail_allocs -= 1;
+                error = Some(wgpu::Error::OutOfMemory { source: "out of memory (test hook)".into() });
+            }
             match error {
                 None => return Some(texture),
                 Some(wgpu::Error::OutOfMemory { .. }) if !retry => {
diff --git a/crates/gpu/src/timing.rs b/crates/gpu/src/timing.rs
index e79548d84c..0f072bfc3e 100644
--- a/crates/gpu/src/timing.rs
+++ b/crates/gpu/src/timing.rs
@@ -95,8 +95,9 @@ pub struct GpuTimer {
     /// A recording was abandoned after it had already submitted timestamps. Writing a query
     /// again resets that slot (wgpu-core resets per write), and resetting one an in-flight
     /// submission is still writing is undefined, with no way to learn when it has drained.
-    /// That only happens when a refresh fails after a flush, which on this path means the
-    /// device faulted and the canvas is about to drop to the CPU compositor anyway, so
+    /// That only happens when a refresh fails after a flush that nothing waited for (a refresh
+    /// whose page retry waited for the GPU calls [`Self::drained`] first), which is rare: usually
+    /// the device faulted and the canvas is about to drop to the CPU compositor anyway. So
     /// measuring simply stops: no number, which is the contract everywhere else here.
     stopped: bool,
     /// Timestamps and pixels of the measurement being read back, and its readback flag.
@@ -236,6 +237,12 @@ impl GpuTimer {
         self.flushed = false;
     }
 
+    /// The caller waited until the GPU finished everything submitted so far: no timestamp of
+    /// this recording is still in flight, so [`Self::cancel`] can reuse its slots safely.
+    pub fn drained(&mut self) {
+        self.flushed = false;
+    }
+
     /// Whether a measurement is being read back (so this refresh won't be measured).
     pub fn busy(&self) -> bool {
         self.in_flight.is_some()
diff --git a/crates/gpu/tests/it/camera_raw.rs b/crates/gpu/tests/it/camera_raw.rs
new file mode 100644
index 0000000000..ff841c825a
--- /dev/null
+++ b/crates/gpu/tests/it/camera_raw.rs
@@ -0,0 +1,370 @@
+//! Camera Raw's GPU preview pass against the CPU develop (the oracle), stage by stage, at 8, 16
+//! and 32 bits. Skips, with a message, when there is no adapter or device or it can't render
+//! `Rgba32Float`; with `WGPU_BACKEND` set those fail instead, as in `parity.rs`. A pipeline that
+//! doesn't build on an adapter that can run it fails. The shader itself is validated without a
+//! GPU ([`the_shader_validates_without_a_gpu`]), so a WGSL error fails on every runner.
+
+use photocraft_algo::camera_raw::{CameraRaw, Wheel, develop, per_pixel, white_black_points};
+use photocraft_gpu::{CameraRawDevelop, DeviceHealth, Fault};
+
+/// Largest difference from the CPU develop, per channel. The pass evaluates the same
+/// expressions in f32, so what remains is the GPU's own `pow`, `exp2` and `sin` (a few ulps) and
+/// how they move a value across a table entry; measured at most about 1e-5 on NVIDIA (Vulkan,
+/// DX12) and WARP. 1/4096 keeps a margin and stays well under one 8-bit step (the compositor's
+/// tolerance is 1/255).
+const TOL: f32 = 1.0 / 4096.0;
+
+struct Gpu {
+    device: wgpu::Device,
+    queue: wgpu::Queue,
+    dev: CameraRawDevelop,
+    _lock: std::sync::MutexGuard<'static, ()>,
+}
+
+fn gpu() -> Option<Gpu> {
+    let lock = crate::GPU_LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let required = std::env::var_os("WGPU_BACKEND").is_some();
+    // `WGPU_BACKEND` picks the backend; `PHOTOCRAFT_TEST_FALLBACK_ADAPTER=1` the software one (WARP).
+    let instance = wgpu::Instance::new(wgpu::InstanceDescriptor::new_without_display_handle_from_env());
+    let fallback = std::env::var_os("PHOTOCRAFT_TEST_FALLBACK_ADAPTER").is_some();
+    let options = wgpu::RequestAdapterOptions { force_fallback_adapter: fallback, ..Default::default() };
+    let adapter = match pollster::block_on(instance.request_adapter(&options)) {
+        Ok(a) => a,
+        Err(e) => {
+            assert!(!required, "WGPU_BACKEND is set but has no adapter: {e}");
+            eprintln!("skipping Camera Raw GPU tests: no adapter ({e})");
+            return None;
+        }
+    };
+    let info = adapter.get_info();
+    if !CameraRawDevelop::supported(&adapter) {
+        assert!(!required, "WGPU_BACKEND is set but {} can't render Rgba32Float", info.name);
+        eprintln!("skipping Camera Raw GPU tests: adapter can't render Rgba32Float");
+        return None;
+    }
+    let (device, queue) = match pollster::block_on(adapter.request_device(&wgpu::DeviceDescriptor::default())) {
+        Ok(d) => d,
+        Err(e) => {
+            assert!(!required, "WGPU_BACKEND is set but {} has no device: {e}", info.name);
+            eprintln!("skipping Camera Raw GPU tests: no device ({e})");
+            return None;
+        }
+    };
+    eprintln!("Camera Raw GPU tests on {:?} ({})", info.backend, info.name);
+    // The adapter can run the pass: a pipeline that doesn't build is a bug in it, not a skip.
+    let dev = CameraRawDevelop::new(&device).unwrap_or_else(|e| panic!("the Camera Raw pipeline didn't build on {}: {}", info.name, e.0));
+    Some(Gpu { device, queue, dev, _lock: lock })
+}
+
+/// The Camera Raw shader parses and validates (naga, as wgpu does before any driver sees it),
+/// with no adapter: the GPU tests below skip on runners without one.
+#[test]
+fn the_shader_validates_without_a_gpu() {
+    let src = photocraft_gpu::CAMERA_RAW_SHADER;
+    let module = wgpu::naga::front::wgsl::parse_str(src).unwrap_or_else(|e| panic!("{}", e.emit_to_string(src)));
+    wgpu::naga::valid::Validator::new(wgpu::naga::valid::ValidationFlags::all(), wgpu::naga::valid::Capabilities::empty())
+        .validate(&module)
+        .unwrap_or_else(|e| panic!("{}", e.emit_to_string(src)));
+    assert!(!module.entry_points.is_empty());
+}
+
+#[derive(Clone, Copy, Debug)]
+enum Depth {
+    Eight,
+    Sixteen,
+    Float,
+}
+
+const DEPTHS: [Depth; 3] = [Depth::Eight, Depth::Sixteen, Depth::Float];
+
+fn hash(i: usize, c: u64) -> f32 {
+    let mut z = (i as u64).wrapping_mul(0x9E37_79B9_7F4A_7C15) ^ c.wrapping_mul(0xC2B2_AE3D_27D4_EB4F);
+    z = (z ^ (z >> 29)).wrapping_mul(0xBF58_476D_1CE4_E5B9);
+    (z >> 40) as f32 / (1u64 << 24) as f32
+}
+
+/// Gradients, noise and saturated patches (every Color Mixer band), quantized to `depth`. The
+/// 32-bit image also has values above 1 and a few below 0.
+fn image(w: usize, h: usize, depth: Depth) -> Vec<[f32; 4]> {
+    (0..w * h)
+        .map(|i| {
+            let (x, y) = ((i % w) as f32 / w as f32, (i / w) as f32 / h as f32);
+            let mut c = if (i / w).is_multiple_of(4) {
+                // A hue sweep at full and half saturation.
+                let hue = x * 6.0;
+                let f = |n: f32| (((hue + n) % 6.0 - 3.0).abs() - 1.0).clamp(0.0, 1.0);
+                let s = if (i / w).is_multiple_of(8) { 1.0 } else { 0.5 };
+                [f(0.0), f(4.0), f(2.0)].map(|v| (1.0 - s) * 0.6 + s * v)
+            } else {
+                [0.1 + 0.8 * x, 0.2 + 0.6 * y, 0.5 - 0.4 * x * y].map(|v| v + (hash(i, 1) - 0.5) * 0.15)
+            };
+            if let Depth::Float = depth {
+                c = c.map(|v| v * (1.0 + 1.5 * y) - 0.02 * hash(i, 2));
+            }
+            let q = |v: f32| match depth {
+                Depth::Eight => (v.clamp(0.0, 1.0) * 255.0).round() / 255.0,
+                Depth::Sixteen => (v.clamp(0.0, 1.0) * 32768.0).round() / 32768.0,
+                Depth::Float => v,
+            };
+            [q(c[0]), q(c[1]), q(c[2]), 1.0]
+        })
+        .collect()
+}
+
+/// Develops `p` both ways and returns the largest channel difference.
+fn compare(g: &mut Gpu, p: &CameraRaw, depth: Depth) -> f32 {
+    let (w, h) = (171, 113);
+    let float = matches!(depth, Depth::Float);
+    let src = image(w, h, depth);
+    let mut cpu = src.clone();
+    develop(&mut cpu, w, h, p, float);
+    let points = white_black_points(&src, w, h, p);
+    let stages = per_pixel(p, w, h, float, points).unwrap_or_else(|| panic!("{p:?} has a spatial stage"));
+    let out = g.dev.develop(&g.device, &g.queue, None, &src, None, [w as u32, h as u32], &stages).unwrap();
+    assert_eq!(out.len(), cpu.len());
+    let mut worst = (0.0f32, 0usize);
+    for (i, (a, b)) in out.iter().zip(&cpu).enumerate() {
+        assert!(a.iter().all(|v| v.is_finite()), "{p:?} {depth:?}: non-finite GPU pixel {i}: {a:?}");
+        assert_eq!(a[3], b[3], "alpha is kept");
+        for c in 0..3 {
+            let d = (a[c] - b[c]).abs();
+            if d > worst.0 {
+                worst = (d, i);
+            }
+        }
+    }
+    let (d, i) = worst;
+    assert!(d <= TOL, "{p:?} {depth:?}: GPU {:?} vs CPU {:?} at pixel {i} (source {:?}), off by {d}", out[i], cpu[i], src[i]);
+    if !float {
+        assert!(out.iter().all(|q| q[..3].iter().all(|v| (0.0..=1.0).contains(v))), "{p:?} {depth:?}: clipped like the CPU");
+    }
+    d
+}
+
+fn check(name: &str, sets: &[CameraRaw]) {
+    let Some(mut g) = gpu() else { return };
+    for p in sets {
+        for depth in DEPTHS {
+            let d = compare(&mut g, p, depth);
+            eprintln!("{name} {depth:?}: max |GPU - CPU| = {d:.2e}");
+        }
+    }
+}
+
+#[test]
+fn white_balance_and_exposure() {
+    check(
+        "white balance",
+        &[
+            CameraRaw { temperature: 40.0, tint: -25.0, ..Default::default() },
+            CameraRaw { temperature: -70.0, tint: 60.0, exposure: -1.2, ..Default::default() },
+            CameraRaw { exposure: 1.5, ..Default::default() },
+        ],
+    );
+}
+
+#[test]
+fn contrast_without_texture_or_clarity() {
+    check("contrast", &[CameraRaw { contrast: 60.0, ..Default::default() }, CameraRaw { contrast: -80.0, exposure: 0.4, ..Default::default() }]);
+}
+
+#[test]
+fn whites_and_blacks() {
+    check(
+        "whites/blacks",
+        &[
+            CameraRaw { whites: 70.0, blacks: -45.0, ..Default::default() },
+            CameraRaw { whites: -60.0, blacks: 50.0, temperature: 20.0, ..Default::default() },
+            CameraRaw { whites: 30.0, ..Default::default() },
+            CameraRaw { blacks: -100.0, exposure: -0.5, ..Default::default() },
+            // ProPhoto's power-law encoding.
+            CameraRaw { whites: 50.0, blacks: -30.0, encoding_gamma: 1.8, ..Default::default() },
+        ],
+    );
+}
+
+#[test]
+fn tone_curves() {
+    check(
+        "tone curves",
+        &[
+            CameraRaw {
+                curve_highlights: -60.0,
+                curve_lights: 30.0,
+                curve_darks: 40.0,
+                curve_shadows: -20.0,
+                curve_splits: [20.0, 45.0, 80.0],
+                ..Default::default()
+            },
+            CameraRaw { point_curve: vec![[0.0, 20.0], [64.0, 50.0], [192.0, 220.0], [255.0, 245.0]], ..Default::default() },
+            CameraRaw {
+                point_curve_red: vec![[0.0, 0.0], [128.0, 160.0], [255.0, 255.0]],
+                point_curve_green: vec![[0.0, 10.0], [255.0, 230.0]],
+                point_curve_blue: vec![[0.0, 0.0], [100.0, 70.0], [255.0, 255.0]],
+                ..Default::default()
+            },
+        ],
+    );
+}
+
+#[test]
+fn vibrance_and_saturation() {
+    check(
+        "presence",
+        &[
+            CameraRaw { vibrance: 70.0, ..Default::default() },
+            CameraRaw { saturation: -60.0, ..Default::default() },
+            CameraRaw { vibrance: -40.0, saturation: 50.0, ..Default::default() },
+        ],
+    );
+}
+
+#[test]
+fn color_mixer() {
+    let ramp = |k: f32| std::array::from_fn(|i| ((i as f32 * 37.0 + k) % 200.0) - 100.0);
+    check(
+        "color mixer",
+        &[
+            CameraRaw { hsl_hue: ramp(0.0), ..Default::default() },
+            CameraRaw { hsl_sat: ramp(50.0), ..Default::default() },
+            CameraRaw { hsl_lum: ramp(120.0), ..Default::default() },
+            CameraRaw { hsl_hue: ramp(10.0), hsl_sat: ramp(80.0), hsl_lum: ramp(150.0), ..Default::default() },
+        ],
+    );
+}
+
+#[test]
+fn color_grading() {
+    check(
+        "color grading",
+        &[
+            CameraRaw { grade_shadows: Wheel { hue: 220.0, sat: 70.0, lum: 20.0 }, ..Default::default() },
+            CameraRaw {
+                grade_midtones: Wheel { hue: 120.0, sat: 30.0, lum: -15.0 },
+                grade_highlights: Wheel { hue: 40.0, sat: 50.0, lum: 10.0 },
+                grade_global: Wheel { hue: 300.0, sat: 15.0, lum: 5.0 },
+                grade_blending: 80.0,
+                grade_balance: -40.0,
+                ..Default::default()
+            },
+        ],
+    );
+}
+
+#[test]
+fn vignette() {
+    check(
+        "vignette",
+        &[
+            CameraRaw { vignette_amount: -70.0, ..Default::default() },
+            CameraRaw { vignette_amount: -50.0, vignette_roundness: -60.0, vignette_feather: 20.0, vignette_highlights: 70.0, ..Default::default() },
+            CameraRaw {
+                vignette_amount: 60.0,
+                vignette_roundness: 80.0,
+                vignette_midpoint: 20.0,
+                vignette_style: "colorPriority".into(),
+                ..Default::default()
+            },
+            CameraRaw { vignette_amount: -40.0, vignette_style: "paintOverlay".into(), ..Default::default() },
+            CameraRaw { vignette_amount: 40.0, vignette_style: "paintOverlay".into(), ..Default::default() },
+        ],
+    );
+}
+
+#[test]
+fn grain_in_full_resolution_coordinates() {
+    check(
+        "grain",
+        &[
+            CameraRaw { grain_amount: 60.0, seed: 3, ..Default::default() },
+            // A preview proxy: the noise lattice is sampled at full-resolution positions.
+            CameraRaw { grain_amount: 80.0, grain_size: 60.0, grain_roughness: 90.0, seed: u32::MAX, pixel_scale: 0.143, ..Default::default() },
+            CameraRaw { grain_amount: 25.0, grain_size: 0.0, grain_roughness: 0.0, seed: 77, pixel_scale: 0.5, ..Default::default() },
+        ],
+    );
+}
+
+#[test]
+fn every_per_pixel_stage_at_once() {
+    let mut hsl = [0.0; 8];
+    hsl[1] = 35.0;
+    hsl[5] = -50.0;
+    check(
+        "all stages",
+        &[CameraRaw {
+            temperature: 25.0,
+            tint: 10.0,
+            exposure: 0.3,
+            contrast: 25.0,
+            whites: 20.0,
+            blacks: -15.0,
+            vibrance: 30.0,
+            saturation: 10.0,
+            curve_darks: 20.0,
+            point_curve: vec![[0.0, 8.0], [255.0, 250.0]],
+            hsl_hue: hsl,
+            hsl_sat: hsl,
+            hsl_lum: hsl,
+            grade_shadows: Wheel { hue: 210.0, sat: 25.0, lum: 0.0 },
+            vignette_amount: -30.0,
+            grain_amount: 20.0,
+            pixel_scale: 0.2,
+            ..Default::default()
+        }],
+    );
+}
+
+#[test]
+fn identity_leaves_pixels_alone_and_spatial_settings_have_no_pass() {
+    let Some(mut g) = gpu() else { return };
+    let p = CameraRaw::default();
+    let src = image(64, 32, Depth::Float);
+    let stages = per_pixel(&p, 64, 32, false, None).unwrap();
+    let out = g.dev.develop(&g.device, &g.queue, None, &src, Some(1), [64, 32], &stages).unwrap();
+    assert_eq!(out, src, "the CPU develop returns early, unclipped");
+    for spatial in [
+        CameraRaw { dehaze: 10.0, ..Default::default() },
+        CameraRaw { shadows: 10.0, ..Default::default() },
+        CameraRaw { highlights: -10.0, ..Default::default() },
+        CameraRaw { texture: 10.0, ..Default::default() },
+        CameraRaw { clarity: 10.0, ..Default::default() },
+        CameraRaw { sharpen_amount: 10.0, ..Default::default() },
+        CameraRaw { noise_luminance: 10.0, ..Default::default() },
+        CameraRaw { noise_color: 10.0, ..Default::default() },
+    ] {
+        assert!(spatial.spatial() && per_pixel(&spatial, 64, 32, false, Some((0.0, 1.0))).is_none(), "{spatial:?}");
+    }
+    // Whites and Blacks need the image's points.
+    assert!(per_pixel(&CameraRaw { whites: 10.0, ..Default::default() }, 64, 32, false, None).is_none());
+}
+
+#[test]
+fn a_cached_source_is_reused_and_a_new_key_uploads() {
+    let Some(mut g) = gpu() else { return };
+    let p = CameraRaw { exposure: 0.5, ..Default::default() };
+    let stages = per_pixel(&p, 64, 32, false, None).unwrap();
+    let a = image(64, 32, Depth::Eight);
+    let b: Vec<[f32; 4]> = a.iter().map(|q| [q[2], q[0], q[1], 1.0]).collect();
+    let first = g.dev.develop(&g.device, &g.queue, None, &a, Some(7), [64, 32], &stages).unwrap();
+    // Same key: the uploaded source stays (callers key by the proxy's identity).
+    assert_eq!(g.dev.develop(&g.device, &g.queue, None, &b, Some(7), [64, 32], &stages).unwrap(), first);
+    let mut cpu = b.clone();
+    develop(&mut cpu, 64, 32, &p, false);
+    let other = g.dev.develop(&g.device, &g.queue, None, &b, Some(8), [64, 32], &stages).unwrap();
+    assert!(other.iter().zip(&cpu).all(|(x, y)| (0..3).all(|c| (x[c] - y[c]).abs() <= TOL)));
+}
+
+#[test]
+fn bad_sizes_and_faulted_devices_are_errors() {
+    let Some(mut g) = gpu() else { return };
+    let stages = per_pixel(&CameraRaw { exposure: 0.5, ..Default::default() }, 4, 4, false, None).unwrap();
+    let px = vec![[0.5f32; 4]; 16];
+    for size in [[0, 4], [4, 0], [5, 4], [3, 3], [u32::MAX, 1]] {
+        assert!(g.dev.develop(&g.device, &g.queue, None, &px, None, size, &stages).is_err(), "{size:?}");
+    }
+    let health = DeviceHealth::new();
+    health.mark(Fault::Lost("test".into()));
+    assert!(g.dev.develop(&g.device, &g.queue, Some(&health), &px, None, [4, 4], &stages).is_err());
+    // And the pass still works afterwards.
+    assert!(g.dev.develop(&g.device, &g.queue, Some(&DeviceHealth::new()), &px, None, [4, 4], &stages).is_ok());
+}
diff --git a/crates/gpu/tests/it/main.rs b/crates/gpu/tests/it/main.rs
index 2c070f19ce..027db9d995 100644
--- a/crates/gpu/tests/it/main.rs
+++ b/crates/gpu/tests/it/main.rs
@@ -4,6 +4,7 @@
 /// creates a device takes this lock and holds it until the device is dropped.
 static GPU_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
 
+mod camera_raw;
 mod device_loss;
 mod parity;
 mod pipeline_errors;
diff --git a/crates/gpu/tests/it/parity.rs b/crates/gpu/tests/it/parity.rs
index 65ddbe33c2..14a3e62243 100644
--- a/crates/gpu/tests/it/parity.rs
+++ b/crates/gpu/tests/it/parity.rs
@@ -2915,6 +2915,59 @@ fn layer_pages_are_admitted_under_a_zero_budget_and_stay_on_the_gpu() {
     check(&mut g, &d, "after zero-budget renders");
 }
 
+/// A layer page texture the device has no memory for (#6563): the compositor drops the pages
+/// this cell doesn't use and tries again, then submits, waits and runs the cell once more, and
+/// only then ends this refresh on the CPU. The device stays healthy and the next refresh is back
+/// on the GPU. The test hook makes the next `n` page textures fail as out of memory.
+#[test]
+fn a_layer_page_out_of_memory_retries_then_ends_only_that_refresh_on_the_cpu() {
+    let Some(mut g) = gpu() else { return };
+    let mut d = base_doc(600, 500);
+    d.layers.push(noise_layer("mid", PixelFormat::RGBA8, Rect::new(-20, 10, 590, 480), 71, 0.0));
+    let mut top = noise_layer("top", PixelFormat::RGBA8, Rect::new(30, -15, 620, 510), 72, 0.2);
+    top.blend = BlendMode::Multiply;
+    d.layers.push(top);
+    g.paged.set_composite_cache_budget(0);
+    let cpu = photocraft_compose::flatten(&d);
+    let encode = |g: &mut Gpu, d: &Document| {
+        let mut encoder = g.device.create_command_encoder(&wgpu::CommandEncoderDescriptor::default());
+        g.paged.encode(&g.device, &g.queue, &mut encoder, d, d.bounds(), &mut |_, _| {})
+    };
+    let render = |g: &mut Gpu, d: &Document| photocraft_gpu::render_to_vec_stats(&mut g.paged, &g.device, &g.queue, d, d.bounds());
+    let matches = |out: &[[f32; 4]], what: &str| {
+        let worst = worst_diff(&cpu.px, out);
+        assert!(worst.0 <= TOL, "{what}: max diff {:.2}/255 at {}", worst.0 * 255.0, worst.1);
+    };
+    // Every case starts with no pages, so the first page texture is the one that fails.
+    let fresh = |g: &mut Gpu, d: &Document, n: u32| {
+        g.paged.forget_doc(d.id);
+        g.paged.fail_layer_allocs(n);
+    };
+
+    // One failure: the second try right away succeeds (`encode` can't submit, so this is the
+    // only retry it has).
+    fresh(&mut g, &d, 1);
+    encode(&mut g, &d).unwrap_or_else(|e| panic!("one failed page texture is retried at once: {}", e.0));
+    // Two: both tries fail, and `encode` gives the refresh to the CPU.
+    fresh(&mut g, &d, 2);
+    let e = encode(&mut g, &d).expect_err("encode can't submit to free memory");
+    assert_eq!(e.0, photocraft_gpu::OVER_BUDGET);
+    assert!(g.paged.fault().is_none(), "out of memory for a page doesn't lose the device");
+    // `render` submits, waits and runs the cell once more, which then succeeds.
+    fresh(&mut g, &d, 2);
+    let (out, s) = render(&mut g, &d).unwrap_or_else(|e| panic!("render retries after submitting: {}", e.0));
+    assert!(s.flushes > 0, "{s:?}");
+    matches(&out, "after the submit-and-retry");
+    // Four: the retry after the submit fails as well, so this refresh goes to the CPU...
+    fresh(&mut g, &d, 4);
+    let e = render(&mut g, &d).expect_err("every try failed");
+    assert_eq!(e.0, photocraft_gpu::OVER_BUDGET);
+    assert!(g.paged.fault().is_none(), "out of memory for a page doesn't lose the device");
+    // ...and the next one is back on the GPU.
+    let (out, _) = render(&mut g, &d).unwrap_or_else(|e| panic!("the refresh after an out-of-memory one is on the GPU: {}", e.0));
+    matches(&out, "the refresh after the CPU one");
+}
+
 #[test]
 fn the_focused_view_stays_resident_after_a_full_refresh() {
     let _gamma = TEXT_GAMMA.lock().unwrap_or_else(|e| e.into_inner());
diff --git a/crates/gpu/tests/it/timing.rs b/crates/gpu/tests/it/timing.rs
index 78a1864cc3..76348695c5 100644
--- a/crates/gpu/tests/it/timing.rs
+++ b/crates/gpu/tests/it/timing.rs
@@ -287,3 +287,25 @@ fn a_failed_refresh_that_recorded_nothing_keeps_the_timer_alive() {
     let after = after.expect("the timer still measures after a refresh that recorded nothing");
     assert_eq!(after.px, 4096, "the measurement belongs to the refresh that produced it");
 }
+
+/// A refresh whose layer pages ran out of GPU memory even after the submit-and-retry ends on the
+/// CPU (#6563), but measuring goes on: the retry waited for the GPU, so none of the dropped
+/// measurement's timestamps were still in flight.
+#[test]
+fn an_out_of_memory_refresh_does_not_stop_gpu_timing() {
+    let _lock = crate::GPU_LOCK.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    let Some((device, queue, mut comp)) = gpu() else { return };
+    let doc = document(Size::new(640, 480));
+    let full = doc.bounds();
+    // The first page texture fails twice, and twice more in the retry after the submit.
+    comp.fail_layer_allocs(4);
+    assert!(comp.render(&device, &queue, &doc, full, |_, _| {}).is_err(), "every try failed");
+    let mut timing = None;
+    for _ in 0..4 {
+        timing = measure(&device, &queue, &mut comp, &doc, full).2;
+        if timing.is_some() {
+            break;
+        }
+    }
+    assert!(timing.is_some(), "GPU timing stopped for good after one out-of-memory refresh");
+}
diff --git a/crates/io/Cargo.toml b/crates/io/Cargo.toml
index 9b4ab1f416..83ccd3b784 100644
--- a/crates/io/Cargo.toml
+++ b/crates/io/Cargo.toml
@@ -56,3 +56,7 @@ photocraft-psd = { workspace = true, features = ["testgen"] }
 photocraft-raw = { workspace = true, features = ["testgen"] }
 photocraft-testkit = { workspace = true }
 proptest = { workspace = true }
+# Lossless JPEG XL encoder for the JPEG XL DNG preview test (tests only), as in photocraft-raw.
+zune-jpegxl = { version = "=0.5.2", default-features = false, features = ["std"] }
+zune-core = { workspace = true }
+tiff = { version = "0.11", default-features = false, features = ["deflate", "lzw"] }
diff --git a/crates/io/src/camera_raw_xmp.rs b/crates/io/src/camera_raw_xmp.rs
index 159e298a06..a2e63322d0 100644
--- a/crates/io/src/camera_raw_xmp.rs
+++ b/crates/io/src/camera_raw_xmp.rs
@@ -3,8 +3,9 @@
 //! `x:xmpmeta/rdf:RDF/rdf:Description`, as attributes or as child elements.
 //!
 //! Loading applies only the settings the file holds, over the current ones, as Camera Raw's
-//! Load Settings does; settings PhotoCraft has no control for (lens corrections, calibration,
-//! geometry, defringe, …) are ignored and named in the report. Saving writes every supported
+//! Load Settings does; settings PhotoCraft has no control for (lens corrections, geometry,
+//! defringe, …) are ignored and named in the report. The same reader fills the dialog from a
+//! raw file's sidecar (`IMG_0001.xmp` beside `IMG_0001.CR2`), and the writer keeps it. Saving writes every supported
 //! control, so loading the file in Photoshop reproduces the dialog.
 //!
 //! White balance: a Camera Raw Filter on a rendered image uses the relative
@@ -100,6 +101,14 @@ const SCALARS: &[(&str, Field, f32, f32)] = &[
     ("PostCropVignetteRoundness", |p| &mut p.vignette_roundness, -100.0, 100.0),
     ("PostCropVignetteFeather", |p| &mut p.vignette_feather, 0.0, 100.0),
     ("PostCropVignetteHighlightContrast", |p| &mut p.vignette_highlights, 0.0, 100.0),
+    // Calibration
+    ("ShadowTint", |p| &mut p.shadow_tint, -100.0, 100.0),
+    ("RedHue", |p| &mut p.calibration_hue[0], -100.0, 100.0),
+    ("RedSaturation", |p| &mut p.calibration_sat[0], -100.0, 100.0),
+    ("GreenHue", |p| &mut p.calibration_hue[1], -100.0, 100.0),
+    ("GreenSaturation", |p| &mut p.calibration_sat[1], -100.0, 100.0),
+    ("BlueHue", |p| &mut p.calibration_hue[2], -100.0, 100.0),
+    ("BlueSaturation", |p| &mut p.calibration_sat[2], -100.0, 100.0),
 ];
 
 type Curve = fn(&mut CameraRaw) -> &mut Vec<[f32; 2]>;
@@ -265,6 +274,25 @@ fn escape(s: &str) -> String {
     s.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;").replace('"', "&quot;")
 }
 
+/// The XMP toolkit [`save`] names on `x:xmpmeta`.
+const TOOLKIT: &str = "PhotoCraft";
+const META_NS: &str = "adobe:ns:meta/";
+
+/// Did [`save`] write this file? True when its `x:xmpmeta` names PhotoCraft as the toolkit
+/// (`x:xmptk`). Lightroom, Bridge and Camera Raw put their own toolkit there when they write a
+/// file, so a sidecar another application touched since reads false. Never panics.
+pub fn is_photocraft_xmp(bytes: &[u8]) -> bool {
+    if bytes.len() > MAX_XMP_BYTES {
+        return false;
+    }
+    let Ok(text) = std::str::from_utf8(bytes) else { return false };
+    let Ok(doc) = roxmltree::Document::parse(text.trim_start_matches('\u{feff}')) else { return false };
+    doc.descendants()
+        .find(|n| n.is_element() && n.tag_name().namespace() == Some(META_NS) && n.tag_name().name() == "xmpmeta")
+        .and_then(|n| n.attribute((META_NS, "xmptk")))
+        == Some(TOOLKIT)
+}
+
 /// Write `params` as a Camera Raw settings file Photoshop's Load Settings… reads.
 pub fn save(params: &CameraRaw) -> String {
     let mut p = params.clone();
@@ -357,7 +385,8 @@ mod tests {
         assert_eq!(p.point_curve_red, vec![[0.0, 0.0], [128.0, 140.0], [255.0, 255.0]]);
         assert_eq!(p.dehaze, 12.0);
         // Lens vignetting, calibration and geometry have no counterpart.
-        assert_eq!(r.ignored, vec!["VignetteAmount".to_string(), "RedHue".to_string()]);
+        assert_eq!(r.ignored, vec!["VignetteAmount".to_string()], "the Calibration panel's keys load now");
+        assert_eq!(p.calibration_hue[0], -5.0);
     }
 
     #[test]
@@ -420,4 +449,24 @@ mod tests {
         assert_eq!(p, before);
         assert_eq!(r.ignored, vec!["Contrast2012".to_string(), "ToneCurvePV2012".to_string()]);
     }
+
+    #[test]
+    fn is_photocraft_xmp_reads_the_toolkit_marker() {
+        let own = save(&CameraRaw { contrast: 15.0, ..CameraRaw::default() });
+        assert!(is_photocraft_xmp(own.as_bytes()));
+        let wrapped = format!("\u{feff}<?xpacket begin=\"\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?>\n{own}<?xpacket end=\"w\"?>");
+        assert!(is_photocraft_xmp(wrapped.as_bytes()), "an xpacket wrapper and a byte order mark");
+        assert!(!is_photocraft_xmp(FIXTURE), "Camera Raw's own toolkit");
+        for other in [
+            &b""[..],
+            b"<x:xmpmeta",
+            b"<x:xmpmeta xmlns:x=\"adobe:ns:meta/\"/>",
+            b"<x:xmpmeta xmlns:x=\"adobe:ns:meta/\" xmptk=\"PhotoCraft\"/>",
+            b"<x:xmpmeta xmlns:x=\"other:ns/\" x:xmptk=\"PhotoCraft\"/>",
+            b"<x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"PhotoCraft 2\"/>",
+            b"\xff\xfe",
+        ] {
+            assert!(!is_photocraft_xmp(other), "{}", String::from_utf8_lossy(other));
+        }
+    }
 }
diff --git a/crates/io/src/channel_map.rs b/crates/io/src/channel_map.rs
index 74e42feb11..ef3b389bee 100644
--- a/crates/io/src/channel_map.rs
+++ b/crates/io/src/channel_map.rs
@@ -4,15 +4,18 @@
 //! one 13-byte record per extra channel: colour space (u16), four u16 colour components, opacity
 //! (u16, 0..100) and kind (u8: 0 = colour indicates selected areas, 1 = masked ("protected")
 //! areas, 2 = spot channel). Resource 1007 has the same records without the version and the spot
-//! kind, each followed by a padding byte (14 bytes).
+//! kind, each followed by a padding byte (14 bytes). Photoshop 27's TIFFs use the same 13-byte
+//! 1077 records.
 
-use photocraft_color::{Color, ColorMode};
+use photocraft_color::{Color, ColorMode, SampleType};
 use photocraft_doc::{AlphaChannel, ColorIndicates};
 
 pub(crate) const DISPLAY_INFO: u16 = 1077;
 pub(crate) const DISPLAY_INFO_OLD: u16 = 1007;
 /// Quick Mask information: channel id (u16) and an "initially empty" flag (u8).
 pub(crate) const QUICK_MASK_INFO: u16 = 1022;
+/// Alpha channel identifiers (Photoshop 6): one big-endian u32 per extra channel, no count prefix.
+pub(crate) const ALPHA_IDENTIFIERS: u16 = 1053;
 
 const SPACE_RGB: u16 = 0;
 const SPACE_HSB: u16 = 1;
@@ -20,6 +23,33 @@ const SPACE_CMYK: u16 = 2;
 const SPACE_LAB: u16 = 7;
 const SPACE_GRAY: u16 = 8;
 
+/// Converts one spot channel's plane (native-endian samples) between the document's ink density
+/// (1 = solid ink) and the way Photoshop stores a spot channel (0 = solid ink, the maximum =
+/// bare paper; every PSD and TIFF Photoshop 27.11 saves stores it so). The conversion is its own
+/// inverse, so it serves both open and save. Every reader and writer of Photoshop-polarity spot
+/// planes goes through here: a change to the in-memory convention changes only this function.
+/// Alpha channels are stored straight (the maximum = selected) and never come here.
+pub(crate) fn photoshop_spot_plane(plane: &mut [u8], sample: SampleType) {
+    crate::pixels::invert_plane(plane, sample);
+}
+
+/// Resource 1053 for `count` channels: one big-endian u32 identifier each, with no length prefix
+/// (Photoshop, ag-psd and psd-tools read u32s until the resource ends). Photoshop 27.11 numbers a
+/// new document's channels 3, 4, 5, … in every colour mode (RGB, CMYK, Gray and Lab, in its PSDs
+/// and TIFFs alike), so these do too. `transparency`: the merged image's transparency channel
+/// comes first, with identifier 0 (Photoshop's transparent PSD lists `0, 3, 4, 5`).
+pub(crate) fn alpha_identifiers(transparency: bool, count: usize) -> Vec<u8> {
+    let mut out = Vec::with_capacity(count.saturating_add(1).saturating_mul(4));
+    if transparency {
+        out.extend_from_slice(&0u32.to_be_bytes());
+    }
+    for i in 0..count {
+        let id = 3u32.saturating_add(u32::try_from(i).unwrap_or(u32::MAX));
+        out.extend_from_slice(&id.to_be_bytes());
+    }
+    out
+}
+
 /// Resource 1077 for `channels` (in file order): a version, then 13 bytes per channel (colour
 /// space, four components, opacity, kind). Every corpus file, Photoshop's included, uses 13;
 /// 14-byte records (the older 1007 layout) shift every channel after the first.
@@ -46,12 +76,33 @@ pub(crate) fn display_info(channels: &[&AlphaChannel], transparency: bool) -> Ve
     out
 }
 
+/// The records of a DisplayInfo resource (`versioned` = 1077: 13-byte records after a version;
+/// else the older 1007 with 14-byte records). A trailing partial record is left out.
+fn display_records(data: &[u8], versioned: bool) -> std::slice::ChunksExact<'_, u8> {
+    let (body, size) = if versioned { (data.get(4..).unwrap_or(&[]), 13) } else { (data, 14) };
+    body.chunks_exact(size)
+}
+
+/// Which of the extra channels are spot channels (kind 2), after skipping `skip` records (the
+/// merged transparency channel's), in the same records [`apply_display_info`] reads. A channel
+/// without a record is not a spot.
+pub(crate) fn spot_flags(data: &[u8], versioned: bool, skip: usize) -> Vec<bool> {
+    display_records(data, versioned).skip(skip).map(|rec| rec.get(12) == Some(&2)).collect()
+}
+
+/// Whether a DisplayInfo resource 1077 marks any channel as a spot (kind 2), in 13-byte records
+/// (Photoshop's, and PhotoCraft's since 0.8.2) or in the 14-byte padded records PhotoCraft wrote
+/// up to 0.7.0.
+pub(crate) fn display_info_marks_spot(data: &[u8]) -> bool {
+    let body = data.get(4..).unwrap_or_default();
+    [13, 14].into_iter().any(|size| body.chunks_exact(size).any(|rec| rec.get(12) == Some(&2)))
+}
+
 /// Applies a DisplayInfo resource (`versioned` = 1077: 13-byte records after a version; else the
 /// older 1007 with 14-byte records) to the imported channels in order, after skipping `skip`
 /// records (the merged transparency channel's).
 pub(crate) fn apply_display_info(data: &[u8], versioned: bool, skip: usize, channels: &mut [AlphaChannel]) {
-    let (body, size) = if versioned { (data.get(4..).unwrap_or(&[]), 13) } else { (data, 14) };
-    for (c, rec) in channels.iter_mut().zip(body.chunks_exact(size).skip(skip)) {
+    for (c, rec) in channels.iter_mut().zip(display_records(data, versioned).skip(skip)) {
         let u = |i: usize| u16::from_be_bytes([rec[i], rec[i + 1]]);
         let comps = [u(2), u(4), u(6), u(8)];
         let color = decode_color(u(0), comps);
@@ -149,6 +200,15 @@ mod tests {
         assert!((back[0].opacity - 0.3).abs() < 1e-6);
         assert_eq!(back[0].indicates, ColorIndicates::SelectedAreas);
         assert_eq!(back[1].spot, s.spot);
+        assert_eq!(spot_flags(&bytes, true, 0), [false, true]);
+        assert!(display_info_marks_spot(&bytes));
+        assert!(!display_info_marks_spot(&display_info(&[&a], true)), "alpha and transparency records only");
+        assert!(!display_info_marks_spot(&bytes[..10]));
+        // Photoshop 27 writes a 13-byte record (no pad): red spot, solidity 60.
+        let ps = [0, 0, 0, 1, 0, 0, 0xff, 0xff, 0, 0, 0, 0, 0, 0, 0, 0x3c, 2];
+        let mut spot = vec![AlphaChannel::new("S", Surface::new(PixelFormat::GRAY8))];
+        apply_display_info(&ps, true, 0, &mut spot);
+        assert_eq!(spot[0].spot.map(|(c, s)| (c.to_rgb(), (s * 100.0).round() as u16)), Some(([1.0, 0.0, 0.0], 60)));
         // With the merged transparency's record first, the channels still get their own.
         let with_t = display_info(&[&a, &s], true);
         assert_eq!(with_t.len(), 4 + 3 * 13);
@@ -156,10 +216,79 @@ mod tests {
         apply_display_info(&with_t, true, 1, &mut back);
         assert_eq!(back[0].indicates, ColorIndicates::SelectedAreas);
         assert_eq!(back[1].spot, s.spot);
+        assert_eq!(spot_flags(&with_t, true, 1), [false, true]);
         // Truncated data is ignored rather than misread.
         let mut c = vec![AlphaChannel::new("x", Surface::new(PixelFormat::GRAY8))];
         apply_display_info(&bytes[..10], true, 0, &mut c);
         assert_eq!(c[0].opacity, 0.5);
+        assert!(spot_flags(&bytes[..10], true, 0).is_empty());
+        assert!(spot_flags(&bytes, true, 5).is_empty());
+
+        // 14 unpadded records are a multiple of 14 as well (14×13 = 13×14). Resource 1077
+        // still reads them as 13-byte records; the last spot's solidity must survive.
+        let mut many = Vec::new();
+        for i in 0..14 {
+            let mut ch = AlphaChannel::new(format!("{i}"), Surface::new(PixelFormat::GRAY8));
+            ch.spot = Some((Color::rgb(1.0, 0.0, 0.0), (i as f32) / 14.0));
+            many.push(ch);
+        }
+        let refs: Vec<&AlphaChannel> = many.iter().collect();
+        let packed = display_info(&refs, false);
+        assert_eq!(packed.len(), 4 + 14 * 13);
+        let mut got: Vec<AlphaChannel> = (0..14).map(|i| AlphaChannel::new(format!("{i}"), Surface::new(PixelFormat::GRAY8))).collect();
+        apply_display_info(&packed, true, 0, &mut got);
+        assert_eq!(got[13].spot.map(|(_, s)| (s * 100.0).round() as u16), many[13].spot.map(|(_, s)| (s * 100.0).round() as u16));
+    }
+
+    /// Resource 1053 as Photoshop 27.11 numbers a new document's channels: 3, 4, 5 in every colour
+    /// mode, with the merged transparency first as 0 (its transparent PSD lists `0, 3, 4, 5`).
+    #[test]
+    fn alpha_identifiers_are_numbered_as_photoshop_does() {
+        let ids = |transparency, count| alpha_identifiers(transparency, count).as_chunks::<4>().0.iter().map(|c| u32::from_be_bytes(*c)).collect::<Vec<_>>();
+        assert_eq!(ids(false, 3), [3, 4, 5]);
+        assert_eq!(ids(true, 3), [0, 3, 4, 5]);
+        assert_eq!(ids(false, 1), [3]);
+        assert!(ids(false, 0).is_empty());
+        assert_eq!(ids(true, 0), [0]);
+        assert_eq!(alpha_identifiers(false, 2), [0, 0, 0, 3, 0, 0, 0, 4]);
+    }
+
+    /// PhotoCraft 0.1.0 to 0.7.0 padded each 1077 record to 14 bytes, so a spot after the first
+    /// record sits where a 13-byte reader finds no kind 2; it is still recognised.
+    #[test]
+    fn a_spot_is_found_in_padded_records() {
+        let alpha = |kind: u8| [0, 0, 0xff, 0xff, 0, 0, 0, 0, 0, 0, 0, 50, kind, 0];
+        let mut old = 1u32.to_be_bytes().to_vec();
+        old.extend_from_slice(&alpha(1));
+        old.extend_from_slice(&alpha(0));
+        old.extend_from_slice(&alpha(2));
+        assert_eq!(spot_flags(&old, true, 0), [false, false, false], "13-byte records misread the padded ones");
+        assert!(display_info_marks_spot(&old));
+        old.truncate(old.len() - 14);
+        assert!(!display_info_marks_spot(&old), "two alpha records");
+    }
+
+    /// Photoshop's spot ink (0 = solid) and the document's density (1 = solid) at every depth,
+    /// both ways: the 25 % / 75 % columns of the Photoshop oracles store 191 / 64.
+    #[test]
+    fn photoshop_spot_plane_converts_both_ways() {
+        let mut p8 = vec![255u8, 64, 191, 0];
+        photoshop_spot_plane(&mut p8, SampleType::U8);
+        assert_eq!(p8, [0, 191, 64, 255]);
+        photoshop_spot_plane(&mut p8, SampleType::U8);
+        assert_eq!(p8, [255, 64, 191, 0]);
+        let mut p16: Vec<u8> = [65535u16, 16448, 0].iter().flat_map(|v| v.to_ne_bytes()).collect();
+        photoshop_spot_plane(&mut p16, SampleType::U16);
+        let back: Vec<u16> = p16.as_chunks::<2>().0.iter().map(|c| u16::from_ne_bytes(*c)).collect();
+        assert_eq!(back, [0, 49087, 65535]);
+        let mut p32: Vec<u8> = [1.0f32, 0.25].iter().flat_map(|v| v.to_ne_bytes()).collect();
+        photoshop_spot_plane(&mut p32, SampleType::F32);
+        let back: Vec<f32> = p32.as_chunks::<4>().0.iter().map(|c| f32::from_ne_bytes(*c)).collect();
+        assert_eq!(back, [0.0, 0.75]);
+        // A trailing partial sample is left alone rather than misread.
+        let mut odd = vec![0u8, 0, 7];
+        photoshop_spot_plane(&mut odd, SampleType::U16);
+        assert_eq!(odd, [0xff, 0xff, 7]);
     }
 
     #[test]
diff --git a/crates/io/src/flat.rs b/crates/io/src/flat.rs
index afff94853d..55f602a6e9 100644
--- a/crates/io/src/flat.rs
+++ b/crates/io/src/flat.rs
@@ -280,6 +280,7 @@ pub(crate) fn image_to_document(name: &str, img: &Image) -> Result<ImportResult,
         bg
     };
     doc.layers.push(layer);
+    warnings.extend(crate::tiff_layers::channels_from_extras(&mut doc, img));
     doc.icc_profile = img.icc.clone().map(Arc::new);
     doc.metadata.exif = img.meta.exif.clone().map(Arc::new);
     doc.metadata.xmp = img.meta.xmp.as_deref().map(Arc::from);
@@ -668,6 +669,12 @@ pub(crate) fn export_flat_with(doc: &Document, format: Format, opts: &ExportOpti
     if format == Format::Tga {
         img = tga_image(doc, img, opts.tga_bits, &mut warnings)?;
     }
+    if format == Format::Dds {
+        img = dds_image(doc, img, &mut warnings)?;
+    }
+    if format == Format::Tiff {
+        warnings.extend(crate::tiff_layers::stamp_flat_channels(doc, &mut img));
+    }
     encode_image(&img, format, opts, warnings)
 }
 
@@ -706,7 +713,7 @@ fn tga_image(doc: &Document, img: Image, bits: Option<TgaBits>, warnings: &mut V
             warnings.push("transparency composited over white; a 24-bit Targa has no alpha".into());
             matte_over_white(&img)
         }
-        (TgaBits::Bits32, [channel]) => tga_with_alpha_channel(doc, img, channel, warnings),
+        (TgaBits::Bits32, [channel]) => with_alpha_channel(doc, img, channel, "Targa", warnings),
         (TgaBits::Bits32, alphas) => {
             if !alphas.is_empty() {
                 warnings.push("Targa holds one alpha channel; with several, none was written (as in Photoshop)".into());
@@ -719,11 +726,32 @@ fn tga_image(doc: &Document, img: Image, bits: Option<TgaBits>, warnings: &mut V
     }
 }
 
-/// A 32-bit Targa's image: the colours (composited over white where the layers are transparent)
-/// and `channel`'s values as the alpha.
-fn tga_with_alpha_channel(doc: &Document, img: Image, channel: &AlphaChannel, warnings: &mut Vec<String>) -> Result<Image, IoError> {
+/// The image a DDS texture holds (#8563): as with a 32-bit Targa, the document's alpha channel
+/// becomes the texture's alpha when it has exactly one (spot channels don't count), the colours
+/// composited over white where the layers are transparent; BC1 keeps it as on/off, BC2 and BC3
+/// in full. With none, the layers' transparency is the alpha as before; with several, none of
+/// them is written. Grayscale textures keep their transparency.
+fn dds_image(doc: &Document, img: Image, warnings: &mut Vec<String>) -> Result<Image, IoError> {
+    let alphas: Vec<&AlphaChannel> = doc.channels.iter().filter(|c| c.spot.is_none()).collect();
+    match alphas.as_slice() {
+        [] => Ok(img),
+        [channel] if img.layout().is_rgb() => with_alpha_channel(doc, img, channel, "texture", warnings),
+        [_] => {
+            warnings.push("a grayscale DDS keeps the layers' transparency; the alpha channel was not saved".into());
+            Ok(img)
+        }
+        _ => {
+            warnings.push("a DDS texture holds one alpha channel; with several, none was written".into());
+            Ok(img)
+        }
+    }
+}
+
+/// A 32-bit Targa's or a texture's image: the colours (composited over white where the layers are
+/// transparent) and `channel`'s values as the alpha. `what` names the file in the warning.
+fn with_alpha_channel(doc: &Document, img: Image, channel: &AlphaChannel, what: &str, warnings: &mut Vec<String>) -> Result<Image, IoError> {
     let img = if img.layout().has_alpha() {
-        warnings.push("transparency composited over white; the alpha channel is the Targa's alpha".into());
+        warnings.push(format!("transparency composited over white; the alpha channel is the {what}'s alpha"));
         matte_over_white(&img)?
     } else {
         img
diff --git a/crates/io/src/ora/tests.rs b/crates/io/src/ora/tests.rs
index 922135a42e..c5576ce0ef 100644
--- a/crates/io/src/ora/tests.rs
+++ b/crates/io/src/ora/tests.rs
@@ -352,6 +352,22 @@ fn krita_soft_light_ids_map_to_photoshop_soft_light() {
     assert!(!all.contains("soft_light_svg"), "{all}");
 }
 
+#[test]
+fn soft_light_exports_as_svg_soft_light() {
+    // The W3C id, not krita:soft_light_svg (which import also accepts): other applications read it.
+    let mut d = doc(SampleType::U8);
+    let mut soft = block("Soft", PixelFormat::RGBA8, 0, 0, 10, 10, 5);
+    soft.blend = BlendMode::SoftLight;
+    d.layers.push(soft);
+    let out = export(&d).unwrap();
+    let xml = String::from_utf8(ZipReader::new(&out.bytes).unwrap().read_by_name("stack.xml", 1 << 20).unwrap()).unwrap();
+    assert!(xml.contains("name=\"Soft\"") && xml.contains("composite-op=\"svg:soft-light\""), "{xml}");
+    assert!(!xml.contains("soft_light"), "{xml}");
+    let (back, exported, imported) = round_trip(&d);
+    assert!(back.layers.iter().any(|l| l.name == "Soft" && l.blend == BlendMode::SoftLight));
+    assert!(!exported.iter().chain(&imported).any(|w| w.to_lowercase().contains("soft")), "{exported:?} {imported:?}");
+}
+
 #[test]
 fn preserves_surrounding_whitespace_in_layer_and_group_names() {
     let xml = r#"<image w="2" h="2"><stack>
diff --git a/crates/io/src/pixels.rs b/crates/io/src/pixels.rs
index 0251f83755..15e648df1a 100644
--- a/crates/io/src/pixels.rs
+++ b/crates/io/src/pixels.rs
@@ -21,6 +21,14 @@ pub fn sample_for_depth(depth: u16) -> SampleType {
     }
 }
 
+/// Complements every native-endian sample of one plane (`max − v`, `1 − v` for float). A
+/// trailing partial sample is left unchanged.
+pub(crate) fn invert_plane(bytes: &mut [u8], s: SampleType) {
+    for c in bytes.chunks_exact_mut(s.bytes().max(1)) {
+        invert_sample(c, s);
+    }
+}
+
 fn invert_sample(bytes: &mut [u8], s: SampleType) {
     match s {
         SampleType::U8 => bytes[0] = 255 - bytes[0],
@@ -47,7 +55,7 @@ pub fn interleave(planes: &[Option<&[u8]>], fill: &[Vec<u8>], n: usize, s: Sampl
         return out;
     }
     let bs = bands(n);
-    let step = bs.first().map_or(n, |b| b.len()) * row;
+    let step = bs.first().map_or(n, ExactSizeIterator::len) * row;
     par_map(bs.into_iter().zip(out.chunks_mut(step)).collect(), |(band, part)| {
         for (c, plane) in planes.iter().enumerate() {
             let src = plane.and_then(|p| p.get(band.start * bps..)).unwrap_or_default();
diff --git a/crates/io/src/psd_export.rs b/crates/io/src/psd_export.rs
index 8bfe50038c..7b3d6bb373 100644
--- a/crates/io/src/psd_export.rs
+++ b/crates/io/src/psd_export.rs
@@ -1271,9 +1271,12 @@ pub(crate) fn pascal_names_resource(names: &[&str]) -> Vec<u8> {
     let mut v = Vec::new();
     for n in names {
         let b = legacy_name(n);
-        v.push(b.len() as u8);
-        v.extend_from_slice(&b);
+        let n = b.len().min(255);
+        v.push(n as u8);
+        v.extend_from_slice(&b[..n]);
     }
+    // No per-string pad: Photoshop's resource 1006 for "Spot Color 1" is 13 bytes
+    // (length byte + 12 characters). The 8BIM container pads an odd resource separately.
     v
 }
 
@@ -1763,7 +1766,11 @@ fn document_to_psd_sized(doc: &Document, opts: &PsdExportOptions, depth: u32, ct
     };
     for a in &extra {
         let s = if a.surface.format() != ex.mask_fmt { a.surface.convert(ex.mask_fmt) } else { a.surface.clone() };
-        let bytes = s.to_interleaved(canvas);
+        let mut bytes = s.to_interleaved(canvas);
+        // Spot ink as Photoshop stores it (0 = solid); an alpha channel stays straight.
+        if a.spot.is_some() {
+            crate::channel_map::photoshop_spot_plane(&mut bytes, sample);
+        }
         planes.extend(deinterleave(&bytes, 1, sample, &[false]).remove(0));
     }
     let channels = (cc + usize::from(has_alpha) + extra.len()) as u16;
@@ -1795,6 +1802,9 @@ fn document_to_psd_sized(doc: &Document, opts: &PsdExportOptions, depth: u32, ct
         resources.push(ImageResource::new(1006, pascal_names_resource(&names)));
         resources.push(ImageResource::new(1045, unicode_names_resource(&names)));
         resources.push(ImageResource::new(crate::channel_map::DISPLAY_INFO, crate::channel_map::display_info(&extra, has_alpha)));
+        // Photoshop writes 1053 in every file with an extra channel. Its absence is how a file from
+        // an earlier PhotoCraft is told apart (`psd_import::earlier_photocraft_spot_planes`).
+        resources.push(ImageResource::new(crate::channel_map::ALPHA_IDENTIFIERS, crate::channel_map::alpha_identifiers(has_alpha, extra.len())));
     }
     if let Some(id) = quick_mask_id {
         let mut data = id.to_be_bytes().to_vec();
@@ -1847,7 +1857,13 @@ fn document_to_psd_sized(doc: &Document, opts: &PsdExportOptions, depth: u32, ct
             continue;
         }
         // The signature follows the final version (see `sign_global_blocks`).
-        global_blocks.push(global_block(sig, key, &data));
+        let block = global_block(sig, key, &data);
+        // A kept merged-transparency marker describes the opened file's composite. Over an opaque
+        // one it would make the first alpha channel read back as the transparency, and vanish.
+        if !has_alpha && block.is_merged_transparency_marker() {
+            continue;
+        }
+        global_blocks.push(block);
     }
     if let Some(txt2) = txt2 {
         let mut tb = TaggedBlock::new(*b"Txt2", txt2.clone());
@@ -1872,6 +1888,12 @@ fn document_to_psd_sized(doc: &Document, opts: &PsdExportOptions, depth: u32, ct
         if !keep_imported_resource(doc, *id, data) {
             continue;
         }
+        // 1053 is written afresh with the extra channels. A kept copy (from a Multichannel file, or
+        // a document saved by an earlier version) would be a second one, or list channels that
+        // are gone.
+        if *id == crate::channel_map::ALPHA_IDENTIFIERS {
+            continue;
+        }
         let mut r = ImageResource::new(*id, data.to_vec());
         r.name = legacy_name(name);
         resources.push(r);
@@ -1888,10 +1910,10 @@ fn document_to_psd_sized(doc: &Document, opts: &PsdExportOptions, depth: u32, ct
     resources.push(version_info_resource(real_merged));
 
     let has_layers = !ex.records.is_empty();
-    // Photoshop writes a merged-transparency marker (`Mtrn`, `Mt16`, `Mt32`) before the layer
-    // block, and won't open a file whose `Lr32` comes first (#5068): the layer block goes right
-    // after the last kept marker, else first.
-    let index = global_blocks.iter().rposition(|b| matches!(&b.key, b"Mtrn" | b"Mt16" | b"Mt32")).map_or(0, |i| i + 1);
+    // Photoshop writes a merged-transparency marker (`Mtrn`, `Mt16`, `Mt32`; `MTrn` in a TIFF)
+    // before the layer block, and won't open a file whose `Lr32` comes first (#5068): the layer
+    // block goes right after the last kept marker, else first.
+    let index = global_blocks.iter().rposition(TaggedBlock::is_merged_transparency_marker).map_or(0, |i| i + 1);
     let placement = match (has_layers, sample) {
         (true, SampleType::U16) => LayerInfoPlacement::GlobalBlock { index, signature: *b"8BIM", key: *b"Lr16", padding: None },
         (true, SampleType::F32) => LayerInfoPlacement::GlobalBlock { index, signature: *b"8BIM", key: *b"Lr32", padding: None },
@@ -2004,6 +2026,100 @@ mod tests {
         assert!(back.layers.len() == 1 && bg.name == "Background" && bg.locks.transparency && bg.locks.position, "{:?}", bg.locks);
     }
 
+    /// A layered document with a spot and an alpha channel. Each channel holds 100 %, 25 %, 75 %
+    /// and 0 % in four columns, the layout of the Photoshop spot oracles.
+    fn spot_and_alpha_document() -> Document {
+        let mut doc = document(4, 1);
+        doc.layers.push(Layer::group("Group", vec![Layer::raster("Layer 1", doc.pixel_format())]));
+        let channel = |name: &str| {
+            let mut s = Surface::new(PixelFormat::GRAY8);
+            s.write_interleaved(doc.bounds(), &[255, 64, 191, 0]);
+            photocraft_doc::AlphaChannel::new(name, s)
+        };
+        let mut spot = channel("Spot Color 1");
+        spot.spot = Some((photocraft_doc::Color::rgb(0.0, 0.6, 1.0), 0.0));
+        let alpha = channel("Alpha 1");
+        doc.channels.extend([spot, alpha]);
+        doc
+    }
+
+    /// The extra planes after the colour channels (and the merged transparency) of `file`.
+    fn extra_planes(file: &PsdFile, count: usize) -> Vec<u8> {
+        let planes = file.decode_merged().unwrap();
+        let plane = (file.header.width * file.header.height) as usize * usize::from(file.header.depth / 8);
+        planes[planes.len() - count * plane..].to_vec()
+    }
+
+    /// Resource 1053's identifiers.
+    fn alpha_ids(file: &PsdFile) -> Option<Vec<u32>> {
+        file.resource(crate::channel_map::ALPHA_IDENTIFIERS).map(|r| r.data.as_chunks::<4>().0.iter().map(|c| u32::from_be_bytes(*c)).collect())
+    }
+
+    /// A PSD stores spot ink as Photoshop's own PSDs do (0 = solid ink: the 100, 25, 75 and 0 %
+    /// columns are 0, 191, 64, 255) and an alpha channel straight (255 = selected). The global
+    /// layer mask stays empty and flag bit 3 stays on the layers only, not on the group's closing
+    /// divider: Photoshop opens those as they are, and 509 of the corpus's 721 Photoshop PSDs have
+    /// an empty mask too. Opening the file gives the same ink back.
+    #[test]
+    fn psd_stores_spot_ink_as_photoshop_does() {
+        let doc = spot_and_alpha_document();
+        let file = PsdFile::from_bytes(&document_to_psd(&doc).to_bytes().unwrap()).unwrap();
+        assert_eq!(extra_planes(&file, 2), [0, 191, 64, 255, 255, 64, 191, 0], "spot, then alpha");
+        assert_eq!(file.global_layer_mask.as_ref().map(|m| m.data.len()), Some(0));
+        let flags: Vec<u8> = file.layers().iter().map(|l| l.flags.0 & LayerFlags::BIT4_USEFUL).collect();
+        assert_eq!(flags, [0, LayerFlags::BIT4_USEFUL, LayerFlags::BIT4_USEFUL], "closing divider, layer, group");
+        let back = crate::import("spot.psd", &file.to_bytes().unwrap()).unwrap().document;
+        assert!(back.channels[0].spot.is_some() && back.channels[1].spot.is_none());
+        for c in &back.channels {
+            assert_eq!(c.surface.to_interleaved(back.bounds()), [255, 64, 191, 0], "{}", c.name);
+        }
+    }
+
+    /// Resource 1053 numbers the extra channels as Photoshop 27.11 does in a new document: 3, 4, 5
+    /// in every colour mode, after 0 for the merged transparency when there is one (its
+    /// transparent PSD lists `0, 3, 4, 5`). A Quick Mask is an extra channel too. Without extra
+    /// channels there is none.
+    #[test]
+    fn psd_alpha_identifiers_number_the_channels_as_photoshop_does() {
+        use photocraft_color::Color;
+        let size = photocraft_geom::Size::new(4, 1);
+        for mode in [ColorMode::Rgb, ColorMode::Cmyk, ColorMode::Grayscale, ColorMode::Lab] {
+            let mut doc = Document::with_background("bg", size, mode, SampleType::U8, Color::rgb(1.0, 1.0, 1.0));
+            assert_eq!(alpha_ids(&document_to_psd(&doc)), None, "{mode:?} without channels");
+            doc.channels = spot_and_alpha_document().channels;
+            let file = document_to_psd(&doc);
+            assert!(!file.merged_has_alpha(), "{mode:?}");
+            assert_eq!(alpha_ids(&file), Some(vec![3, 4]), "{mode:?}");
+            doc.quick_mask = Some(photocraft_doc::AlphaChannel::new("Quick Mask", Surface::new(PixelFormat::GRAY8)));
+            assert_eq!(alpha_ids(&document_to_psd(&doc)), Some(vec![3, 4, 5]), "{mode:?} with a Quick Mask");
+        }
+        // The empty layer leaves the composite transparent.
+        let file = document_to_psd(&spot_and_alpha_document());
+        assert!(file.merged_has_alpha());
+        assert_eq!(alpha_ids(&file), Some(vec![0, 3, 4]));
+    }
+
+    /// A save writes one fresh 1053 for the channels the document has. A Photoshop file's own is
+    /// not kept on open (it would be new metadata after every round trip), and one a document
+    /// carries anyway (kept by an earlier version) is never written: next to the fresh one it
+    /// would be a second, and without channels it would list channels that are gone. The
+    /// identifiers here, 3 and 2, are those of psd-tools' `cmyk-alpha-spot.psd` (Photoshop 24.7).
+    #[test]
+    fn a_kept_alpha_identifiers_resource_is_not_written() {
+        let kept = || (crate::channel_map::ALPHA_IDENTIFIERS, String::new(), std::sync::Arc::new([0, 0, 0, 3, 0, 0, 0, 2].to_vec()));
+        let mut file = document_to_psd(&spot_and_alpha_document());
+        file.resources.retain(|r| r.id != crate::channel_map::ALPHA_IDENTIFIERS);
+        file.resources.push(ImageResource::new(kept().0, kept().2.to_vec()));
+        let mut opened = crate::import("ps.psd", &file.to_bytes().unwrap()).unwrap().document;
+        assert!(!opened.metadata.psd_resources.iter().any(|(id, ..)| *id == crate::channel_map::ALPHA_IDENTIFIERS));
+        opened.metadata.psd_resources.push(kept());
+        let again = PsdFile::from_bytes(&crate::export(&opened, "x.psd", &crate::ExportOptions::default()).unwrap().bytes).unwrap();
+        assert_eq!(again.resources.iter().filter(|r| r.id == crate::channel_map::ALPHA_IDENTIFIERS).count(), 1);
+        assert_eq!(alpha_ids(&again), Some(vec![0, 3, 4]));
+        opened.channels.clear();
+        assert_eq!(alpha_ids(&document_to_psd(&opened)), None, "no channels left");
+    }
+
     #[test]
     fn group_divider_id_wraps_without_colliding_with_imported_layer_ids() {
         let mut doc = document(8, 8);
@@ -2030,7 +2146,12 @@ mod tests {
     /// `transparentbg.psd` re-saved both ways). The layer block follows a kept marker.
     #[test]
     fn layer_block_follows_a_kept_merged_transparency_marker() {
-        for (depth, key, marker) in [(SampleType::F32, *b"Lr32", *b"Mt32"), (SampleType::U16, *b"Lr16", *b"Mt16"), (SampleType::F32, *b"Lr32", *b"Mtrn")] {
+        for (depth, key, marker) in [
+            (SampleType::F32, *b"Lr32", *b"Mt32"),
+            (SampleType::U16, *b"Lr16", *b"Mt16"),
+            (SampleType::F32, *b"Lr32", *b"Mtrn"),
+            (SampleType::F32, *b"Lr32", *b"MTrn"),
+        ] {
             let mut doc = Document::new("t", photocraft_geom::Size::new(8, 6), ColorMode::Rgb, depth);
             let mut s = Surface::new(doc.pixel_format());
             s.fill_rect(photocraft_geom::Rect::new(1, 1, 5, 4), &[0.5, 0.2, 0.9, 1.0]);
@@ -2050,6 +2171,28 @@ mod tests {
         assert!(matches!(saved.layer_info_placement, LayerInfoPlacement::GlobalBlock { index: 0, .. }));
     }
 
+    /// A merged-transparency marker kept from the opened file describes that file's composite.
+    /// Saved with an opaque composite, it would make the first alpha channel read back as the
+    /// merged transparency, and the channel would be gone: the save drops it.
+    #[test]
+    fn an_opaque_save_drops_a_kept_merged_transparency_marker() {
+        for (depth, marker) in [(SampleType::U8, *b"MTrn"), (SampleType::U8, *b"Mtrn"), (SampleType::U16, *b"Mt16"), (SampleType::F32, *b"Mt32")] {
+            let case = format!("{depth:?} {}", String::from_utf8_lossy(&marker));
+            let mut doc = Document::new("t", photocraft_geom::Size::new(8, 6), ColorMode::Rgb, depth);
+            let mut s = Surface::new(doc.pixel_format());
+            s.fill_rect(photocraft_geom::Rect::new(0, 0, 8, 6), &[0.5, 0.2, 0.9, 1.0]);
+            doc.layers.push(Layer::new("Layer 1", LayerContent::Raster(s)));
+            doc.channels.push(photocraft_doc::AlphaChannel::new("Alpha 1", Surface::new(PixelFormat::GRAY8)));
+            doc.metadata.psd_global_blocks = vec![(*b"8BIM", marker, std::sync::Arc::new(Vec::new()))];
+            let file = document_to_psd(&doc);
+            assert!(!file.global_blocks.iter().any(TaggedBlock::is_merged_transparency_marker), "{case}");
+            assert!(!file.merged_has_alpha(), "{case}");
+            let back = crate::import("a.psd", &file.to_bytes().unwrap()).unwrap().document;
+            let names: Vec<&str> = back.channels.iter().map(|c| c.name.as_str()).collect();
+            assert_eq!(names, ["Alpha 1"], "{case}");
+        }
+    }
+
     #[test]
     fn unreadable_lr16_warns_on_import_and_is_not_saved_twice() {
         // #2700: a 16-bit file whose Lr16 block claims five layers but holds none.
diff --git a/crates/io/src/psd_import.rs b/crates/io/src/psd_import.rs
index 717f848716..07542bf2c6 100644
--- a/crates/io/src/psd_import.rs
+++ b/crates/io/src/psd_import.rs
@@ -430,10 +430,17 @@ impl Ctx<'_> {
                 })
                 .flatten();
             if let Some(mut t) = parsed {
+                let mut path_error = None;
                 if let Some(txt2) = &self.txt2 {
                     photocraft_text::psd::apply_txt2(&mut t, &block.data, txt2);
+                    // Type on a path keeps its path only in its `Txt2` frame (#7962).
+                    path_error = photocraft_text::psd::apply_txt2_path(&mut t, &block.data, txt2).err();
                     photocraft_text::psd::apply_txt2_frame(&mut t, &block.data, txt2);
                 }
+                if let Some(e) = path_error {
+                    let shape = if matches!(t.shape, photocraft_doc::text::TextShape::Box { .. }) { "paragraph" } else { "point" };
+                    self.warn(format!("layer \"{name}\": its type path could not be read ({e}); it opens as {shape} text"));
+                }
                 // Photoshop's pixels stay until edited. Writers without type pixels are
                 // rendered by text_import::prepare instead of retaining an empty cache.
                 let cache = self.record_surface(rec, &name);
@@ -724,7 +731,7 @@ fn be_to_ne_plane(plane: &[u8], s: SampleType, n: usize) -> Vec<u8> {
     interleave(&[Some(plane)], &[zero_sample(s)], n, s, &[false])
 }
 
-fn unicode_names(data: &[u8]) -> Vec<String> {
+pub(crate) fn unicode_names(data: &[u8]) -> Vec<String> {
     let mut out = Vec::new();
     let mut at = 0;
     while at + 4 <= data.len() {
@@ -876,6 +883,69 @@ pub fn psd_to_document_with(file: &PsdFile, ctl: &photocraft_raster::Interrupt)
     psd_to_document_decoded(file, ctl, None)
 }
 
+/// Whether `file` stores spot planes the way earlier PhotoCraft versions (releases 0.1.0 to
+/// 0.16.0) wrote them: straight (the maximum = solid ink), the opposite of Photoshop, which
+/// stores 0 = solid ink in every PSD and TIFF it saves. Their files are recognised by three
+/// things together:
+///
+/// - DisplayInfo (1077) marks at least one spot channel;
+/// - there is no Alpha Identifiers resource (1053), or one that lists fewer channels than the
+///   file has ([`photoshop_identified_channels`]). Photoshop has written it, one identifier per
+///   extra channel, in every file with an extra channel since version 6, and PhotoCraft writes it
+///   now. No earlier PhotoCraft wrote one of its own, but each kept the 1053 of a Photoshop file
+///   it opened (a transparent document's `[0]`, for one) and wrote it back unchanged, after the
+///   channels added in it, which it stored straight;
+/// - the version info (1057) is byte for byte what those versions wrote: writer "Adobe Photoshop"
+///   with reader "Adobe Photoshop CS6", both NUL-terminated (0.1.0 to 0.7.0), or reader "Adobe
+///   Photoshop 2026" without a NUL (0.8.2 on), with either merged-data flag.
+///
+/// Any other file is read in Photoshop's polarity. psd-tools' `cmyk-spot.psd`, for one, also has
+/// spots and no 1053, but names psd-tools in 1057 and stores Photoshop's polarity. A Photoshop
+/// file that an earlier PhotoCraft opened and saved again kept Photoshop's 1053 and its planes as
+/// Photoshop stored them, so it is read in Photoshop's polarity too; when channels were added
+/// there, only the planes after the ones the kept 1053 lists are read straight.
+///
+/// Keeping these files' ink is the only reason this exists: deleting it (and its one caller)
+/// reads every file in Photoshop's polarity, at the cost of inverting the spot ink of PSDs saved
+/// by those versions.
+pub(crate) fn earlier_photocraft_spot_planes(file: &PsdFile) -> bool {
+    use photocraft_psd::descriptor::UnicodeString;
+    use photocraft_psd::resources::VersionInfo;
+
+    let marks_spot = file.resource(crate::channel_map::DISPLAY_INFO).is_some_and(|r| crate::channel_map::display_info_marks_spot(&r.data));
+    let identifies_every_channel = match file.header.color_mode.color_channels() {
+        Some(color) => {
+            let channels = file.header.channels.saturating_sub(color).saturating_sub(u16::from(file.merged_has_alpha()));
+            photoshop_identified_channels(file) >= usize::from(channels)
+        }
+        // Multichannel has no fixed number of colour channels to count from.
+        None => file.resource(crate::channel_map::ALPHA_IDENTIFIERS).is_some(),
+    };
+    if !marks_spot || identifies_every_channel {
+        return false;
+    }
+    let Some(r) = file.resource(ids::VERSION_INFO) else { return false };
+    // Byte for byte: a resource with anything after the fields is someone else's.
+    let Ok(v) = VersionInfo::from_bytes(&r.data) else { return false };
+    if v.to_bytes() != r.data {
+        return false;
+    }
+    let writers = [
+        (UnicodeString::new_nul("Adobe Photoshop"), UnicodeString::new_nul("Adobe Photoshop CS6")),
+        (UnicodeString::new("Adobe Photoshop"), UnicodeString::new("Adobe Photoshop 2026")),
+    ];
+    v.version == 1 && v.file_version == 1 && writers.iter().any(|(writer, reader)| v.writer == *writer && v.reader == *reader)
+}
+
+/// How many extra channels, after the merged transparency, the Alpha Identifiers resource (1053)
+/// lists: its identifiers other than 0, which Photoshop gives the merged transparency (first, and
+/// in some files with no transparency plane at all). 0 without a 1053. In a file from an earlier
+/// PhotoCraft ([`earlier_photocraft_spot_planes`]) these are the channels of the Photoshop file
+/// it opened, stored as Photoshop stored them; the channels after them were added there.
+pub(crate) fn photoshop_identified_channels(file: &PsdFile) -> usize {
+    file.resource(crate::channel_map::ALPHA_IDENTIFIERS).map_or(0, |r| r.data.as_chunks::<4>().0.iter().filter(|id| **id != [0; 4]).count())
+}
+
 /// Whether the import reads the merged composite: for a flattened or multichannel file (it *is*
 /// the image), a file without layers, or extra alpha/spot channels behind the colour ones.
 pub(crate) fn merged_needed(file: &PsdFile) -> bool {
@@ -965,6 +1035,10 @@ pub(crate) fn psd_to_document_decoded_integrity(
                 doc.clipping_path = Some(photocraft_doc::ClippingPath { name, flatness: 0.0 });
                 doc.metadata.psd_resources.push((r.id, String::from_utf8_lossy(&r.name).into_owned(), Arc::new(r.data.clone())));
             }
+            // Resource 1053 is written afresh with the extra channels on every save, so a kept copy
+            // would be new metadata after each round trip. Multichannel has no such rewrite: the
+            // imported bytes are the channel ids, copied back while they still match.
+            crate::channel_map::ALPHA_IDENTIFIERS if !multichannel => {}
             id if MAPPED_RESOURCES.contains(&id) => {}
             id => doc.metadata.psd_resources.push((id, String::from_utf8_lossy(&r.name).into_owned(), Arc::new(r.data.clone()))),
         }
@@ -1197,13 +1271,29 @@ pub(crate) fn psd_to_document_decoded_integrity(
         // Photoshop lists every extra channel, the merged transparency first when there is one.
         let skip = usize::from(file.merged_has_alpha() && names.len() == usize::from(h.channels).saturating_sub(cc));
         let names = names.get(skip..).unwrap_or_default();
+        // Which planes hold spot ink in Photoshop's polarity (0 = solid): the DisplayInfo records
+        // the channel options are read from below, the transparency's first when `skip` is 1.
+        // A file from an earlier PhotoCraft stores them straight and is read as it was written,
+        // past the channels of the Photoshop file it opened, if any.
+        let straight_from = if earlier_photocraft_spot_planes(file) { photoshop_identified_channels(file) } else { usize::MAX };
+        let photoshop_spots = if let Some(r) = file.resource(crate::channel_map::DISPLAY_INFO) {
+            crate::channel_map::spot_flags(&r.data, true, skip)
+        } else if let Some(r) = file.resource(crate::channel_map::DISPLAY_INFO_OLD) {
+            crate::channel_map::spot_flags(&r.data, false, skip)
+        } else {
+            Vec::new()
+        };
         for (k, idx) in (first..usize::from(h.channels)).enumerate() {
             let Some(p) = merged_plane(all, idx, plane) else {
                 cx.warn_unreadable_data(format!("merged extra channel {idx} is incomplete and was not imported"));
                 break;
             };
+            let mut raw = be_to_ne_plane(p, depth, n);
+            if k < straight_from && photoshop_spots.get(k).copied().unwrap_or(false) {
+                crate::channel_map::photoshop_spot_plane(&mut raw, depth);
+            }
             let mut s = Surface::new(cx.mask_fmt);
-            s.write_interleaved(canvas, &be_to_ne_plane(p, depth, n));
+            s.write_interleaved(canvas, &raw);
             s.prune();
             let name = names.get(k).cloned().unwrap_or_else(|| format!("Alpha {}", k + 1));
             doc.channels.push(AlphaChannel::new(name, s));
@@ -1245,7 +1335,9 @@ pub(crate) fn psd_to_document_decoded_integrity(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use photocraft_psd::{Compression, PsdError, Version, testgen};
+    use photocraft_psd::descriptor::UnicodeString;
+    use photocraft_psd::resources::VersionInfo;
+    use photocraft_psd::{Compression, ImageData, ImageResource, PsdError, Version, testgen};
 
     /// #5200: the Multichannel fallback checks its RGBA output against the budget before
     /// allocating it (here a 2x2 image, 16 bytes, against caps of 15 and 16 bytes).
@@ -1349,4 +1441,266 @@ mod tests {
         assert_eq!(merged_plane(&all, 2, 2), None);
         assert_eq!(merged_plane(&all, usize::MAX, 2), None);
     }
+
+    /// Resource 1057's data.
+    fn version_info(writer: UnicodeString, reader: UnicodeString, has_real_merged_data: bool) -> Vec<u8> {
+        VersionInfo { version: 1, has_real_merged_data, writer, reader, file_version: 1 }.to_bytes()
+    }
+
+    /// The 1057 PhotoCraft 0.1.0 to 0.7.0 wrote: Photoshop CS6's names, NUL-terminated.
+    fn version_info_cs6(has_real_merged_data: bool) -> Vec<u8> {
+        version_info(UnicodeString::new_nul("Adobe Photoshop"), UnicodeString::new_nul("Adobe Photoshop CS6"), has_real_merged_data)
+    }
+
+    /// The 1057 PhotoCraft writes since 0.8.2: Photoshop 2026's bytes, no NUL.
+    fn version_info_2026(has_real_merged_data: bool) -> Vec<u8> {
+        photocraft_psd::resources::version_info_resource(has_real_merged_data).data
+    }
+
+    /// An opaque 4 × 1 RGB document with the Photoshop spot oracles' channels in their order:
+    /// "Spot A", "Alpha 1" and "Spot B", each holding 100, 25, 75 and 0 % in four columns.
+    fn channels_document(depth: SampleType) -> Document {
+        let mut doc = Document::with_background("old", Size::new(4, 1), ColorMode::Rgb, depth, photocraft_color::Color::rgb(1.0, 1.0, 1.0));
+        let gray = PixelFormat::new(ColorMode::Grayscale, depth, false);
+        let canvas = doc.bounds();
+        let channel = |name: &str, spot: Option<(photocraft_color::Color, f32)>| {
+            let mut s = Surface::new(gray);
+            s.write_region(canvas, &[1.0, 0.25, 0.75, 0.0]);
+            AlphaChannel { spot, ..AlphaChannel::new(name, s) }
+        };
+        doc.channels.push(channel("Spot A", Some((photocraft_color::Color::rgb(0.0, 0.627, 1.0), 0.0))));
+        doc.channels.push(channel("Alpha 1", None));
+        doc.channels.push(channel("Spot B", Some((photocraft_color::Color::rgb(1.0, 0.0, 0.627), 0.5))));
+        doc
+    }
+
+    /// Each channel's values on an 8-bit scale.
+    fn ink(doc: &Document) -> Vec<Vec<u8>> {
+        doc.channels.iter().map(|c| c.surface.read_region(doc.bounds()).iter().map(|v| (v * 255.0).round() as u8).collect()).collect()
+    }
+
+    fn spots(doc: &Document) -> Vec<bool> {
+        doc.channels.iter().map(|c| c.spot.is_some()).collect()
+    }
+
+    /// `doc` (opaque, 8 or 16-bit) saved the way PhotoCraft 0.1.0 to 0.16.0 saved it: spot planes
+    /// straight (the maximum = solid ink), no 1053, and `version_info` as resource 1057. `padded`
+    /// lays DisplayInfo out in the 14-byte records of 0.1.0 to 0.7.0.
+    fn as_earlier_photocraft_saved(doc: &Document, version_info: Vec<u8>, padded: bool) -> Vec<u8> {
+        let mut file = crate::psd_export::document_to_psd(doc);
+        assert!(!file.merged_has_alpha());
+        file.resources.retain(|r| r.id != crate::channel_map::ALPHA_IDENTIFIERS);
+        for r in &mut file.resources {
+            match r.id {
+                ids::VERSION_INFO => r.data = version_info.clone(),
+                crate::channel_map::DISPLAY_INFO if padded => {
+                    let (version, records) = r.data.split_at(4);
+                    r.data = version.iter().copied().chain(records.chunks(13).flat_map(|rec| rec.iter().copied().chain([0]))).collect();
+                }
+                _ => {}
+            }
+        }
+        let mut planes = file.decode_merged().unwrap();
+        let plane = planes.len() / usize::from(file.header.channels);
+        for (k, c) in doc.channels.iter().enumerate() {
+            if c.spot.is_some() {
+                // At 8 and 16 bits the complement of a sample is that of each of its bytes.
+                planes[(3 + k) * plane..(4 + k) * plane].iter_mut().for_each(|b| *b = !*b);
+            }
+        }
+        file.image_data = ImageData::encode(Compression::Raw, &planes, &file.header).unwrap();
+        file.to_bytes().unwrap()
+    }
+
+    /// PSDs that PhotoCraft 0.1.0 to 0.16.0 saved with spot channels store them straight. They
+    /// open with the ink they had in those versions (which read every plane straight), whichever
+    /// 1057 they carry. Saved again, they get Photoshop's polarity and a 1053, and reopen with the
+    /// same ink. (A 0.1.0 to 0.7.0 file's padded records misread every channel's options after
+    /// the first, here Spot B's kind, as those versions' successors always have; its ink is kept.)
+    #[test]
+    fn spot_planes_from_earlier_photocraft_keep_their_ink() {
+        for depth in [SampleType::U8, SampleType::U16] {
+            let doc = channels_document(depth);
+            let cases = [
+                ("0.1.0 to 0.7.0", version_info_cs6(true), true),
+                ("0.8.2 on", version_info_2026(true), false),
+                ("0.8.2 on, Maximize Compatibility off", version_info_2026(false), false),
+                ("0.1.0 to 0.7.0, 13-byte records", version_info_cs6(true), false),
+            ];
+            for (what, version_info, padded) in cases {
+                let bytes = as_earlier_photocraft_saved(&doc, version_info, padded);
+                assert!(earlier_photocraft_spot_planes(&PsdFile::from_bytes(&bytes).unwrap()), "{what}");
+                let opened = crate::import("old.psd", &bytes).unwrap().document;
+                assert_eq!(ink(&opened), ink(&doc), "{depth:?} {what}: the ink earlier versions opened");
+                assert!(spots(&opened)[0], "{depth:?} {what}");
+                if !padded {
+                    assert_eq!(spots(&opened), spots(&doc), "{depth:?} {what}");
+                }
+                let saved = crate::export(&opened, "old.psd", &crate::ExportOptions::default()).unwrap();
+                let file = PsdFile::from_bytes(&saved.bytes).unwrap();
+                assert!(file.resource(crate::channel_map::ALPHA_IDENTIFIERS).is_some() && !earlier_photocraft_spot_planes(&file), "{what}");
+                let again = crate::import("again.psd", &saved.bytes).unwrap().document;
+                assert_eq!(ink(&again), ink(&doc), "{depth:?} {what}: saved again");
+                assert_eq!(spots(&again), spots(&opened), "{depth:?} {what}: saved again");
+            }
+        }
+    }
+
+    /// A 0.1.0 to 0.7.0 file whose first extra channel is an alpha channel, spots after it. In its
+    /// 14-byte DisplayInfo records the spots' kind bytes sit where a 13-byte reader (main's, and
+    /// this one's) doesn't look, so only the padded reading finds a spot for the rule. Every plane
+    /// is then read straight, as those versions read it, and keeps its ink. The 13-byte reader
+    /// opens each channel's options from shifted bytes, as on main: here every channel opens as
+    /// an alpha channel. A spot of 2 % solidity puts a 2 where that reader looks for the kind, so
+    /// that channel opens as a spot: without the rule its plane would be inverted. Saved again and
+    /// reopened, every channel keeps its ink and kind.
+    #[test]
+    fn an_early_file_with_an_alpha_channel_first_keeps_its_ink() {
+        for solidity in [0.0, 0.02] {
+            let mut doc = channels_document(SampleType::U8);
+            doc.channels.swap(0, 1);
+            doc.channels[1].spot = Some((photocraft_color::Color::rgb(0.0, 0.627, 1.0), solidity));
+            let names: Vec<&str> = doc.channels.iter().map(|c| c.name.as_str()).collect();
+            assert_eq!(names, ["Alpha 1", "Spot A", "Spot B"]);
+            let bytes = as_earlier_photocraft_saved(&doc, version_info_cs6(true), true);
+            let file = PsdFile::from_bytes(&bytes).unwrap();
+            let info = &file.resource(crate::channel_map::DISPLAY_INFO).unwrap().data;
+            let misread = solidity > 0.0;
+            assert_eq!(crate::channel_map::spot_flags(info, true, 0), [false, misread, false], "{solidity}: 13-byte records");
+            assert!(earlier_photocraft_spot_planes(&file), "{solidity}: found in the 14-byte records");
+            let opened = crate::import("old.psd", &bytes).unwrap().document;
+            assert_eq!(ink(&opened), ink(&doc), "{solidity}: the ink 0.7.0 opened");
+            assert_eq!(spots(&opened), [false, misread, false], "{solidity}: kinds as main reads them");
+            let saved = crate::export(&opened, "old.psd", &crate::ExportOptions::default()).unwrap();
+            let again = crate::import("again.psd", &saved.bytes).unwrap().document;
+            assert_eq!(ink(&again), ink(&doc), "{solidity}: saved again");
+            assert_eq!(spots(&again), spots(&opened), "{solidity}: saved again");
+        }
+    }
+
+    /// A file with spots and no 1053 that no earlier PhotoCraft wrote is read in Photoshop's
+    /// polarity (0 = solid ink). psd-tools' `cmyk-spot.psd` is one: its 1057 names psd-tools as
+    /// writer and reader. So is a file with no 1057, with Photoshop CS6's names without the NUL,
+    /// or with bytes after PhotoCraft's.
+    #[test]
+    fn other_files_without_alpha_identifiers_use_photoshop_polarity() {
+        let doc = channels_document(SampleType::U8);
+        let mut trailing = version_info_2026(true);
+        trailing.extend([0, 0]);
+        let cases = [
+            ("psd-tools", Some(version_info(UnicodeString::new("psd-tools 1.10.0"), UnicodeString::new("psd-tools 1.10.0"), true))),
+            ("no 1057", None),
+            ("CS6 without a NUL", Some(version_info(UnicodeString::new("Adobe Photoshop"), UnicodeString::new("Adobe Photoshop CS6"), true))),
+            ("bytes after PhotoCraft's 1057", Some(trailing)),
+        ];
+        for (what, info) in cases {
+            // Photoshop's polarity, as this version writes it, without 1053.
+            let mut file = crate::psd_export::document_to_psd(&doc);
+            file.resources.retain(|r| r.id != crate::channel_map::ALPHA_IDENTIFIERS && r.id != ids::VERSION_INFO);
+            file.resources.extend(info.map(|d| ImageResource::new(ids::VERSION_INFO, d)));
+            let bytes = file.to_bytes().unwrap();
+            assert!(!earlier_photocraft_spot_planes(&PsdFile::from_bytes(&bytes).unwrap()), "{what}");
+            let opened = crate::import("x.psd", &bytes).unwrap().document;
+            assert_eq!(ink(&opened), ink(&doc), "{what}");
+            assert_eq!(spots(&opened), spots(&doc), "{what}");
+        }
+    }
+
+    /// The rule needs a spot in DisplayInfo and no 1053, besides PhotoCraft's 1057.
+    #[test]
+    fn the_earlier_photocraft_rule_needs_a_spot_and_no_alpha_identifiers() {
+        let mut doc = channels_document(SampleType::U8);
+        let old = PsdFile::from_bytes(&as_earlier_photocraft_saved(&doc, version_info_2026(true), false)).unwrap();
+        assert!(earlier_photocraft_spot_planes(&old));
+        let mut with_ids = old.clone();
+        with_ids.resources.push(ImageResource::new(crate::channel_map::ALPHA_IDENTIFIERS, crate::channel_map::alpha_identifiers(false, 3)));
+        assert!(!earlier_photocraft_spot_planes(&with_ids), "a 1053");
+        let mut no_info = old.clone();
+        no_info.resources.retain(|r| r.id != crate::channel_map::DISPLAY_INFO);
+        assert!(!earlier_photocraft_spot_planes(&no_info), "no DisplayInfo");
+        doc.channels.retain(|c| c.spot.is_none());
+        let alpha_only = PsdFile::from_bytes(&as_earlier_photocraft_saved(&doc, version_info_2026(true), false)).unwrap();
+        assert!(!earlier_photocraft_spot_planes(&alpha_only), "alpha channels only");
+    }
+
+    /// `doc` as an earlier PhotoCraft saved a Photoshop file it had opened with the first `kept`
+    /// of `doc`'s channels: it wrote back the Photoshop file's 1053, `stale_ids`, unchanged and
+    /// those channels' planes as Photoshop stored them (it had read and written them straight),
+    /// and stored the channels added after them straight.
+    fn as_earlier_photocraft_resaved(doc: &Document, stale_ids: &[u32], kept: usize) -> Vec<u8> {
+        let mut file = crate::psd_export::document_to_psd(doc);
+        file.resources.retain(|r| r.id != crate::channel_map::ALPHA_IDENTIFIERS && r.id != ids::VERSION_INFO);
+        file.resources.push(ImageResource::new(crate::channel_map::ALPHA_IDENTIFIERS, stale_ids.iter().flat_map(|id| id.to_be_bytes()).collect()));
+        file.resources.push(ImageResource::new(ids::VERSION_INFO, version_info_2026(true)));
+        let mut planes = file.decode_merged().unwrap();
+        let plane = planes.len() / usize::from(file.header.channels);
+        let first = usize::from(file.header.channels) - doc.channels.len();
+        for (k, c) in doc.channels.iter().enumerate().skip(kept) {
+            if c.spot.is_some() {
+                planes[(first + k) * plane..(first + k + 1) * plane].iter_mut().for_each(|b| *b = !*b);
+            }
+        }
+        file.image_data = ImageData::encode(Compression::Raw, &planes, &file.header).unwrap();
+        file.to_bytes().unwrap()
+    }
+
+    /// An earlier PhotoCraft kept the 1053 of a Photoshop file it opened and wrote it back
+    /// unchanged, so a spot channel added there sits behind a 1053 that doesn't list it: a
+    /// transparent Photoshop document's `[0]` (the white plate of a DTF print, added before
+    /// saving), the `[0, 3]` of one with a spot channel already, or a `[0]` kept through a
+    /// flatten that removed the transparency. The added spot is stored straight and keeps its
+    /// ink; the Photoshop file's own spot keeps Photoshop's polarity. Saved again, both reopen
+    /// the same.
+    #[test]
+    fn a_spot_added_behind_a_kept_alpha_identifiers_resource_keeps_its_ink() {
+        let transparent = |names: &[&str]| {
+            let mut doc = channels_document(SampleType::U8);
+            doc.layers = vec![Layer::raster("Layer 1", doc.pixel_format())];
+            doc.channels.retain(|c| names.contains(&c.name.as_str()));
+            doc
+        };
+        let mut flattened = channels_document(SampleType::U8);
+        flattened.channels.retain(|c| c.name == "Spot A");
+        let cases = [
+            ("transparent, one spot added", transparent(&["Spot A"]), vec![0], 0),
+            ("transparent, a Photoshop spot and one added", transparent(&["Spot A", "Spot B"]), vec![0, 3], 1),
+            ("flattened, one spot added", flattened, vec![0], 0),
+        ];
+        for (what, doc, stale_ids, kept) in cases {
+            let bytes = as_earlier_photocraft_resaved(&doc, &stale_ids, kept);
+            let file = PsdFile::from_bytes(&bytes).unwrap();
+            assert_eq!(file.merged_has_alpha(), what.starts_with("transparent"), "{what}");
+            assert!(earlier_photocraft_spot_planes(&file), "{what}");
+            let opened = crate::import("old.psd", &bytes).unwrap().document;
+            assert_eq!(ink(&opened), ink(&doc), "{what}: the ink earlier versions opened");
+            assert_eq!(spots(&opened), spots(&doc), "{what}");
+            let saved = crate::export(&opened, "old.psd", &crate::ExportOptions::default()).unwrap();
+            let again = crate::import("again.psd", &saved.bytes).unwrap().document;
+            assert_eq!(ink(&again), ink(&doc), "{what}: saved again");
+        }
+    }
+
+    /// A 1053 that lists every extra channel, as Photoshop and this version write it, keeps the
+    /// file in Photoshop's polarity, with PhotoCraft's (Photoshop 2026's) 1057 too: a transparent
+    /// file with a spot, and Photoshop's own `[0]` in a file without a transparency plane.
+    #[test]
+    fn a_complete_alpha_identifiers_resource_keeps_photoshop_polarity() {
+        let mut doc = channels_document(SampleType::U8);
+        doc.layers = vec![Layer::raster("Layer 1", doc.pixel_format())];
+        let bytes = as_earlier_photocraft_resaved(&doc, &[0, 3, 4, 5], 3);
+        let file = PsdFile::from_bytes(&bytes).unwrap();
+        assert!(file.merged_has_alpha());
+        assert!(!earlier_photocraft_spot_planes(&file));
+        assert_eq!(ink(&crate::import("ps.psd", &bytes).unwrap().document), ink(&doc));
+        let mut opaque = channels_document(SampleType::U8);
+        opaque.channels.clear();
+        let mut file = PsdFile::from_bytes(&as_earlier_photocraft_resaved(&opaque, &[0], 0)).unwrap();
+        file.resources.retain(|r| r.id != crate::channel_map::DISPLAY_INFO);
+        file.resources.push(ImageResource::new(
+            crate::channel_map::DISPLAY_INFO,
+            crate::channel_map::display_info(&channels_document(SampleType::U8).channels.iter().collect::<Vec<_>>(), false),
+        ));
+        assert_eq!(photoshop_identified_channels(&file), 0, "0 is the transparency's");
+        assert!(!earlier_photocraft_spot_planes(&file), "no channel left unlisted");
+    }
 }
diff --git a/crates/io/src/raw.rs b/crates/io/src/raw.rs
index 04158deddc..a1ed4aaa01 100644
--- a/crates/io/src/raw.rs
+++ b/crates/io/src/raw.rs
@@ -280,25 +280,52 @@ pub fn import_raw_with(name: &str, bytes: &[u8], opts: &DevelopOptions) -> Resul
             let summary = format!("{DEVELOPED_NOTE} ({} demosaic, as-shot white balance)", opts.demosaic.id());
             developed_document(name, bytes, format, dev, &summary)
         }
-        Err(RawError::Unsupported(reason)) => match photocraft_raw::embedded_preview(bytes) {
-            Some(p) => {
-                let img = upright_preview(bytes, p.jpeg, &opts.limits)?;
-                let mut r = image_to_document(name, &img)?;
-                r.warnings.insert(
-                    0,
-                    format!(
-                        "{format}: {reason} is not supported yet; opened the camera's embedded {}x{} JPEG preview instead (8-bit, not the raw sensor data)",
-                        p.width, p.height
-                    ),
-                );
-                Ok(r)
-            }
-            None => Err(IoError::Raw(RawError::Unsupported(reason))),
-        },
+        Err(RawError::Unsupported(reason)) => {
+            let jpeg = photocraft_raw::embedded_preview(bytes);
+            // A DNG 1.7 converter keeps only its small thumbnail as JPEG and writes the larger
+            // previews as JPEG XL, like the raw data (#8125): open the largest of either kind.
+            let jpeg_area = jpeg.map_or(0, |p| u64::from(p.width) * u64::from(p.height));
+            let jxl = photocraft_raw::embedded_jxl_preview(bytes, &opts.limits).filter(|p| u64::from(p.width) * u64::from(p.height) > jpeg_area);
+            let (img, kind, (w, h)) = match (jxl, jpeg) {
+                (Some(p), _) => {
+                    let size = (p.width, p.height);
+                    (jxl_preview_image(bytes, p)?, "JPEG XL", size)
+                }
+                (None, Some(p)) => (upright_preview(bytes, p.jpeg, &opts.limits)?, "JPEG", (p.width, p.height)),
+                (None, None) => return Err(IoError::Raw(RawError::Unsupported(reason))),
+            };
+            let mut r = image_to_document(name, &img)?;
+            let depth = if img.sample_type() == SampleType::U8 { "8-bit" } else { "16-bit" };
+            r.warnings.insert(
+                0,
+                format!(
+                    "{format}: {reason} is not supported yet; opened the camera's embedded {w}x{h} {kind} preview instead ({depth}, not the raw sensor data)"
+                ),
+            );
+            Ok(r)
+        }
         Err(e) => Err(IoError::Raw(e)),
     }
 }
 
+/// A decoded JPEG XL preview as an image: in its stated colour space (sRGB when it states
+/// none), turned upright by the raw's orientation (DNG previews are stored as the raw is).
+fn jxl_preview_image(raw: &[u8], p: photocraft_raw::DecodedPreview) -> Result<Image, IoError> {
+    let img = if p.bits == 8 {
+        Image::from_u8(p.width, p.height, ChannelLayout::Rgb, p.rgb.iter().map(|&v| v.min(255) as u8).collect())?
+    } else {
+        let max = f64::from((1u32 << p.bits.clamp(1, 16)) - 1);
+        let rgb: Vec<u16> = p.rgb.iter().map(|&v| (f64::from(v).min(max) * 65535.0 / max).round() as u16).collect();
+        Image::from_u16(p.width, p.height, ChannelLayout::Rgb, &rgb)?
+    };
+    let icc = match p.color_space {
+        Some(PreviewColorSpace::AdobeRgb) => Some(Builtin::AdobeRgbCompat.profile().to_bytes().to_vec()),
+        Some(PreviewColorSpace::ProPhoto) => Some(Builtin::ProPhotoCompat.profile().to_bytes().to_vec()),
+        Some(PreviewColorSpace::Srgb) | None => None,
+    };
+    Ok(img.with_icc(icc).oriented(photocraft_raw::orientation(raw).unwrap_or(1))?)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/io/src/svg.rs b/crates/io/src/svg.rs
index 6363945d7e..7ff563d466 100644
--- a/crates/io/src/svg.rs
+++ b/crates/io/src/svg.rs
@@ -203,6 +203,86 @@ fn system_generic_family(_generic: &str) -> Option<String> {
     None
 }
 
+/// Most font file bytes [`in_memory`] keeps; past it a face stays on disk (slow, still right).
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_CACHED_FONT_BYTES: usize = 256 << 20;
+
+/// `id`, or the same face loaded from memory when the database names a file for it. fontdb
+/// re-reads a system font's whole file for every glyph usvg outlines (about a millisecond a
+/// character with Times New Roman), so a short entity-expanded text could keep an import busy
+/// for minutes. Each file is read once per process; the parse's own database copy then holds
+/// every face of that file from memory.
+#[cfg(not(target_arch = "wasm32"))]
+fn in_memory(id: usvg::fontdb::ID, db: &mut Arc<usvg::fontdb::Database>) -> usvg::fontdb::ID {
+    use std::collections::HashMap;
+    use std::path::PathBuf;
+    use std::sync::{Mutex, PoisonError};
+    use usvg::fontdb::Source;
+    type Files = (HashMap<PathBuf, Arc<Vec<u8>>>, usize);
+    static FILES: OnceLock<Mutex<Files>> = OnceLock::new();
+    static LOADING: Mutex<()> = Mutex::new(());
+    let Some((Source::File(path), index)) = db.face_source(id) else { return id };
+    let files = || FILES.get_or_init(Mutex::default).lock().unwrap_or_else(PoisonError::into_inner);
+    let fits = |files: &Files, len: usize| files.1.saturating_add(len) <= MAX_CACHED_FONT_BYTES;
+    let cached = files().0.get(&path).cloned();
+    // One miss at a time, so imports wanting the same file read it once: a second one waits
+    // here, then takes the bytes the first one kept.
+    let loading = cached.is_none().then(|| LOADING.lock().unwrap_or_else(PoisonError::into_inner));
+    let cached = cached.or_else(|| files().0.get(&path).cloned());
+    let bytes = match cached {
+        Some(b) => b,
+        None => {
+            // The size first: a file past the budget isn't read at all, on this lookup or the next.
+            let Ok(len) = std::fs::metadata(&path).map(|m| usize::try_from(m.len()).unwrap_or(usize::MAX)) else { return id };
+            if !fits(&files(), len) {
+                return id;
+            }
+            let Ok(b) = std::fs::read(&path) else { return id };
+            let b = Arc::new(b);
+            // The face has to load from the bytes before they're kept or the file's faces leave
+            // the database: a file replaced or cut short since fontdb indexed it stays on disk.
+            let mut probe = usvg::fontdb::Database::new();
+            let ids = probe.load_font_source(Source::Binary(b.clone()));
+            if !ids.iter().any(|&n| probe.face_source(n).is_some_and(|(_, i)| i == index)) {
+                return id;
+            }
+            let mut files = files();
+            if !fits(&files, b.len()) {
+                return id;
+            }
+            files.1 = files.1.saturating_add(b.len());
+            files.0.insert(path.clone(), b.clone());
+            b
+        }
+    };
+    drop(loading);
+    let db = Arc::make_mut(db);
+    let same_file: Vec<_> = db.faces().filter(|f| matches!(&f.source, Source::File(p) if *p == path)).map(|f| f.id).collect();
+    // Last first: fontdb's slots are reused last-freed-first, so the file's faces come back in
+    // their old places and order, and the fallback search (first face with the character)
+    // still finds the face it finds on disk.
+    for f in same_file.into_iter().rev() {
+        db.remove_face(f);
+    }
+    let loaded = db.load_font_source(Source::Binary(bytes));
+    loaded.into_iter().find(|&n| db.face_source(n).is_some_and(|(_, i)| i == index)).unwrap_or(id)
+}
+
+/// usvg's font choice, with the chosen faces read from memory ([`in_memory`]).
+fn font_resolver() -> usvg::FontResolver<'static> {
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let select = usvg::FontResolver::default_font_selector();
+        let fallback = usvg::FontResolver::default_fallback_selector();
+        usvg::FontResolver {
+            select_font: Box::new(move |font, db| select(font, db).map(|id| in_memory(id, db))),
+            select_fallback: Box::new(move |c, used, db| fallback(c, used, db).map(|id| in_memory(id, db))),
+        }
+    }
+    #[cfg(target_arch = "wasm32")]
+    usvg::FontResolver::default()
+}
+
 /// Parse options for an untrusted drawing. `<image href>` resolves only `data:` URLs: a file path
 /// or relative href is never read, so opening an SVG cannot pull local files (`/etc/...`,
 /// `~/.ssh/...`) into the document. Embedded SVG images get no `<image>` resolution at all
@@ -239,6 +319,7 @@ fn options(fontdb: Arc<usvg::fontdb::Database>) -> usvg::Options<'static> {
         resources_dir: None,
         image_href_resolver: usvg::ImageHrefResolver { resolve_data, resolve_string: Box::new(|_, _| None) },
         fontdb,
+        font_resolver: font_resolver(),
         ..usvg::Options::default()
     }
 }
@@ -1092,6 +1173,154 @@ mod tests {
         }
     }
 
+    /// #9406: a font installed on disk (how the system fonts load) is read once, not once per
+    /// glyph: fontdb re-reads a file source's whole font on every glyph it outlines, about a
+    /// millisecond a character. The face text is set in comes from memory, and the outlines
+    /// match the same font loaded from memory in the first place.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn text_in_a_font_on_disk_is_set_from_memory() {
+        fn inter_on_disk() -> Arc<usvg::fontdb::Database> {
+            let mut db = usvg::fontdb::Database::new();
+            let _ = db.load_font_file(concat!(env!("CARGO_MANIFEST_DIR"), "/../../assets/fonts/Inter-Regular.ttf"));
+            Arc::new(db)
+        }
+        assert!(inter_on_disk().faces().all(|f| matches!(f.source, usvg::fontdb::Source::File(_))));
+        let svg = b"<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"120\" height=\"60\"><text x=\"5\" y=\"45\" font-size=\"48\" font-family=\"Inter\">IHI</text></svg>";
+        let parsed = parse_with(svg, inter_on_disk).unwrap();
+        let faces: Vec<_> = parsed.tree.fontdb().faces().map(|f| matches!(f.source, usvg::fontdb::Source::Binary(_))).collect();
+        assert_eq!(faces, [true], "the face text was set in is held in memory");
+        let on_disk = import_parsed("t", parsed, MAX_GROUP_DEPTH).unwrap();
+        let in_memory = import_parsed("t", parse_with(svg, inter_only).unwrap(), MAX_GROUP_DEPTH).unwrap();
+        assert_eq!(on_disk.document.layers.first().map(|l| l.name.as_str()), Some("IHI"));
+        let outlines = |r: &ImportResult| {
+            let groups = r.document.layers.iter().filter_map(|l| if let LayerContent::Group(g) = &l.content { Some(g) } else { None });
+            groups
+                .flat_map(|g| &g.children)
+                .filter_map(|l| if let LayerContent::Shape(s) = &l.content { Some(s.path.clone()) } else { None })
+                .collect::<Vec<_>>()
+        };
+        assert!(outlines(&on_disk).iter().any(|p| !p.subpaths.is_empty()), "the text has outlines");
+        assert_eq!(outlines(&on_disk), outlines(&in_memory));
+    }
+
+    /// A font file that no longer loads (replaced or cut short since fontdb indexed it) keeps its
+    /// faces in the database and isn't remembered: once the file is whole again, text is set
+    /// from it.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn a_font_file_gone_bad_since_indexing_is_not_cached() {
+        use std::sync::atomic::{AtomicBool, Ordering};
+        static BAD: AtomicBool = AtomicBool::new(true);
+        fn indexed_then_overwritten() -> Arc<usvg::fontdb::Database> {
+            let path = std::env::temp_dir().join(format!("photocraft-svg-test-bad-{}.ttf", std::process::id()));
+            std::fs::write(&path, include_bytes!("../../../assets/fonts/Inter-Regular.ttf")).unwrap();
+            let mut db = usvg::fontdb::Database::new();
+            db.load_font_file(&path).unwrap();
+            if BAD.load(Ordering::SeqCst) {
+                std::fs::write(&path, b"not a font any more").unwrap();
+            }
+            Arc::new(db)
+        }
+        let svg = b"<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"120\" height=\"60\"><text x=\"5\" y=\"45\" font-family=\"Inter\">IHI</text></svg>";
+        let parsed = parse_with(svg, indexed_then_overwritten).unwrap();
+        let sources: Vec<_> = parsed.tree.fontdb().faces().map(|f| matches!(f.source, usvg::fontdb::Source::File(_))).collect();
+        assert_eq!(sources, [true], "the face stays in the database, on disk");
+        BAD.store(false, Ordering::SeqCst);
+        let parsed = parse_with(svg, indexed_then_overwritten).unwrap();
+        let sources: Vec<_> = parsed.tree.fontdb().faces().map(|f| matches!(f.source, usvg::fontdb::Source::Binary(_))).collect();
+        assert_eq!(sources, [true], "the whole file is read into memory now");
+        let layers = import_parsed("t", parsed, MAX_GROUP_DEPTH).unwrap().document.layers;
+        assert_eq!(layers.first().map(|l| l.name.as_str()), Some("IHI"));
+        assert!(
+            layers.iter().any(|l| matches!(&l.content, LayerContent::Group(g) if g.children.iter().any(|c| matches!(&c.content, LayerContent::Shape(s) if !s.path.subpaths.is_empty())))),
+            "the text has outlines"
+        );
+    }
+
+    /// Imports that miss the cache for the same file at once read it once: every one sets its
+    /// text from the same bytes, not a copy of its own next to the kept one.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn imports_missing_the_same_font_at_once_share_one_read() {
+        use std::sync::atomic::{AtomicUsize, Ordering};
+        static ROUND: AtomicUsize = AtomicUsize::new(0);
+        fn fresh_file() -> Arc<usvg::fontdb::Database> {
+            let round = ROUND.load(Ordering::SeqCst);
+            let path = std::env::temp_dir().join(format!("photocraft-svg-test-shared-{}-{round}.ttf", std::process::id()));
+            let mut db = usvg::fontdb::Database::new();
+            db.load_font_file(&path).unwrap();
+            Arc::new(db)
+        }
+        let svg = b"<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"120\" height=\"60\"><text x=\"5\" y=\"45\" font-family=\"Inter\">IHI</text></svg>";
+        for round in 0..5 {
+            ROUND.store(round, Ordering::SeqCst);
+            let path = std::env::temp_dir().join(format!("photocraft-svg-test-shared-{}-{round}.ttf", std::process::id()));
+            std::fs::write(&path, include_bytes!("../../../assets/fonts/Inter-Regular.ttf")).unwrap();
+            let start = Arc::new(std::sync::Barrier::new(8));
+            let threads: Vec<_> = (0..8)
+                .map(|_| {
+                    let start = start.clone();
+                    std::thread::spawn(move || {
+                        start.wait();
+                        let parsed = parse_with(svg, fresh_file).unwrap();
+                        let bytes: Vec<_> = parsed
+                            .tree
+                            .fontdb()
+                            .faces()
+                            .filter_map(|f| if let usvg::fontdb::Source::Binary(b) = &f.source { Some(Arc::as_ptr(b).cast::<u8>() as usize) } else { None })
+                            .collect();
+                        bytes
+                    })
+                })
+                .collect();
+            let bytes: Vec<_> = threads.into_iter().flat_map(|t| t.join().unwrap()).collect();
+            assert_eq!(bytes.len(), 8, "every import set its text from memory");
+            assert!(bytes.iter().all(|&b| b == bytes[0]), "round {round}: {bytes:x?}");
+            let _ = std::fs::remove_file(&path);
+        }
+    }
+
+    /// #9406: moving a font collection into memory keeps its faces in their order, so the
+    /// fallback search for a later text still finds the face it found on disk first.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn a_collection_in_memory_keeps_its_face_order() {
+        fn collection_on_disk() -> Arc<usvg::fontdb::Database> {
+            // A two-face .ttc of the bundled Inter Regular and SemiBold: the `ttcf` header, then
+            // each font with its table offsets moved by where it starts.
+            let fonts: [&[u8]; 2] = [include_bytes!("../../../assets/fonts/Inter-Regular.ttf"), include_bytes!("../../../assets/fonts/Inter-SemiBold.ttf")];
+            let mut ttc = b"ttcf
".to_vec();
+            let mut start = 20;
+            let mut body = Vec::new();
+            for f in fonts {
+                ttc.extend_from_slice(&u32::try_from(start).unwrap().to_be_bytes());
+                let mut font = f.to_vec();
+                for t in 0..usize::from(u16::from_be_bytes([font[4], font[5]])) {
+                    let at = 12 + t * 16 + 8;
+                    let off = u32::from_be_bytes(font[at..at + 4].try_into().unwrap()) + u32::try_from(start).unwrap();
+                    font[at..at + 4].copy_from_slice(&off.to_be_bytes());
+                }
+                font.resize(font.len().next_multiple_of(4), 0);
+                start += font.len();
+                body.extend(font);
+            }
+            ttc.extend(body);
+            let path = std::env::temp_dir().join(format!("photocraft-svg-test-{}.ttc", std::process::id()));
+            std::fs::write(&path, ttc).unwrap();
+            let mut db = usvg::fontdb::Database::new();
+            db.load_font_file(&path).unwrap();
+            Arc::new(db)
+        }
+        let order = |db: &usvg::fontdb::Database| db.faces().map(|f| (f.index, f.weight.0)).collect::<Vec<_>>();
+        assert_eq!(order(&collection_on_disk()), [(0, 400), (1, 600)]);
+        let svg = b"<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"120\" height=\"60\"><text x=\"5\" y=\"45\" font-family=\"Inter\">IHI</text></svg>";
+        let parsed = parse_with(svg, collection_on_disk).unwrap();
+        let db = parsed.tree.fontdb();
+        assert!(db.faces().all(|f| matches!(f.source, usvg::fontdb::Source::Binary(_))), "both faces of the file are in memory");
+        assert_eq!(order(db), [(0, 400), (1, 600)]);
+    }
+
     #[test]
     fn generic_families_point_at_installed_fonts() {
         use usvg::fontdb::Family;
diff --git a/crates/io/src/tiff_layers.rs b/crates/io/src/tiff_layers.rs
index 4245957156..fc08d76452 100644
--- a/crates/io/src/tiff_layers.rs
+++ b/crates/io/src/tiff_layers.rs
@@ -11,11 +11,13 @@
 use std::sync::Arc;
 
 use photocraft_codecs::{self as codecs, ChannelLayout, Format, Image, SampleType as CSample};
-use photocraft_color::ColorMode;
-use photocraft_doc::Document;
+use photocraft_color::{ColorMode, PixelFormat, SampleType};
+use photocraft_doc::{AlphaChannel, Document};
+use photocraft_geom::Rect;
 use photocraft_psd::resources::ids;
 use photocraft_psd::tiff::{ByteOrder, ImageSourceData, resources_from_bytes, resources_to_bytes};
 use photocraft_psd::{ColorMode as PsdMode, Compression, Header, ImageData, ImageResource, ResolutionInfo};
+use photocraft_raster::Surface;
 
 use crate::flat::{csample, encode_image, image_to_document, layout_for, single_layer, try_buffer};
 use crate::psd_export::PsdExportOptions;
@@ -101,13 +103,36 @@ pub(crate) fn import_layered(name: &str, img: &Image, layers: &[u8]) -> Result<I
         CSample::F16 | CSample::F32 => 32,
     };
     let (w, h) = img.dimensions();
-    let channels = u16::try_from(img.layout().channels()).map_err(|_| IoError::Unsupported("too many channels".into()))?;
+    let mut data = planar_big_endian(&img, color_channels, mode == PsdMode::Cmyk)?;
+    let bps = img.sample_type().bytes();
+    let plane_len = (w as usize).saturating_mul(h as usize).saturating_mul(bps);
+    let mut added = 0usize;
+    for e in img.meta.extra_samples.iter().take(codecs::MAX_EXTRA_SAMPLES) {
+        match native_plane_to_be(&e.data, bps) {
+            Ok(be) if be.len() == plane_len => {
+                data.extend(be);
+                added += 1;
+            }
+            _ => warnings.push("an extra TIFF sample did not match the image and was dropped".into()),
+        }
+    }
+    let channels = u16::try_from(img.layout().channels().saturating_add(added)).map_err(|_| IoError::Unsupported("too many channels".into()))?;
     let header = Header::new(isd.version, w, h, channels, depth, mode);
-    let data = planar_big_endian(&img, color_channels, mode == PsdMode::Cmyk)?;
     let image_data = ImageData { compression: Compression::Raw, data };
-    let file = isd.into_psd(header, resources, image_data);
+    let mut file = isd.into_psd(header, resources, image_data);
+    // Empty `Patt` and the default filter mask are written so Photoshop's block list matches
+    // a file it saved. They carry nothing the document stores, so they are not kept: a
+    // round trip would otherwise grow `metadata.psd_global_blocks` on every open.
+    file.global_blocks.retain(|b| {
+        let empty_pattern = matches!(&b.key, b"Patt" | b"Pat2" | b"Pat3") && b.data.is_empty();
+        let default_filter_mask = &b.key == b"FMsk" && b.data.as_slice() == FILTER_MASK_DEFAULT;
+        !empty_pattern && !default_filter_mask
+    });
     // The same nesting limit as opening a PSD (#2940).
     crate::psd_import::check_group_depth(&file)?;
+    // Spot planes are read in Photoshop's polarity (0 = solid ink), as from a PSD. The importer's
+    // rule for PSDs from earlier PhotoCraft versions never applies: those versions stored no
+    // extra samples in a TIFF, and a TIFF with them carries 1053.
     let (mut doc, w) = psd_to_document(&file);
     warnings.extend(w);
     doc.name = name.to_string();
@@ -200,18 +225,23 @@ pub(crate) fn export_layered(doc: &Document, opts: &ExportOptions, ctl: &photocr
     }
     let mut warnings = Vec::new();
     let big = doc.size.width > 30_000 || doc.size.height > 30_000;
-    // The PSD exporter renders the composite we need for the TIFF itself: unmatted (the TIFF
-    // keeps straight alpha) and uncompressed (its planes are interleaved below).
+    // The PSD exporter renders the composite we need for the TIFF itself, uncompressed (its
+    // planes are interleaved below). A spot (or any user channel) is saved the way Photoshop's
+    // TIFF dialog does with "Save Transparency" off: the composite is colour plus those
+    // channels, matted on white, and each layer keeps its own transparency. With no user
+    // channel the composite stays unmatted, straight RGBA, which is what a plain transparent
+    // TIFF already round-trips as.
     // Layer data is written PSD-style ("Adobe Photoshop Document Data Block", 4-byte lengths), as
     // Photoshop writes it: Photoshop does not read the PSB-style header ("... Data V0002") in a
     // TIFF and opens only the composite, as one locked Background. The exporter's switch to PSB
     // on the encoded file size is not used here: PSB-style data is written only past 30000 px,
     // when asked for, or when a length really overflows 32 bits.
+    let user_channels = !doc.channels.is_empty() || doc.quick_mask.is_some();
     let force_psb = opts.force_psb || big;
     let psd_opts = PsdExportOptions {
         force_psb,
         size_limit_psb: false,
-        merged_matte: false,
+        merged_matte: user_channels,
         merged_compression: Compression::Raw,
         maximize_compatibility: true,
         document_path: opts.document_path.clone(),
@@ -233,7 +263,7 @@ pub(crate) fn export_layered(doc: &Document, opts: &ExportOptions, ctl: &photocr
     ctl.check().map_err(|_| IoError::Cancelled)?;
     warnings.extend(w);
     let order = if codecs::tiff_writes_little_endian() { ByteOrder::Little } else { ByteOrder::Big };
-    let (layers, w) = match ImageSourceData::from_psd(&file).to_bytes(order) {
+    let (layers, w) = match tiff_image_source(doc, &file).to_bytes(order) {
         Err(photocraft_psd::PsdError::LimitExceeded(_)) if !force_psb => {
             let psb_opts = PsdExportOptions { force_psb: true, ..psd_opts };
             let (psb, w) = crate::with_span(ctl, 0.0, TIFF_MODEL_DONE, |ctl| crate::psd_export::document_to_psd_interruptible(doc, &psb_opts, ctl));
@@ -241,7 +271,7 @@ pub(crate) fn export_layered(doc: &Document, opts: &ExportOptions, ctl: &photocr
             warnings.extend(w);
             warnings.push("layer data exceeds 4 GB; written with PSB-sized lengths, which some readers do not open".into());
             file = psb;
-            ImageSourceData::from_psd(&file).to_bytes(order)?
+            tiff_image_source(doc, &file).to_bytes(order)?
         }
         r => r?,
     };
@@ -251,24 +281,60 @@ pub(crate) fn export_layered(doc: &Document, opts: &ExportOptions, ctl: &photocr
     // The profile and XMP are written as TIFF tags, not as resources. EXIF stays a resource
     // (1058), which the PSD importer reads back unchanged; a block rebuilt from the TIFF's own
     // Exif directory keeps only the Exif, GPS and descriptive tags.
-    let resources: Vec<ImageResource> = file.resources.iter().filter(|r| !matches!(r.id, ids::ICC_PROFILE | ids::XMP)).cloned().collect();
-    let resources = resources_to_bytes(&resources)?;
+    let mut resources: Vec<ImageResource> = file.resources.iter().filter(|r| !matches!(r.id, ids::ICC_PROFILE | ids::XMP)).cloned().collect();
 
     let fmt = doc.pixel_format();
     let cc = fmt.mode.color_channels();
     let has_alpha = file.layer_info.as_ref().is_some_and(|l| l.merged_alpha);
     let channels = cc + usize::from(has_alpha);
-    let extra = usize::from(file.header.channels).saturating_sub(channels);
-    if extra > 0 {
-        warnings.push(format!("{extra} alpha channel(s) are not written to TIFF (one transparency channel only)"));
+    let extra_n = usize::from(file.header.channels).saturating_sub(channels);
+    let kept = extra_n.min(codecs::MAX_EXTRA_SAMPLES);
+    if extra_n > kept {
+        warnings.push(format!("{extra_n} extra channels; TIFF keeps the first {kept}"));
     }
+    // With spot or alpha channels, the IFD image is colour + those channels. The merged
+    // transparency plane stays out of the IFD (see above); a file with no extra channels keeps
+    // it, so a plain transparent TIFF still opens with alpha.
+    let write_alpha = has_alpha && kept == 0;
+    // One identifier per extra sample actually stored. The PSD model's 1053 lists the merged
+    // transparency too, which the IFD leaves out next to extra samples, so it is not copied.
+    resources.retain(|r| r.id != crate::channel_map::ALPHA_IDENTIFIERS);
+    if kept > 0 {
+        resources.push(ImageResource::new(crate::channel_map::ALPHA_IDENTIFIERS, crate::channel_map::alpha_identifiers(false, kept)));
+    }
+    // Resource 1022 names a channel of the PSD merged image, which counts the transparency plane.
+    // The IFD below does not, so the id moves back by one.
+    if has_alpha
+        && kept > 0
+        && let Some(r) = resources.iter_mut().find(|r| r.id == crate::channel_map::QUICK_MASK_INFO)
+        && r.data.len() >= 2
+    {
+        let id = u16::from_be_bytes([r.data[0], r.data[1]]).saturating_sub(1);
+        let be = id.to_be_bytes();
+        r.data[0] = be[0];
+        r.data[1] = be[1];
+    }
+    // The name and DisplayInfo resources list the merged transparency plane first. The IFD
+    // leaves that plane out, so the resources must too: Photoshop pairs each name with the
+    // next sample past the colour channels.
+    if has_alpha && !write_alpha {
+        drop_merged_transparency(&mut resources);
+    }
+    // Past MAX_EXTRA_SAMPLES the TIFF stores only the first `kept` channels: the name and
+    // DisplayInfo resources describe just those, and a Quick Mask among the rest is dropped.
+    if extra_n > kept {
+        keep_first_channels(&mut resources, kept, cc);
+    }
+    let resources = resources_to_bytes(&resources)?;
+    let ifd_channels = cc + usize::from(write_alpha);
     let sample = csample(fmt.sample);
     let (w, h) = (doc.size.width, doc.size.height);
     let cmyk = fmt.mode == ColorMode::Cmyk;
-    let data = interleave(&file.image_data.data, w, h, channels, cc, sample, cmyk)?;
+    let data = interleave(&file.image_data.data, w, h, ifd_channels, cc, sample, cmyk)?;
+    let extras = native_extra_planes(&file.image_data.data, w, h, channels, kept, sample)?;
     ctl.check().map_err(|_| IoError::Cancelled)?;
     ctl.progress(TIFF_COMPOSITE_DONE);
-    let layout = layout_for(fmt.mode, has_alpha);
+    let layout = layout_for(fmt.mode, write_alpha);
     let mut img = Image::from_raw(w, h, layout, sample, data)?;
     img.icc = doc.icc_profile.as_ref().map(|i| i.to_vec());
     img.meta = codecs::Metadata {
@@ -281,11 +347,180 @@ pub(crate) fn export_layered(doc: &Document, opts: &ExportOptions, ctl: &photocr
         dpi: Some((doc.resolution_dpi, doc.resolution_dpi)),
         photoshop_resources: Some(resources),
         photoshop_layers: Some(layers),
+        extra_samples: extras,
         ..Default::default()
     };
     encode_image(&img, Format::Tiff, opts, warnings)
 }
 
+/// The layer data (`ImageSourceData`) of a layered TIFF saved from `file`, adjusted the way
+/// Photoshop writes it.
+fn tiff_image_source(doc: &Document, file: &photocraft_psd::PsdFile) -> ImageSourceData {
+    // Photoshop pairs alpha-name resources with samples past the colour channels and ignores
+    // the ExtraSamples kind. The merged transparency must not occupy that first slot when a
+    // spot is also stored. Layer transparency stays in each layer's channel −1.
+    let mut isd = ImageSourceData::from_psd(file);
+    let spot_extras = file.header.channels as usize > {
+        let cc = doc.pixel_format().mode.color_channels();
+        let alpha = file.layer_info.as_ref().is_some_and(|l| l.merged_alpha);
+        cc + usize::from(alpha)
+    };
+    // Positive layer count: the merged image's first extra sample is not transparency
+    // (Photoshop's own spot TIFF does this; a negative count would claim the spot plane is alpha).
+    if spot_extras && let Some(info) = &mut isd.layer_info {
+        info.merged_alpha = false;
+    }
+    // A merged-transparency marker kept from an opened file (Photoshop's `MTrn`) would make the
+    // first spot read back as transparency. The PSD export already drops it over an opaque
+    // composite; a transparent one keeps it there, but the TIFF leaves that sample out here.
+    if spot_extras {
+        isd.global_blocks.retain(|b| !b.is_merged_transparency_marker());
+    }
+    if let Some(info) = &mut isd.layer_info {
+        for layer in &mut info.layers {
+            // Photoshop sets flag bit 3 on every record it writes, group dividers included (299 of
+            // the 305 dividers in the corpus's Photoshop files). PhotoCraft's PSDs set it on
+            // layers only, unchanged here.
+            layer.flags.0 |= photocraft_psd::layer::LayerFlags::BIT4_USEFUL;
+            photoshop_layer_blocks(&mut layer.blocks);
+        }
+    }
+    // Photoshop reads a fixed 14-byte user-mask record from `LMsk` and an empty `Patt`
+    // before the filter mask. A zero-length `LMsk` is what makes it report that the
+    // layer data could not be read.
+    if let Some(mask) = &mut isd.global_layer_mask
+        && mask.data.len() < 14
+    {
+        *mask = photocraft_psd::GlobalLayerMask::photoshop_default();
+    }
+    if !isd.global_blocks.iter().any(|b| matches!(&b.key, b"Patt" | b"Pat2" | b"Pat3")) {
+        isd.global_blocks.insert(0, photocraft_psd::TaggedBlock::new(*b"Patt", Vec::new()));
+    }
+    if !isd.global_blocks.iter().any(|b| &b.key == b"FMsk") {
+        isd.global_blocks.push(photocraft_psd::TaggedBlock::new(*b"FMsk", FILTER_MASK_DEFAULT.to_vec()));
+    }
+    isd
+}
+
+/// Removes the leading transparency entry from the channel-name resources (1006, 1045) and
+/// from DisplayInfo (1077). Each is left unchanged when it is too short to hold that entry.
+fn drop_merged_transparency(resources: &mut [ImageResource]) {
+    for r in resources {
+        r.data = match r.id {
+            1006 => drop_first_pascal(&r.data),
+            1045 => drop_first_unicode(&r.data),
+            id if id == crate::channel_map::DISPLAY_INFO => drop_first_display_record(&r.data),
+            _ => continue,
+        };
+    }
+}
+
+fn drop_first_pascal(data: &[u8]) -> Vec<u8> {
+    let Some(&n) = data.first() else { return data.to_vec() };
+    let end = 1usize.saturating_add(usize::from(n));
+    data.get(end..).unwrap_or(data).to_vec()
+}
+
+fn drop_first_unicode(data: &[u8]) -> Vec<u8> {
+    let Some(nbe) = data.get(..4) else { return data.to_vec() };
+    let n = u32::from_be_bytes([nbe[0], nbe[1], nbe[2], nbe[3]]) as usize;
+    let end = 4usize.saturating_add(n.saturating_mul(2));
+    data.get(end..).unwrap_or(data).to_vec()
+}
+
+/// Trims the channel-name resources (1006, 1045) and DisplayInfo (1077) to their first `kept`
+/// entries, and drops Quick Mask info (1022) when its channel is not one of the `kept` extra
+/// samples, which start at sample `first_extra`. A resource too short for `kept` entries is
+/// left as it is.
+fn keep_first_channels(resources: &mut Vec<ImageResource>, kept: usize, first_extra: usize) {
+    for r in resources.iter_mut() {
+        r.data = match r.id {
+            1006 => first_pascal_names(&r.data, kept),
+            1045 => first_unicode_names(&r.data, kept),
+            id if id == crate::channel_map::DISPLAY_INFO => first_display_records(&r.data, kept),
+            _ => continue,
+        };
+    }
+    let end = first_extra.saturating_add(kept);
+    resources.retain(|r| r.id != crate::channel_map::QUICK_MASK_INFO || r.data.get(..2).is_none_or(|b| usize::from(u16::from_be_bytes([b[0], b[1]])) < end));
+}
+
+fn first_pascal_names(data: &[u8], n: usize) -> Vec<u8> {
+    let mut at = 0usize;
+    for _ in 0..n {
+        let Some(&len) = data.get(at) else { return data.to_vec() };
+        at = at.saturating_add(1).saturating_add(usize::from(len));
+    }
+    data.get(..at).unwrap_or(data).to_vec()
+}
+
+fn first_unicode_names(data: &[u8], n: usize) -> Vec<u8> {
+    let mut at = 0usize;
+    for _ in 0..n {
+        let Some(b) = data.get(at..at.saturating_add(4)) else { return data.to_vec() };
+        let len = u32::from_be_bytes([b[0], b[1], b[2], b[3]]) as usize;
+        at = at.saturating_add(4).saturating_add(len.saturating_mul(2));
+    }
+    data.get(..at).unwrap_or(data).to_vec()
+}
+
+/// Resource 1077: a 4-byte version, then 13-byte records. Keeps the first `n` records.
+fn first_display_records(data: &[u8], n: usize) -> Vec<u8> {
+    let end = 4usize.saturating_add(n.saturating_mul(13));
+    data.get(..end).unwrap_or(data).to_vec()
+}
+
+/// Resource 1077: a 4-byte version, then 13-byte records. Drops the first record.
+fn drop_first_display_record(data: &[u8]) -> Vec<u8> {
+    const RECORD: usize = 13;
+    if data.len() < 4 + RECORD {
+        return data.to_vec();
+    }
+    let mut out = Vec::with_capacity(data.len() - RECORD);
+    out.extend_from_slice(&data[..4]);
+    out.extend_from_slice(&data[4 + RECORD..]);
+    out
+}
+
+/// Filter-mask block (`FMsk`) Photoshop writes next to a layered TIFF: the same red 50%
+/// overlay as [`photocraft_psd::GlobalLayerMask::photoshop_default`], without the kind byte.
+const FILTER_MASK_DEFAULT: &[u8] = &[0, 0, 0xff, 0xff, 0, 0, 0, 0, 0, 0, 0, 50];
+
+/// Blocks Photoshop writes on every layer of a layered TIFF, when the layer does not
+/// already carry them. Defaults match a plain pixel layer (clipped-as-group on, nothing
+/// locked, no label).
+fn photoshop_layer_blocks(blocks: &mut Vec<photocraft_psd::TaggedBlock>) {
+    let has = |k: &[u8; 4]| blocks.iter().any(|b| &b.key == k);
+    let mut add = Vec::new();
+    if !has(b"lnsr") {
+        add.push(photocraft_psd::TaggedBlock::name_source(*b"layr"));
+    }
+    if !has(b"clbl") {
+        add.push(photocraft_psd::TaggedBlock::blend_clipped_as_group(true));
+    }
+    if !has(b"infx") {
+        add.push(photocraft_psd::TaggedBlock::blend_interior_elements(false));
+    }
+    if !has(b"knko") {
+        add.push(photocraft_psd::TaggedBlock::knockout(0));
+    }
+    if !has(b"lspf") {
+        add.push(photocraft_psd::TaggedBlock::protection(0));
+    }
+    if !has(b"lclr") {
+        add.push(photocraft_psd::TaggedBlock::sheet_color(0));
+    }
+    let at = blocks
+        .iter()
+        .position(|b| &b.key == b"lyid")
+        .map(|i| i + 1)
+        .or_else(|| blocks.iter().position(|b| &b.key == b"luni").map(|i| i + 1))
+        .unwrap_or(blocks.len());
+    for (i, block) in add.into_iter().enumerate() {
+        blocks.insert(at.saturating_add(i), block);
+    }
+}
+
 /// Removes the blocks a document kept verbatim from a little-endian TIFF because their layout
 /// is unknown ([`photocraft_psd::TaggedBlock::is_foreign_order`]) before `file` is written as a
 /// PSD: their bytes are in the wrong order for a PSD and cannot be converted. Returns a warning
@@ -315,6 +550,418 @@ pub fn strip_foreign_order_blocks(file: &mut photocraft_psd::PsdFile) -> Vec<Str
     warnings
 }
 
+/// Big-endian planar samples (a PSD merged-image plane) to native endian, or the reverse.
+fn swap_plane(src: &[u8], bps: usize, to_be: bool) -> Result<Vec<u8>, IoError> {
+    if bps == 1 {
+        return Ok(src.to_vec());
+    }
+    if !matches!(bps, 2 | 4) || !src.len().is_multiple_of(bps) {
+        return Err(IoError::Unsupported("an extra channel plane is incomplete".into()));
+    }
+    let mut out = Vec::with_capacity(src.len());
+    for c in src.chunks_exact(bps) {
+        match (bps, to_be, c) {
+            (2, true, [a, b]) => {
+                let v = u16::from_ne_bytes([*a, *b]);
+                out.extend_from_slice(&v.to_be_bytes());
+            }
+            (2, false, [a, b]) => {
+                let v = u16::from_be_bytes([*a, *b]);
+                out.extend_from_slice(&v.to_ne_bytes());
+            }
+            (4, true, [a, b, c, d]) => {
+                let v = f32::from_ne_bytes([*a, *b, *c, *d]);
+                out.extend_from_slice(&v.to_be_bytes());
+            }
+            (4, false, [a, b, c, d]) => {
+                let v = f32::from_be_bytes([*a, *b, *c, *d]);
+                out.extend_from_slice(&v.to_ne_bytes());
+            }
+            _ => return Err(IoError::Unsupported("an extra channel plane is incomplete".into())),
+        }
+    }
+    Ok(out)
+}
+
+/// Native-endian extra-sample plane → big-endian, for the PSD merged image a layered TIFF rebuilds.
+fn native_plane_to_be(src: &[u8], bps: usize) -> Result<Vec<u8>, IoError> {
+    swap_plane(src, bps, true)
+}
+
+/// Extra planes of a PSD merged image (`skip` colour-and-alpha planes already consumed), as
+/// native-endian TIFF extra samples. A spot plane is already Photoshop ink (0 = solid, max =
+/// paper); an alpha plane is already straight. Neither is inverted again here.
+fn native_extra_planes(planes: &[u8], w: u32, h: u32, skip: usize, count: usize, sample: CSample) -> Result<Vec<codecs::ExtraSample>, IoError> {
+    let bps = sample.bytes();
+    let n = (w as usize).checked_mul(h as usize).ok_or_else(|| IoError::Unsupported("image size overflows".into()))?;
+    let plane = n.checked_mul(bps).ok_or_else(|| IoError::Unsupported("image size overflows".into()))?;
+    let mut out = Vec::with_capacity(count);
+    for i in 0..count {
+        let at = skip.checked_add(i).and_then(|k| k.checked_mul(plane)).ok_or_else(|| IoError::Unsupported("image size overflows".into()))?;
+        let Some(src) = planes.get(at..at.saturating_add(plane)) else {
+            return Err(IoError::Unsupported("the merged image is missing an extra channel".into()));
+        };
+        if src.len() != plane {
+            return Err(IoError::Unsupported("the merged image is missing an extra channel".into()));
+        }
+        out.push(codecs::ExtraSample { kind: 0, data: swap_plane(src, bps, false)? });
+    }
+    Ok(out)
+}
+
+/// One grayscale channel as native-endian samples in `img`'s sample type.
+fn channel_plane(channel: &AlphaChannel, canvas: Rect, sample: CSample) -> Result<Vec<u8>, String> {
+    let depth = match sample {
+        CSample::U8 => SampleType::U8,
+        CSample::U16 => SampleType::U16,
+        CSample::F16 | CSample::F32 => SampleType::F32,
+    };
+    let fmt = PixelFormat::new(ColorMode::Grayscale, depth, false);
+    let owned;
+    let surface = if channel.surface.format() == fmt {
+        &channel.surface
+    } else {
+        owned = channel.surface.convert(fmt);
+        &owned
+    };
+    let mut bytes = surface.to_interleaved(canvas);
+    let n = (canvas.width() as usize).saturating_mul(canvas.height() as usize);
+    let expect = n.saturating_mul(depth.bytes());
+    if bytes.len() != expect {
+        return Err(format!("channel \"{}\" does not cover the canvas", channel.name));
+    }
+    if channel.spot.is_some() {
+        crate::channel_map::photoshop_spot_plane(&mut bytes, depth);
+    }
+    if sample == CSample::F16 {
+        let mut out = Vec::with_capacity(n.saturating_mul(2));
+        for arr in bytes.as_chunks::<4>().0 {
+            let v = f32::from_ne_bytes(*arr);
+            out.extend_from_slice(&codecs::f16::from_f32(v).to_ne_bytes());
+        }
+        return Ok(out);
+    }
+    Ok(bytes)
+}
+
+/// Composites straight alpha over white and drops it. Photoshop's TIFF save with
+/// "Save Transparency" off stores that matte in the colour samples and keeps transparency
+/// only inside each layer. Fully opaque pixels are copied unchanged, so they stay identical
+/// to a composite that was quantized before the matte. `false` when there is no alpha or
+/// the buffer is not one sample per channel.
+fn matte_and_drop_alpha(img: &mut Image) -> bool {
+    if !img.layout().has_alpha() {
+        return false;
+    }
+    let (w, h) = img.dimensions();
+    let sample = img.sample_type();
+    let dst = img.layout().without_alpha();
+    let bps = sample.bytes();
+    let keep = dst.channels().saturating_mul(bps);
+    let stride = img.layout().channels().saturating_mul(bps);
+    if stride == 0 || keep == 0 || bps == 0 || stride <= keep || !img.data().len().is_multiple_of(stride) {
+        return false;
+    }
+    let cmyk = img.layout().is_cmyk();
+    let white_byte: u8 = if cmyk { 0 } else { 255 };
+    let white_u16: u16 = if cmyk { 0 } else { u16::MAX };
+    let white_f: f32 = if cmyk { 0.0 } else { 1.0 };
+    // Lab's white is L* 100 with a* and b* 0, which PhotoCraft holds mid-range (`(0 + 128) / 255`).
+    let lab = img.layout().is_lab();
+    let mut out = Vec::with_capacity(img.data().len() / stride * keep);
+    for px in img.data().chunks_exact(stride) {
+        let Some(color) = px.get(..keep) else { return false };
+        let Some(alpha) = px.get(keep..keep.saturating_add(bps)) else { return false };
+        let ok = if lab {
+            let (Some(l), Some(ab)) = (color.get(..bps), color.get(bps..)) else { return false };
+            matte_pixel(sample, l, alpha, white_byte, white_u16, white_f, &mut out) && matte_pixel(sample, ab, alpha, 128, 128 * 257, 128.0 / 255.0, &mut out)
+        } else {
+            matte_pixel(sample, color, alpha, white_byte, white_u16, white_f, &mut out)
+        };
+        if !ok {
+            return false;
+        }
+    }
+    let icc = img.icc.clone();
+    let meta = img.meta.clone();
+    let warnings = img.warnings.clone();
+    let Ok(mut next) = Image::from_raw(w, h, dst, sample, out) else { return false };
+    next.icc = icc;
+    next.meta = meta;
+    next.warnings = warnings;
+    *img = next;
+    true
+}
+
+/// One pixel of [`matte_and_drop_alpha`]. Opaque samples are copied; a clear pixel becomes
+/// `white`; anything in between is `c·a + white·(1−a)` in normalized space.
+fn matte_pixel(sample: CSample, color: &[u8], alpha: &[u8], white_byte: u8, white_u16: u16, white_f: f32, out: &mut Vec<u8>) -> bool {
+    match sample {
+        CSample::U8 => {
+            let Some(&a) = alpha.first() else { return false };
+            if a == 255 {
+                out.extend_from_slice(color);
+            } else if a == 0 {
+                out.resize(out.len().saturating_add(color.len()), white_byte);
+            } else {
+                let af = f32::from(a) / 255.0;
+                for &c in color {
+                    let m = crate::pixels::matte(f32::from(c) / 255.0, af, white_f);
+                    out.push((m.clamp(0.0, 1.0) * 255.0).round() as u8);
+                }
+            }
+        }
+        CSample::U16 => {
+            let Some(a) = ne_u16(alpha) else { return false };
+            if a == u16::MAX {
+                out.extend_from_slice(color);
+            } else if a == 0 {
+                for _ in 0..color.len() / 2 {
+                    out.extend_from_slice(&white_u16.to_ne_bytes());
+                }
+            } else {
+                let af = f32::from(a) / 65535.0;
+                for pair in color.as_chunks::<2>().0 {
+                    let c = u16::from_ne_bytes(*pair);
+                    let m = crate::pixels::matte(f32::from(c) / 65535.0, af, white_f);
+                    out.extend_from_slice(&((m.clamp(0.0, 1.0) * 65535.0).round() as u16).to_ne_bytes());
+                }
+            }
+        }
+        CSample::F32 => {
+            let Some(a) = ne_f32(alpha) else { return false };
+            if a == 1.0 {
+                out.extend_from_slice(color);
+            } else if a == 0.0 || !a.is_finite() {
+                for _ in 0..color.len() / 4 {
+                    out.extend_from_slice(&white_f.to_ne_bytes());
+                }
+            } else {
+                let af = a.clamp(0.0, 1.0);
+                for quad in color.as_chunks::<4>().0 {
+                    let m = crate::pixels::matte(f32::from_ne_bytes(*quad), af, white_f);
+                    out.extend_from_slice(&m.to_ne_bytes());
+                }
+            }
+        }
+        CSample::F16 => {
+            let Some(bits) = ne_u16(alpha) else { return false };
+            let a = codecs::f16::from_bits(bits).to_f32();
+            if a == 1.0 {
+                out.extend_from_slice(color);
+            } else if a == 0.0 || !a.is_finite() {
+                let w = codecs::f16::from_f32(white_f).to_bits().to_ne_bytes();
+                for _ in 0..color.len() / 2 {
+                    out.extend_from_slice(&w);
+                }
+            } else {
+                let af = a.clamp(0.0, 1.0);
+                for pair in color.as_chunks::<2>().0 {
+                    let c = codecs::f16::from_bits(u16::from_ne_bytes(*pair)).to_f32();
+                    let m = codecs::f16::from_f32(crate::pixels::matte(c, af, white_f)).to_bits();
+                    out.extend_from_slice(&m.to_ne_bytes());
+                }
+            }
+        }
+    }
+    true
+}
+
+fn ne_u16(b: &[u8]) -> Option<u16> {
+    let arr: [u8; 2] = b.get(..2)?.try_into().ok()?;
+    Some(u16::from_ne_bytes(arr))
+}
+
+fn ne_f32(b: &[u8]) -> Option<f32> {
+    let arr: [u8; 4] = b.get(..4)?.try_into().ok()?;
+    Some(f32::from_ne_bytes(arr))
+}
+
+/// Writes alpha and spot channels (and a Quick Mask) into a flat TIFF: extra samples in the
+/// IFD, plus Photoshop resources for the name, ink colour and solidity. At most
+/// [`codecs::MAX_EXTRA_SAMPLES`] are kept. A TIFF with no extra channels is left unchanged.
+/// When any are written, the composite's own transparency is left out of the IFD: readers pair
+/// the channel resources with every sample past the colour channels, in order.
+pub(crate) fn stamp_flat_channels(doc: &Document, img: &mut Image) -> Vec<String> {
+    let total = doc.channels.len().saturating_add(usize::from(doc.quick_mask.is_some()));
+    if total == 0 {
+        return Vec::new();
+    }
+    let mut warnings = Vec::new();
+    let (w, h) = img.dimensions();
+    if w != doc.size.width || h != doc.size.height {
+        warnings.push("extra channels were not written: the image size differs from the document".into());
+        return warnings;
+    }
+    let max = codecs::MAX_EXTRA_SAMPLES;
+    let mut picked: Vec<&AlphaChannel> = doc.channels.iter().take(max).collect();
+    if let Some(q) = &doc.quick_mask
+        && picked.len() < max
+    {
+        picked.push(q);
+    }
+    if total > picked.len() {
+        warnings.push(format!("{total} extra channels; TIFF keeps the first {}", picked.len()));
+    }
+    let canvas = Rect::new(0, 0, w as i32, h as i32);
+    let mut planes = Vec::with_capacity(picked.len());
+    for ch in &picked {
+        match channel_plane(ch, canvas, img.sample_type()) {
+            Ok(data) => planes.push(data),
+            Err(msg) => {
+                warnings.push(msg);
+                break;
+            }
+        }
+    }
+    picked.truncate(planes.len());
+    if picked.is_empty() {
+        return warnings;
+    }
+    let names: Vec<&str> = picked.iter().map(|c| c.name.as_str()).collect();
+    let quick_last = matches!((picked.last(), doc.quick_mask.as_ref()), (Some(p), Some(q)) if std::ptr::eq(*p, q));
+    let color_channels = img.layout().color_channels();
+    // Save Transparency off: the colour samples are the composite over white, and the
+    // alpha plane is not an extra sample (it would be named as the first spot). The
+    // composite transparency is gone after this; say so, because the user did not pick
+    // that option themselves.
+    if img.layout().has_alpha() {
+        if !matte_and_drop_alpha(img) {
+            warnings.push("extra channels were not written: the composite transparency could not be separated from them".into());
+            return warnings;
+        }
+        warnings.push(
+            "transparency composited over white; a TIFF with alpha or spot channels stores them as extra samples and drops image transparency (Save Transparency off)"
+                .into(),
+        );
+    }
+    let quick_id = if quick_last { u16::try_from(color_channels.saturating_add(picked.len()).saturating_sub(1)).ok() } else { None };
+    match channel_resources(img.meta.photoshop_resources.as_deref(), &names, &picked, quick_id) {
+        Ok(bytes) => img.meta.photoshop_resources = Some(bytes),
+        Err(e) => warnings.push(format!("spot channel options were not written to the TIFF: {e}")),
+    }
+    img.meta.extra_samples = planes.into_iter().map(|data| codecs::ExtraSample { kind: 0, data }).collect();
+    warnings
+}
+
+/// Existing Photoshop resources with the channel-name, display-info and quick-mask blocks replaced.
+fn channel_resources(existing: Option<&[u8]>, names: &[&str], channels: &[&AlphaChannel], quick_id: Option<u16>) -> Result<Vec<u8>, IoError> {
+    let mut resources = match existing.filter(|b| !b.is_empty()) {
+        Some(b) => resources_from_bytes(b)?.0,
+        None => Vec::new(),
+    };
+    resources.retain(|r| {
+        !matches!(r.id, 1006 | 1045 | crate::channel_map::DISPLAY_INFO | crate::channel_map::QUICK_MASK_INFO | crate::channel_map::ALPHA_IDENTIFIERS)
+    });
+    resources.push(ImageResource::new(1006, crate::psd_export::pascal_names_resource(names)));
+    resources.push(ImageResource::new(1045, crate::psd_export::unicode_names_resource(names)));
+    resources.push(ImageResource::new(crate::channel_map::DISPLAY_INFO, crate::channel_map::display_info(channels, false)));
+    resources.push(ImageResource::new(crate::channel_map::ALPHA_IDENTIFIERS, crate::channel_map::alpha_identifiers(false, names.len())));
+    if let Some(id) = quick_id {
+        let mut data = id.to_be_bytes().to_vec();
+        data.push(0);
+        resources.push(ImageResource::new(crate::channel_map::QUICK_MASK_INFO, data));
+    }
+    Ok(resources_to_bytes(&resources)?)
+}
+
+/// Extra samples of a flat TIFF become alpha / spot channels. Layered TIFFs rebuild those
+/// through the PSD importer instead, so this is only for a file with no layer tag.
+pub(crate) fn channels_from_extras(doc: &mut Document, img: &Image) -> Vec<String> {
+    if img.meta.extra_samples.is_empty() {
+        return Vec::new();
+    }
+    let mut warnings = Vec::new();
+    let (w, h) = img.dimensions();
+    if w != doc.size.width || h != doc.size.height {
+        warnings.push("extra TIFF samples were dropped: their size differs from the image".into());
+        return warnings;
+    }
+    let parsed = img.meta.photoshop_resources.as_deref().filter(|b| !b.is_empty()).and_then(|b| resources_from_bytes(b).ok());
+    let none = Vec::new();
+    let resources = parsed.as_ref().map(|(r, _)| r.as_slice()).unwrap_or(&none);
+    let all_names = resources.iter().find(|r| r.id == 1045).map(|r| crate::psd_import::unicode_names(&r.data)).unwrap_or_default();
+    // As in the PSD importer: Photoshop lists the image transparency first ("Transparency", with
+    // its own display record), ahead of the channels the extra samples hold.
+    let skip = usize::from(img.layout().has_alpha() && all_names.len() == img.meta.extra_samples.len().saturating_add(1));
+    let names = all_names.get(skip..).unwrap_or_default();
+    let spots = if let Some(r) = resources.iter().find(|r| r.id == crate::channel_map::DISPLAY_INFO) {
+        crate::channel_map::spot_flags(&r.data, true, skip)
+    } else if let Some(r) = resources.iter().find(|r| r.id == crate::channel_map::DISPLAY_INFO_OLD) {
+        crate::channel_map::spot_flags(&r.data, false, skip)
+    } else {
+        Vec::new()
+    };
+    let start = doc.channels.len();
+    let n_px = (w as usize).saturating_mul(h as usize);
+    for (k, e) in img.meta.extra_samples.iter().take(codecs::MAX_EXTRA_SAMPLES).enumerate() {
+        let spot = spots.get(k).copied().unwrap_or(false);
+        match mask_from_plane(&e.data, w, h, n_px, img.sample_type(), doc.depth, spot) {
+            Ok(surface) => {
+                let name = names.get(k).cloned().filter(|s| !s.is_empty()).unwrap_or_else(|| format!("Alpha {}", k + 1));
+                doc.channels.push(AlphaChannel::new(name, surface));
+            }
+            Err(msg) => warnings.push(msg),
+        }
+    }
+    if doc.channels.len() == start {
+        return warnings;
+    }
+    {
+        let slice = &mut doc.channels[start..];
+        if let Some(r) = resources.iter().find(|r| r.id == crate::channel_map::DISPLAY_INFO) {
+            crate::channel_map::apply_display_info(&r.data, true, skip, slice);
+        } else if let Some(r) = resources.iter().find(|r| r.id == crate::channel_map::DISPLAY_INFO_OLD) {
+            crate::channel_map::apply_display_info(&r.data, false, skip, slice);
+        }
+    }
+    let first = img.layout().color_channels().saturating_add(usize::from(img.layout().has_alpha()));
+    if let Some(r) = resources.iter().find(|r| r.id == crate::channel_map::QUICK_MASK_INFO)
+        && r.data.len() >= 2
+        && let Some(k) = usize::from(u16::from_be_bytes([r.data[0], r.data[1]])).checked_sub(first)
+        && start.saturating_add(k) < doc.channels.len()
+    {
+        doc.quick_mask = Some(doc.channels.remove(start + k));
+    }
+    warnings
+}
+
+/// Native-endian extra-sample bytes → a grayscale surface at the document depth.
+/// `photoshop_spot`: the sample is a spot channel in Photoshop's polarity (0 = solid ink).
+fn mask_from_plane(data: &[u8], w: u32, h: u32, n: usize, from: CSample, depth: SampleType, photoshop_spot: bool) -> Result<Surface, String> {
+    let rect = Rect::new(0, 0, w as i32, h as i32);
+    let mut bytes = match (from, depth) {
+        (CSample::U8, SampleType::U8) | (CSample::U16, SampleType::U16) | (CSample::F32, SampleType::F32) => {
+            if data.len() != n.saturating_mul(from.bytes()) {
+                return Err("an extra TIFF sample did not match the image and was dropped".into());
+            }
+            data.to_vec()
+        }
+        (CSample::F16, SampleType::F32) => {
+            if data.len() != n.saturating_mul(2) {
+                return Err("an extra TIFF sample did not match the image and was dropped".into());
+            }
+            let mut out = Vec::with_capacity(n.saturating_mul(4));
+            for arr in data.as_chunks::<2>().0 {
+                let v = codecs::f16::from_bits(u16::from_ne_bytes(*arr)).to_f32();
+                out.extend_from_slice(&v.to_ne_bytes());
+            }
+            out
+        }
+        _ => return Err(format!("an extra TIFF sample ({from:?}) does not match the document depth and was dropped")),
+    };
+    if photoshop_spot {
+        crate::channel_map::photoshop_spot_plane(&mut bytes, depth);
+    }
+    if bytes.len() != n.saturating_mul(depth.bytes()) {
+        return Err("an extra TIFF sample did not match the image and was dropped".into());
+    }
+    let mut s = Surface::new(PixelFormat::new(ColorMode::Grayscale, depth, false));
+    s.write_interleaved(rect, &bytes);
+    s.prune();
+    Ok(s)
+}
+
 #[cfg(test)]
 mod tests {
     use photocraft_doc::{Color, Document, Fill, FillCache, Layer, LayerContent};
diff --git a/crates/io/tests/it/corpus.rs b/crates/io/tests/it/corpus.rs
index b7695d451a..182d60095a 100644
--- a/crates/io/tests/it/corpus.rs
+++ b/crates/io/tests/it/corpus.rs
@@ -154,7 +154,7 @@ const MIXED: Source = Source { label: "io corpus", dir: "corpus/psd", group_dept
 /// 226 vs the merged image + 10 vs the thumbnail (Advanced Blending knockouts: +7).
 const PSD_TOOLS: Source = Source { label: "psd-tools corpus", dir: "corpus/psd-tools", group_depth: 0, pass_floor: 249, roundtrip_floor: 308 };
 
-/// Our Photoshop-authored oracles (256 files; https://github.com/storytold/photocraft-corpus),
+/// Our Photoshop-authored oracles (258 files; https://github.com/storytold/photocraft-corpus),
 /// grouped by feature (`smart-filters`, `effects`, `text`, `adjustments/<mode><bits>`).
 const PHOTOSHOP: Source = Source { label: "photoshop oracles", dir: "corpus/photoshop", group_depth: 2, pass_floor: 190, roundtrip_floor: 258 };
 
diff --git a/crates/io/tests/it/flat.rs b/crates/io/tests/it/flat.rs
index 353e2bbb7a..f6e888eb06 100644
--- a/crates/io/tests/it/flat.rs
+++ b/crates/io/tests/it/flat.rs
@@ -59,6 +59,7 @@ codec_rt!(dpx_rgba16, "dpx", ColorMode::Rgb, SampleType::U16, true, 0.0);
 // Cineon stores 10-bit code values: within half a 10-bit step.
 codec_rt!(cin_gray16, "cin", ColorMode::Grayscale, SampleType::U16, false, 0.5 / 1023.0);
 codec_rt!(cin_rgb16, "cin", ColorMode::Rgb, SampleType::U16, false, 0.5 / 1023.0);
+codec_rt!(iff_rgb8_opaque, "iff", ColorMode::Rgb, SampleType::U8, false, 0.0);
 
 fn indexed_bmp_8() -> Vec<u8> {
     const FILE_HEADER_SIZE: usize = 14;
@@ -1190,3 +1191,39 @@ fn a_stereo_png_keeps_its_stereo_mark_on_save() {
     let plain = export(&single(ColorMode::Rgb, SampleType::U8, false), "png", &ExportOptions::default()).unwrap();
     assert_eq!(photocraft_codecs::png_stereo(&plain.bytes), None);
 }
+
+/// #8563: a DDS export writes the document's alpha channel as the texture's alpha, as a 32-bit
+/// Targa does: exactly in an uncompressed texture, to 4 bits in BC2, interpolated in BC3, and on
+/// or off in BC1. With several alpha channels none is written, with a warning.
+#[test]
+fn dds_writes_the_alpha_channel_as_the_texture_alpha() {
+    use photocraft_codecs::DdsCompression;
+    let d = with_alpha_channel(single(ColorMode::Rgb, SampleType::U8, false), "Alpha 1");
+    for compression in DdsCompression::ALL {
+        let mut opts = ExportOptions::default();
+        opts.encode.dds.compression = compression;
+        let r = export(&d, "a.dds", &opts).unwrap();
+        let img = photocraft_codecs::decode(&r.bytes).expect("decode dds");
+        assert_eq!(img.layout(), photocraft_codecs::ChannelLayout::Rgba, "{compression:?}");
+        let (w, _) = img.dimensions();
+        let tolerance = match compression {
+            DdsCompression::None => 1.0,
+            DdsCompression::Bc2 => 9.0,
+            _ => 18.0,
+        };
+        for (i, px) in img.data().as_chunks::<4>().0.iter().enumerate() {
+            let x = i as u32 % w;
+            let want = alpha_value(x) * 255.0;
+            if compression == DdsCompression::Bc1 && x == 4 {
+                continue; // half opacity sits on BC1's on/off threshold
+            }
+            assert!((f32::from(px[3]) - want).abs() <= tolerance, "{compression:?} pixel {i}: alpha {} want {want}", px[3]);
+        }
+    }
+    // Two alpha channels: Photoshop's rule for Targa, none of them is written.
+    let two = with_alpha_channel(d.clone(), "Alpha 2");
+    let r = export(&two, "a.dds", &ExportOptions::default()).unwrap();
+    assert!(r.warnings.iter().any(|w| w.contains("several")), "{:?}", r.warnings);
+    let img = photocraft_codecs::decode(&r.bytes).expect("decode dds");
+    assert!(!img.layout().has_alpha() || img.data().as_chunks::<4>().0.iter().all(|p| p[3] == 255));
+}
diff --git a/crates/io/tests/it/psd16_merged_transparency.rs b/crates/io/tests/it/psd16_merged_transparency.rs
index 82b054e873..03030e557c 100644
--- a/crates/io/tests/it/psd16_merged_transparency.rs
+++ b/crates/io/tests/it/psd16_merged_transparency.rs
@@ -43,7 +43,7 @@ fn resave_keeps_a_name_marked_merged_transparency() {
             // transparency named in the alpha channel names.
             let mut ps = ours.clone();
             ps.layer_info.as_mut().expect("layers").merged_alpha = false;
-            ps.global_blocks.retain(|b| !matches!(&b.key, b"Mtrn" | b"Mt16" | b"Mt32"));
+            ps.global_blocks.retain(|b| !b.is_merged_transparency_marker());
             assert!(!ps.merged_has_alpha(), "{case}: nothing marks it yet");
             let name: Vec<u8> = [0u8, 0, 0, 13].into_iter().chain("Transparency\0".encode_utf16().flat_map(u16::to_be_bytes)).collect();
             ps.resources.retain(|r| !matches!(r.id, 1006 | 1045));
diff --git a/crates/io/tests/it/psd_kerning.rs b/crates/io/tests/it/psd_kerning.rs
index ad492fce25..8b85c4f3ba 100644
--- a/crates/io/tests/it/psd_kerning.rs
+++ b/crates/io/tests/it/psd_kerning.rs
@@ -228,7 +228,7 @@ fn add_type_layer(objects: &[(&str, &str)], kept: &[(&str, i32)], at: usize) ->
             (l.name.clone(), index, t.char_runs().iter().flat_map(|r| r.style.features.iter().filter(|f| f.tag != "calt").map(|f| f.tag.clone())).collect())
         })
         .collect();
-    let hi = layers.iter().find(|l| l.0 == "Hi").and_then(|l| l.1).unwrap() as usize;
+    let hi = usize::try_from(layers.iter().find(|l| l.0 == "Hi").and_then(|l| l.1).unwrap()).unwrap();
     let run = txt2.path(&["1", "1"]).and_then(E::as_array).unwrap()[hi].path(&["0", "6", "0"]).and_then(E::as_array).unwrap()[0].clone();
     (layers, run)
 }
diff --git a/crates/io/tests/it/raw.rs b/crates/io/tests/it/raw.rs
index 2927634993..52250c24d7 100644
--- a/crates/io/tests/it/raw.rs
+++ b/crates/io/tests/it/raw.rs
@@ -22,6 +22,28 @@ fn dng_opens_as_16_bit_prophoto() {
     assert!(r.warnings.iter().any(|w| w.contains("DNG") && w.contains("ProPhoto")), "{:?}", r.warnings);
 }
 
+/// #8125: a lossy DNG's floating-point LinearRaw data, JPEG XL-compressed, is developed (not
+/// replaced by a preview). The test codestream is an integer one the reader takes as floats.
+#[test]
+fn floating_point_jpeg_xl_dng_is_developed() {
+    use photocraft_raw::testgen::DngStorage;
+    use zune_core::{bit_depth::BitDepth, colorspace::ColorSpace, options::EncoderOptions};
+    let (w, h) = (24, 16);
+    let data: Vec<u16> = scene(w, h).iter().flat_map(|p| p.map(|v| (v * 20000.0) as u16)).collect();
+    let bytes: Vec<u8> = data.iter().flat_map(|v| v.to_ne_bytes()).collect();
+    let mut segment = Vec::new();
+    zune_jpegxl::JxlSimpleEncoder::new(&bytes, EncoderOptions::new(w, h, ColorSpace::RGB, BitDepth::Sixteen)).encode(&mut segment).unwrap();
+    let mut spec = DngSpec::cfa(w, h, data);
+    spec.samples = 3;
+    spec.white = 0;
+    spec.storage = DngStorage::JxlStrips { rows: h };
+    spec.jxl_segments = vec![segment];
+    spec.raw_extra = vec![(339, Val::Short(vec![3; 3]))];
+    let r = import("lossy.dng", &spec.build()).unwrap();
+    assert_eq!((r.document.size.width, r.document.size.height, r.document.depth), (24, 16, SampleType::U16));
+    assert!(r.warnings.iter().all(|w| !w.contains("preview")), "{:?}", r.warnings);
+}
+
 /// #3497: a monochrome (one-sample LinearRaw) DNG, as VueScan writes film scans, opens as a
 /// 16-bit RGB document (neutral grey) instead of failing as unsupported.
 #[test]
@@ -194,6 +216,79 @@ fn unsupported_raw_falls_back_to_the_embedded_preview() {
     assert!(r.warnings.first().is_some_and(|w| w.contains("Nikon compressed NEF") && w.contains("embedded")), "{:?}", r.warnings);
 }
 
+/// A DNG 1.7 laid out as converters write one with JPEG XL raw data: an 8×6 JPEG thumbnail in
+/// IFD0, raw data this reader refuses (here floating-point LinearRaw), and a 40×30 preview
+/// compressed with JPEG XL, stored as the raw is (IFD0 Orientation 6).
+fn dng_with_jxl_preview() -> Vec<u8> {
+    use zune_core::{bit_depth::BitDepth, colorspace::ColorSpace, options::EncoderOptions};
+    let thumb = Image::from_u8(8, 6, ChannelLayout::Rgb, vec![90; 8 * 6 * 3]).unwrap();
+    let thumb = photocraft_codecs::encode(&thumb, Format::Jpeg, &EncodeOptions::default()).unwrap();
+    let (w, h) = (40usize, 30usize);
+    let rgb: Vec<u8> = (0..w * h).flat_map(|i| [(i % w * 6) as u8, (i / w * 8) as u8, 120]).collect();
+    let mut preview = Vec::new();
+    zune_jpegxl::JxlSimpleEncoder::new(&rgb, EncoderOptions::new(w, h, ColorSpace::RGB, BitDepth::Eight)).encode(&mut preview).unwrap();
+    let mut t = TiffBuilder::default();
+    let raw_strip = t.blob(vec![0; 4 * 4 * 3 * 2]);
+    let raw = t.ifd(vec![
+        (254, Val::Long(vec![0])),
+        (256, Val::Long(vec![4])),
+        (257, Val::Long(vec![4])),
+        (258, Val::Short(vec![16, 16, 16])),
+        (259, Val::Short(vec![1])),
+        (262, Val::Short(vec![34892])),
+        (273, Val::Blobs(vec![raw_strip])),
+        (277, Val::Short(vec![3])),
+        (278, Val::Long(vec![4])),
+        (279, Val::Long(vec![4 * 4 * 3 * 2])),
+        (339, Val::Short(vec![3, 3, 3])),
+    ]);
+    let preview_len = preview.len() as u32;
+    let preview_strip = t.blob(preview);
+    let preview = t.ifd(vec![
+        (254, Val::Long(vec![1])),
+        (256, Val::Long(vec![w as u32])),
+        (257, Val::Long(vec![h as u32])),
+        (258, Val::Short(vec![8, 8, 8])),
+        (259, Val::Short(vec![52546])),
+        (262, Val::Short(vec![2])),
+        (273, Val::Blobs(vec![preview_strip])),
+        (277, Val::Short(vec![3])),
+        (278, Val::Long(vec![h as u32])),
+        (279, Val::Long(vec![preview_len])),
+        (50970, Val::Long(vec![2])),
+    ]);
+    let thumb_len = thumb.len() as u32;
+    let thumb_strip = t.blob(thumb);
+    let ifd0 = t.ifd(vec![
+        (254, Val::Long(vec![1])),
+        (256, Val::Long(vec![8])),
+        (257, Val::Long(vec![6])),
+        (258, Val::Short(vec![8, 8, 8])),
+        (259, Val::Short(vec![7])),
+        (262, Val::Short(vec![6])),
+        (271, Val::Ascii("Synthetic".into())),
+        (273, Val::Blobs(vec![thumb_strip])),
+        (274, Val::Short(vec![6])),
+        (277, Val::Short(vec![3])),
+        (278, Val::Long(vec![6])),
+        (279, Val::Long(vec![thumb_len])),
+        (330, Val::Ifds(vec![raw, preview])),
+        (50706, Val::Byte(vec![1, 7, 0, 0])),
+    ]);
+    t.chain = vec![ifd0];
+    t.build()
+}
+
+/// #8125: a DNG whose raw data isn't supported opens its full JPEG XL preview, upright, not
+/// the small JPEG thumbnail.
+#[test]
+fn unsupported_dng_falls_back_to_its_jpeg_xl_preview() {
+    let r = import("photo.dng", &dng_with_jxl_preview()).unwrap();
+    assert_eq!((r.document.size.width, r.document.size.height), (30, 40), "the 40×30 preview, turned upright: {:?}", r.warnings);
+    let w = r.warnings.first().map_or("", String::as_str);
+    assert!(w.contains("floating-point") && w.contains("40x30 JPEG XL preview"), "{:?}", r.warnings);
+}
+
 #[test]
 fn unsupported_raw_without_preview_is_a_clear_error() {
     let mut cr3 = vec![0, 0, 0, 24];
diff --git a/crates/io/tests/it/text_corpus.rs b/crates/io/tests/it/text_corpus.rs
index 8597ac49d8..32e914d051 100644
--- a/crates/io/tests/it/text_corpus.rs
+++ b/crates/io/tests/it/text_corpus.rs
@@ -169,6 +169,107 @@ fn corpus_photoshop_txt2_survives_an_unedited_save() {
     println!("Txt2 kept byte-for-byte in {checked} Photoshop type files");
 }
 
+/// #7962: Photoshop's type on a path (`Txt2` frames, EngineData calls it a text box) opens on its
+/// path, at the anchors the generator gave Photoshop; the circle re-renders where Photoshop drew
+/// it; and a save after an edit (new text, a moved path) reopens on the layer's path.
+#[cfg(feature = "corpus")]
+#[test]
+fn corpus_photoshop_path_text_opens_on_its_path() {
+    use photocraft_doc::text::TextShape;
+    use photocraft_geom::Point;
+    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../corpus/photoshop/text");
+    let k = 0.5522847498 * 96.0;
+    let cases: [(&str, bool, Vec<[f64; 2]>); 2] = [
+        // Photoshop sets the type from the closed path's last anchor (the bottom).
+        ("path-circle.psd", true, vec![[128.0, 224.0], [32.0, 128.0], [128.0, 32.0], [224.0, 128.0]]),
+        ("path-wave-open.psd", false, vec![[16.0, 100.0], [160.0, 80.0], [304.0, 60.0]]),
+    ];
+    let mut engine = photocraft_text::TextEngine::with_system_fonts();
+    for (file, closed, anchors) in cases {
+        let f = root.join(file);
+        let bytes = std::fs::read(&f).unwrap_or_else(|e| panic!("{}: {e}: run `cargo xtask corpus --photoshop`", f.display()));
+        let imp = photocraft_io::import(file, &bytes).unwrap();
+        assert!(!imp.warnings.iter().any(|w| w.contains("type path")), "{file}: {:?}", imp.warnings);
+        let doc = imp.document;
+        let mut all = Vec::new();
+        walk(&doc.layers, &mut all);
+        let layer = all.iter().find(|l| matches!(l.content, LayerContent::Text(_))).unwrap();
+        let LayerContent::Text(t) = &layer.content else { unreachable!() };
+        let doc_anchors = |t: &photocraft_doc::TextLayer| -> Vec<Point> {
+            let TextShape::Path { path, start, flip } = &t.shape else { panic!("{file}: not path text: {:?}", t.shape) };
+            assert_eq!((path.closed, *start, *flip), (closed, 0.0, false), "{file}");
+            path.knots.iter().map(|k| t.transform.apply(k.anchor)).collect()
+        };
+        let got = doc_anchors(t);
+        assert_eq!(got.len(), anchors.len(), "{file}");
+        for (g, [x, y]) in got.iter().zip(&anchors) {
+            assert!((g.x - x).abs() < 1e-3 && (g.y - y).abs() < 1e-3, "{file}: anchor {g:?}, want ({x}, {y})");
+        }
+        if closed {
+            // The circle's handles are the generator's (kappa × r), so the path is the circle.
+            let TextShape::Path { path, .. } = &t.shape else { unreachable!() };
+            let h = t.transform.apply(path.knots[0].out_ctrl);
+            assert!((h.x - (128.0 - k)).abs() < 1e-3 && (h.y - 224.0).abs() < 1e-3, "{file}: handle {h:?}");
+        }
+
+        // Photoshop's pixels (the wave's EngineData text is blank: Photoshop drew nothing).
+        if let Some(ps) = t.cache.as_ref().filter(|c| !c.content_bounds().is_empty()) {
+            let ps_rect = ps.content_bounds();
+            let (_, ours) = engine.render(t, doc.resolution_dpi, doc.pixel_format());
+            let our_rect = ours.surface.content_bounds();
+            let u = Rect::new(ps_rect.x0.min(our_rect.x0), ps_rect.y0.min(our_rect.y0), ps_rect.x1.max(our_rect.x1), ps_rect.y1.max(our_rect.y1));
+            let (a, b) = (alpha(ps, u), alpha(&ours.surface, u));
+            let inter: f32 = a.iter().zip(&b).map(|(x, y)| x.min(*y)).sum();
+            let union: f32 = a.iter().zip(&b).map(|(x, y)| x.max(*y)).sum();
+            let iou = if union > 0.0 { inter / union } else { 1.0 };
+            let edges = [ps_rect.x0 - our_rect.x0, ps_rect.y0 - our_rect.y0, ps_rect.x1 - our_rect.x1, ps_rect.y1 - our_rect.y1];
+            println!("{file}: ps={ps_rect:?} ours={our_rect:?} iou={iou:.2} edges={edges:?}");
+            // Where the type starts on the path and how far it reaches across it hold with any
+            // font; the far end and the glyph overlap need the font Photoshop used (a wider
+            // fallback runs further around the circle).
+            let [x0, y0, _, y1] = edges;
+            assert!([x0, y0, y1].iter().all(|d| d.abs() <= 8), "{file}: ink bounds {our_rect:?}, Photoshop's {ps_rect:?}");
+            let family = t.runs.first().map(|r| r.style.font_family.clone()).unwrap_or_default();
+            if engine.fonts.has_family(&family) {
+                assert!(edges.iter().all(|d| d.abs() <= 8), "{file}: ink bounds {our_rect:?}, Photoshop's {ps_rect:?}");
+                assert!(iou > 0.2, "{file}: the glyphs sit where Photoshop drew them (IoU {iou:.2})");
+            } else {
+                eprintln!("{file}: {family:?} not installed, far edge and overlap comparison skipped");
+            }
+        }
+
+        // Edited: new text and the path moved 10 px right; saved and opened again.
+        let mut edited = doc.clone();
+        let id = layer.id;
+        for l in edited.layers.iter_mut() {
+            if l.id != id {
+                continue;
+            }
+            let LayerContent::Text(t) = &mut l.content else { continue };
+            t.text = format!("{} again", t.text);
+            if let Some(r) = t.runs.last_mut() {
+                r.len += " again".len();
+            }
+            t.sync_summary();
+            if let TextShape::Path { path, .. } = &mut t.shape {
+                for k in &mut path.knots {
+                    *k = k.transform(&photocraft_geom::Affine::translate(10.0, 0.0));
+                }
+            }
+            t.psd_raw = Some(std::sync::Arc::new(photocraft_text::psd::build_tysh(t, edited.resolution_dpi, None)));
+        }
+        let out = photocraft_io::export(&edited, file, &Default::default()).unwrap().bytes;
+        let back = photocraft_io::import(file, &out).unwrap().document;
+        let mut all = Vec::new();
+        walk(&back.layers, &mut all);
+        let LayerContent::Text(bt) = &all.iter().find(|l| matches!(l.content, LayerContent::Text(_))).unwrap().content else { unreachable!() };
+        assert!(bt.text.ends_with(" again"), "{file}: {:?}", bt.text);
+        for (g, [x, y]) in doc_anchors(bt).iter().zip(&anchors) {
+            assert!((g.x - (x + 10.0)).abs() < 1e-3 && (g.y - y).abs() < 1e-3, "{file}: saved anchor {g:?}, want ({}, {y})", x + 10.0);
+        }
+    }
+}
+
 /// A text layer created in PhotoCraft (no PSD data) exports as an editable type layer and
 /// imports back with the same model.
 #[test]
diff --git a/crates/io/tests/it/tiff_layers.rs b/crates/io/tests/it/tiff_layers.rs
index 1bbe8e2f4b..11e37591bc 100644
--- a/crates/io/tests/it/tiff_layers.rs
+++ b/crates/io/tests/it/tiff_layers.rs
@@ -34,19 +34,18 @@ fn roundtrip(doc: &Document) -> Document {
     // The TIFF is a plain image to any other reader: the composite at the document's size.
     let flat = photocraft_codecs::decode(&r.bytes).expect("flat decode");
     assert_eq!(flat.dimensions(), (doc.size.width, doc.size.height));
-    // A TIFF holds one transparency channel: extra alpha channels (and a Quick Mask) are not
-    // kept, and the export says so.
+    // Extra alpha channels and a Quick Mask travel as TIFF extra samples (at most MAX_EXTRA_SAMPLES).
     let extra = doc.channels.len() + usize::from(doc.quick_mask.is_some());
-    assert_eq!(r.warnings.iter().any(|w| w.contains("alpha channel(s) are not written")), extra > 0, "{:?}", r.warnings);
+    assert!(!r.warnings.iter().any(|w| w.contains("not written")), "{:?}", r.warnings);
+    if extra > 0 && extra <= photocraft_codecs::MAX_EXTRA_SAMPLES {
+        assert_eq!(flat.meta.extra_samples.len(), extra, "{:?}", r.warnings);
+    }
     import("x.tif", &r.bytes).expect("import").document
 }
 
-/// `doc` as a layered TIFF round trip returns it: without extra alpha channels or a Quick Mask.
+/// `doc` as a layered TIFF round trip returns it, including extra channels.
 fn expected(doc: &Document) -> Document {
-    let mut d = doc.clone();
-    d.channels.clear();
-    d.quick_mask = None;
-    d
+    doc.clone()
 }
 
 macro_rules! rt_case {
@@ -202,6 +201,47 @@ fn transparency_is_straight_in_the_composite() {
     assert_docs_eq(&d, &back);
 }
 
+/// Photoshop (27.11) saves a layered TIFF with Save Transparency as a composite with a
+/// transparency sample, a positive layer count and an `MTrn` block first in the layer data
+/// (the specification's key is `Mtrn`; `nrTM` in an `II` file). That sample is the merged
+/// transparency: it opens as no alpha channel, and a PSD save doesn't write it twice.
+#[test]
+fn photoshop_mtrn_marks_the_merged_transparency_of_a_layered_tiff() {
+    use photocraft_psd::{PsdFile, TaggedBlock};
+    for depth in [SampleType::U8, SampleType::U16] {
+        let mut d = Document::new("t", photocraft_geom::Size::new(8, 6), ColorMode::Rgb, depth);
+        let fmt = d.pixel_format();
+        d.layers.push(raster("shape", fmt, photocraft_geom::Rect::new(1, 1, 5, 4), 3, true));
+        let r = tiff(&d, true);
+        let mut img = photocraft_codecs::decode(&r.bytes).expect("decode");
+        assert!(img.layout().has_alpha(), "{depth:?}: the composite has a transparency sample");
+        let (isd, _) = ImageSourceData::from_bytes(&tags(&r.bytes).1.expect("layer data")).expect("parse");
+        for order in [ByteOrder::Little, ByteOrder::Big] {
+            let case = format!("{depth:?} {order:?}");
+            // Photoshop's form of the same layer data.
+            let mut ps = isd.clone();
+            ps.layer_info.as_mut().expect("layers").merged_alpha = false;
+            ps.global_blocks.insert(0, TaggedBlock::new(*b"MTrn", Vec::new()));
+            let layers = ps.to_bytes(order).expect("layer data").0;
+            if order == ByteOrder::Little {
+                assert!(layers.windows(12).any(|w| w == b"MIB8nrTM\0\0\0\0"), "{case}: stored as Photoshop stores it");
+            }
+            img.meta.photoshop_layers = Some(layers);
+            let bytes = photocraft_codecs::encode(&img, photocraft_codecs::Format::Tiff, &photocraft_codecs::EncodeOptions::default()).expect("encode");
+
+            let opened = import("x.tif", &bytes).expect("import").document;
+            let names: Vec<&str> = opened.channels.iter().map(|c| c.name.as_str()).collect();
+            assert!(names.is_empty(), "{case}: no alpha channel from the merged transparency: {names:?}");
+            // The marker is kept for the next save.
+            let mut want = d.clone();
+            want.metadata.psd_global_blocks = vec![(*b"8BIM", *b"MTrn", std::sync::Arc::new(Vec::new()))];
+            assert_docs_eq(&want, &opened);
+            let psd = PsdFile::from_bytes(&export(&opened, "x.psd", &ExportOptions::default()).expect("PSD save").bytes).expect("parse");
+            assert_eq!(psd.header.channels, 4, "{case}: colour + merged transparency");
+        }
+    }
+}
+
 #[test]
 fn big_documents_use_the_psb_signature() {
     // Forcing PSB stands in for a > 30000 px document.
@@ -261,12 +301,11 @@ fn psdtags_fixtures_open_with_their_layers() {
         // tifffile writes a Software tag; nothing else is worth a warning.
         assert!(r.warnings.iter().all(|w| w.contains("text metadata")), "{name}: {:?}", r.warnings);
         // psdtags wrote the composite's alpha sample without the transparency flag, so by the
-        // PSD rules it is an alpha channel (which a re-save cannot keep). Re-saving keeps
-        // everything else; the file is then in the encoder's byte order.
+        // PSD rules it is an alpha channel. A re-save keeps it as a TIFF extra sample.
         assert_eq!(d.channels.len(), 1, "{name}");
         let out = tiff(d, true);
         let back = import(name, &out.bytes).unwrap().document;
-        assert_docs_eq(&expected(d), &back);
+        assert_docs_eq(d, &back);
     }
 }
 
@@ -362,6 +401,622 @@ fn damaged_layer_data_opens_flattened() {
     }
 }
 
+/// Every sample of a TIFF, read by the `tiff` crate rather than PhotoCraft's decoder.
+///
+/// That decoder drops unspecified extra samples when the photometric interpretation is RGB, so
+/// the file is retagged MinIsBlack first. The result is then a multiband image of every sample,
+/// which is what libtiff's `TIFFReadScanline` returns and what a RIP walks.
+fn independent_samples(bytes: &[u8]) -> (u16, Vec<u16>, Vec<u16>, u32, Vec<u8>) {
+    let mut tags = tiff::decoder::Decoder::new(std::io::Cursor::new(bytes)).expect("tiff tags");
+    let spp: u16 = tags.get_tag_unsigned(tiff::tags::Tag::SamplesPerPixel).expect("spp");
+    let bps = tags.get_tag_u16_vec(tiff::tags::Tag::BitsPerSample).expect("bps");
+    let extra = tags.get_tag_u16_vec(tiff::tags::Tag::ExtraSamples).unwrap_or_default();
+    let rows = tags.find_tag_unsigned::<u32>(tiff::tags::Tag::RowsPerStrip).ok().flatten().unwrap_or(0);
+    let patched = photometric_min_is_black(bytes);
+    let mut dec = tiff::decoder::Decoder::new(std::io::Cursor::new(patched.as_slice())).expect("tiff decode");
+    let tiff::decoder::DecodingResult::U8(samples) = dec.read_image().expect("read image") else {
+        panic!("expected 8-bit samples");
+    };
+    (spp, bps, extra, rows, samples)
+}
+
+/// Classic-TIFF photometric tag 262 → 1 (MinIsBlack), value stored inline in the IFD entry.
+fn photometric_min_is_black(src: &[u8]) -> Vec<u8> {
+    let mut bytes = src.to_vec();
+    let le = bytes.first().copied() == Some(b'I');
+    let ru16 = |b: &[u8], i: usize| -> Option<u16> {
+        let s = b.get(i..i + 2)?;
+        Some(if le { u16::from_le_bytes([s[0], s[1]]) } else { u16::from_be_bytes([s[0], s[1]]) })
+    };
+    let ru32 = |b: &[u8], i: usize| -> Option<u32> {
+        let s = b.get(i..i + 4)?;
+        Some(if le { u32::from_le_bytes(s.try_into().ok()?) } else { u32::from_be_bytes(s.try_into().ok()?) })
+    };
+    let Some(ifd) = ru32(&bytes, 4) else { return bytes };
+    let Some(n) = ru16(&bytes, ifd as usize) else { return bytes };
+    for e in 0..n as usize {
+        let at = ifd as usize + 2 + e * 12;
+        if ru16(&bytes, at) == Some(262) {
+            let value = if le { 1u16.to_le_bytes() } else { 1u16.to_be_bytes() };
+            if let Some(slot) = bytes.get_mut(at + 8..at + 10) {
+                slot.copy_from_slice(&value);
+            }
+            break;
+        }
+    }
+    bytes
+}
+
+fn assert_plane(samples: &[u8], spp: usize, plane: usize, expected: &[u8]) {
+    assert_eq!(samples.len(), expected.len().saturating_mul(spp));
+    let mut bad = 0usize;
+    let mut first = None;
+    for (i, want) in expected.iter().enumerate() {
+        let got = samples.get(i * spp + plane).copied();
+        if got != Some(*want) {
+            bad += 1;
+            first.get_or_insert((i, got));
+        }
+    }
+    assert_eq!(bad, 0, "{bad} mismatches, first {first:?}");
+}
+
+/// A multi-layer transparent document, large enough for several TIFF strips and several
+/// raster tiles, with a spot whose every pixel is a known value.
+#[test]
+fn dtf_like_spot_is_written_in_full() {
+    use photocraft_color::{Color, PixelFormat};
+    use photocraft_doc::{AlphaChannel, Layer};
+    use photocraft_geom::{Rect, Size};
+    use photocraft_psd::tiff::resources_from_bytes;
+    use photocraft_raster::Surface;
+
+    let (w, h) = (900u32, 360u32);
+    let mut doc = Document::new("dtf", Size::new(w, h), ColorMode::Rgb, SampleType::U8);
+    let fmt = doc.pixel_format();
+    let mut art = Surface::new(fmt);
+    let px = photocraft_raster::from_rgba(&fmt, [0.2, 0.5, 0.9, 1.0]);
+    art.fill_rect(Rect::new(30, 20, 870, 340), &px);
+    doc.layers.push(Layer::new("Art", LayerContent::Raster(art)));
+    let mut ink = Surface::new(fmt);
+    let px = photocraft_raster::from_rgba(&fmt, [0.9, 0.1, 0.2, 0.5]);
+    ink.fill_rect(Rect::new(80, 40, 700, 300), &px);
+    let mut layer = Layer::new("Ink", LayerContent::Raster(ink));
+    layer.opacity = 0.8;
+    doc.layers.push(layer);
+
+    let n = (w as usize) * (h as usize);
+    let mut spot_bytes = vec![0u8; n];
+    for y in 0..h as usize {
+        for x in 0..w as usize {
+            spot_bytes[y * w as usize + x] = ((x * 3 + y * 17) % 251) as u8;
+        }
+    }
+    // Outside the artwork the composite is transparent, but the spot is not zero: a reader that
+    // binds "Spot Color 1" to the alpha plane fails here.
+    assert_eq!(spot_bytes[10 * w as usize + 10], 200);
+    let gray = PixelFormat::new(ColorMode::Grayscale, SampleType::U8, false);
+    let spot_surface = Surface::from_interleaved(gray, Rect::new(0, 0, w as i32, h as i32), &spot_bytes);
+    let mut channel = AlphaChannel::new("Spot Color 1", spot_surface);
+    channel.spot = Some((Color::rgb(1.0, 0.0, 0.0), 0.6));
+    doc.channels.push(channel);
+
+    let mut seen = Vec::new();
+    for (name, layers) in [("flat", false), ("layered", true)] {
+        let opts = ExportOptions { tiff_layers: layers, ..ExportOptions::default() };
+        let r = export(&doc, "dtf.tif", &opts).unwrap();
+        assert!(!r.warnings.iter().any(|w| w.contains("not written")), "{name}: {:?}", r.warnings);
+        let img = photocraft_codecs::decode(&r.bytes).unwrap();
+        assert!(!img.layout().has_alpha(), "{name}: {:?}", img.layout());
+        assert_eq!(img.layout().color_channels(), 3, "{name}");
+        assert_eq!(img.meta.extra_samples.len(), 1, "{name}");
+        assert_eq!(img.meta.extra_samples[0].kind, 0, "{name}");
+        // Photoshop stores spot ink inverted: document 255 (solid) is file 0.
+        let stored_spot: Vec<u8> = spot_bytes.iter().map(|b| 255 - b).collect();
+        assert_eq!(img.meta.extra_samples[0].data, stored_spot, "{name} own decoder");
+
+        let (spp, bps, extra, rows, samples) = independent_samples(&r.bytes);
+        assert_eq!(spp, 4, "{name}");
+        assert_eq!(bps, vec![8, 8, 8, 8], "{name}");
+        assert_eq!(extra, vec![0], "{name} ExtraSamples");
+        assert!(rows > 0 && rows < h, "{name} rows_per_strip {rows}");
+        assert_plane(&samples, 4, 3, &stored_spot);
+        seen.push(samples.clone());
+
+        // Outside the artwork the composite is matted to white (Save Transparency off). The
+        // spot at that pixel is not zero, so a reader that binds the name to the alpha fails.
+        let at = (10 * w as usize + 10) * 4;
+        assert_eq!(&samples[at..at + 3], &[255, 255, 255], "{name} matted rgb");
+        let (resources, layer_tag) = tags(&r.bytes);
+        let resources = resources.expect("photoshop resources");
+        let (blocks, warnings) = resources_from_bytes(&resources).unwrap();
+        assert!(warnings.is_empty(), "{name} {warnings:?}");
+        let block = |id: u16| blocks.iter().find(|b| b.id == id).unwrap_or_else(|| panic!("{name} missing {id}"));
+        // "Spot Color 1" is 12 characters: Photoshop stores 13 bytes and pads the 8BIM block, not the string.
+        assert_eq!(block(1006).data, b"\x0cSpot Color 1", "{name}");
+        assert_eq!(block(1045).data.len(), 30, "{name}");
+        let info = &block(1077).data;
+        assert_eq!(info.len(), 17, "{name}");
+        assert_eq!(u16::from_be_bytes([info[14], info[15]]), 60, "{name} solidity");
+        assert_eq!(info[16], 2, "{name} spot kind");
+        // Photoshop numbers a new document's channels from 3.
+        assert_eq!(block(1053).data, 3u32.to_be_bytes(), "{name} channel id");
+
+        let back = import("dtf.tif", &r.bytes).unwrap().document;
+        assert_eq!(back.channels.len(), 1, "{name}");
+        assert_eq!(back.channels[0].name, "Spot Color 1");
+        let (ink, sol) = back.channels[0].spot.expect("spot");
+        assert_eq!(ink.to_rgb(), [1.0, 0.0, 0.0], "{name}");
+        assert!((sol - 0.6).abs() < 1e-4, "{name}");
+        let area = Rect::new(0, 0, w as i32, h as i32);
+        assert_eq!(back.channels[0].surface.to_interleaved(area), spot_bytes, "{name} reimport");
+        if layers {
+            let layer_tag = layer_tag.expect("layer tag");
+            let (isd, w) = ImageSourceData::from_bytes(&layer_tag).unwrap();
+            assert!(w.is_empty(), "{w:?}");
+            let info = isd.layer_info.expect("layers");
+            assert!(!info.merged_alpha, "{name}");
+            assert!(info.layers.iter().all(|l| l.flags.0 & 0x08 != 0), "{name} photoshop flag");
+            assert!(info.layers.iter().all(|l| l.blocks.iter().any(|b| &b.key == b"lnsr")), "{name} lnsr");
+            let mask = isd.global_layer_mask.expect("LMsk");
+            assert_eq!(mask.data.len(), 14, "{name}");
+            assert_eq!(mask.opacity(), Some(50));
+            assert_eq!(mask.kind(), Some(128));
+            assert_photoshop_layered_tiff(&r.bytes, true);
+            assert_eq!(back.layers.len(), 2, "{name}");
+            let ink = back.layers.iter().find(|l| l.name == "Ink").expect("ink layer");
+            let px = ink.surface().expect("ink pixels").pixel(100, 100);
+            assert!((px[3] - 0.5).abs() < 0.02, "{name} layer alpha {px:?}");
+            let outside = ink.surface().expect("ink pixels").pixel(0, 0);
+            assert!(outside[3] < 0.02, "{name} transparent pixel {outside:?}");
+        } else {
+            assert!(layer_tag.is_none(), "{name}");
+        }
+    }
+    assert_eq!(seen[0], seen[1], "flat and layered IFD samples differ");
+}
+
+/// A transparent document with no user channels still stores image alpha.
+#[test]
+fn transparent_tiff_without_channels_keeps_image_alpha() {
+    use photocraft_doc::Layer;
+    use photocraft_geom::{Rect, Size};
+    use photocraft_raster::Surface;
+
+    let mut doc = Document::new("t", Size::new(8, 8), ColorMode::Rgb, SampleType::U8);
+    let fmt = doc.pixel_format();
+    let mut art = Surface::new(fmt);
+    art.fill_rect(Rect::new(1, 1, 6, 6), &photocraft_raster::from_rgba(&fmt, [1.0, 0.0, 0.0, 0.5]));
+    doc.layers.push(Layer::new("Art", LayerContent::Raster(art)));
+    for layers in [false, true] {
+        let r = export(&doc, "t.tif", &ExportOptions { tiff_layers: layers, ..ExportOptions::default() }).unwrap();
+        let img = photocraft_codecs::decode(&r.bytes).unwrap();
+        assert!(img.layout().has_alpha(), "{layers}");
+        assert!(img.meta.extra_samples.is_empty(), "{layers}");
+        let mut dec = tiff::decoder::Decoder::new(std::io::Cursor::new(r.bytes.as_slice())).unwrap();
+        let extra = dec.get_tag_u16_vec(tiff::tags::Tag::ExtraSamples).unwrap();
+        assert_eq!(extra, vec![2], "{layers}");
+        assert!(!r.warnings.iter().any(|w| w.contains("Save Transparency")), "{layers}: {:?}", r.warnings);
+        if layers {
+            assert_photoshop_layered_tiff(&r.bytes, false);
+        }
+    }
+}
+
+/// A flat TIFF that also stores an alpha or spot channel mattes the composite on white
+/// and drops image transparency. The export says so.
+#[test]
+fn flat_tiff_warns_when_extra_channels_matte_transparency() {
+    use photocraft_color::{Color, PixelFormat};
+    use photocraft_doc::{AlphaChannel, Layer};
+    use photocraft_geom::{Rect, Size};
+    use photocraft_raster::Surface;
+
+    let mut doc = Document::new("t", Size::new(4, 4), ColorMode::Rgb, SampleType::U8);
+    let fmt = doc.pixel_format();
+    let mut art = Surface::new(fmt);
+    // (0, 0) stays transparent. (1, 1) is half-red, so the matte is halfway to white.
+    art.fill_rect(Rect::new(1, 1, 2, 2), &photocraft_raster::from_rgba(&fmt, [1.0, 0.0, 0.0, 0.5]));
+    doc.layers.push(Layer::new("Art", LayerContent::Raster(art)));
+    let mut spot = AlphaChannel::new("Spot Color 1", Surface::new(PixelFormat::new(ColorMode::Grayscale, SampleType::U8, false)));
+    spot.spot = Some((Color::rgb(0.0, 1.0, 0.0), 1.0));
+    doc.channels.push(spot);
+
+    let r = export(&doc, "t.tif", &ExportOptions { tiff_layers: false, ..ExportOptions::default() }).unwrap();
+    assert!(r.warnings.iter().any(|w| w.contains("composited over white") && w.contains("Save Transparency")), "{:?}", r.warnings);
+    let img = photocraft_codecs::decode(&r.bytes).unwrap();
+    assert!(!img.layout().has_alpha(), "{:?}", img.layout());
+    assert_eq!(img.meta.extra_samples.len(), 1);
+    let (_spp, _bps, extra, _rows, samples) = independent_samples(&r.bytes);
+    assert_eq!(extra, vec![0]);
+    // 4 samples per pixel: RGB + spot. (0, 0) was transparent and is now white.
+    assert_eq!(&samples[..3], &[255, 255, 255]);
+    // Half-red over white is about (255, 128, 128). Pixel (1, 1), 4 samples per pixel.
+    let (x, y, width, spp) = (1usize, 1usize, 4usize, 4usize);
+    let at = (y * width + x) * spp;
+    let rgb = &samples[at..at + 3];
+    assert!(rgb[0] > 250 && (rgb[1] as i16 - 128).abs() <= 2 && (rgb[2] as i16 - 128).abs() <= 2, "{rgb:?}");
+}
+
+/// A 4×4 RGB document whose one layer is transparent outside its middle, plus a "White" spot
+/// channel with solid ink in its left half: the shape of a UV print's underbase.
+fn transparent_art_with_white_spot() -> Document {
+    use photocraft_color::{Color, PixelFormat};
+    use photocraft_doc::{AlphaChannel, Layer};
+    use photocraft_geom::{Rect, Size};
+    use photocraft_raster::Surface;
+
+    let mut doc = Document::new("t", Size::new(4, 4), ColorMode::Rgb, SampleType::U8);
+    let fmt = doc.pixel_format();
+    let mut art = Surface::new(fmt);
+    art.fill_rect(Rect::new(1, 1, 3, 3), &photocraft_raster::from_rgba(&fmt, [1.0, 0.0, 0.0, 1.0]));
+    doc.layers.push(Layer::new("Layer 1", LayerContent::Raster(art)));
+    let gray = PixelFormat::new(ColorMode::Grayscale, SampleType::U8, false);
+    let mut plate = Surface::new(gray);
+    plate.fill_rect(Rect::new(0, 0, 2, 4), &photocraft_raster::from_rgba(&gray, [1.0, 1.0, 1.0, 1.0]));
+    let mut white = AlphaChannel::new("White", plate);
+    white.spot = Some((Color::rgb(0.8, 0.2, 0.2), 1.0));
+    doc.channels.push(white);
+    doc
+}
+
+/// The first channel's ink at (0, 0), inked, and at (3, 0), bare.
+fn ink(d: &Document) -> (f32, f32) {
+    (d.channels[0].surface.pixel(0, 0)[0], d.channels[0].surface.pixel(3, 0)[0])
+}
+
+/// `doc` laid out as Photoshop 25.12 saves a TIFF with Save Transparency on: R, G, B,
+/// transparency and spot samples, with "Transparency" first in the channel names and display
+/// records. With `layers`, the layer data has a positive layer count and an `MTrn` block (the
+/// specification's key is `Mtrn`); without, the file is flat. Built from the PSD model of `doc`.
+fn photoshop_transparency_and_spot_tiff(doc: &Document, layers: bool) -> Vec<u8> {
+    use photocraft_psd::{Compression, TaggedBlock};
+
+    let opts = PsdExportOptions { merged_matte: false, merged_compression: Compression::Raw, ..Default::default() };
+    let (file, _) = document_to_psd_with(doc, &opts);
+    let planes = file.decode_merged().unwrap();
+    let n = 16;
+    assert_eq!(planes.len(), 5 * n);
+    let rgba: Vec<u8> = (0..n).flat_map(|i| (0..4).map(move |c| (i, c))).map(|(i, c)| planes[c * n + i]).collect();
+    let mut img = photocraft_codecs::Image::from_raw(4, 4, photocraft_codecs::ChannelLayout::Rgba, photocraft_codecs::SampleType::U8, rgba).unwrap();
+    img.meta.extra_samples = vec![photocraft_codecs::ExtraSample { kind: 0, data: planes[4 * n..].to_vec() }];
+    img.meta.photoshop_resources = Some(photocraft_psd::tiff::resources_to_bytes(&file.resources).unwrap());
+    if layers {
+        let mut isd = ImageSourceData::from_psd(&file);
+        if let Some(info) = &mut isd.layer_info {
+            info.merged_alpha = false;
+        }
+        isd.global_blocks.insert(0, TaggedBlock::new(*b"MTrn", Vec::new()));
+        let order = if photocraft_codecs::tiff_writes_little_endian() { ByteOrder::Little } else { ByteOrder::Big };
+        img.meta.photoshop_layers = Some(isd.to_bytes(order).unwrap().0);
+    }
+    photocraft_codecs::encode(&img, photocraft_codecs::Format::Tiff, &photocraft_codecs::EncodeOptions::default()).unwrap()
+}
+
+/// Photoshop's layered TIFF with transparency next to a spot channel opens with the spot as the
+/// only channel. A layered re-save leaves the transparency sample out next to the spot, so it
+/// must also drop the `MTrn` marker, or the spot would read back as transparency.
+#[test]
+fn photoshop_mtrn_tiff_opens_without_a_transparency_channel() {
+    use photocraft_psd::TaggedBlock;
+
+    let bytes = photoshop_transparency_and_spot_tiff(&transparent_art_with_white_spot(), true);
+    let opened = import("t.tif", &bytes).unwrap().document;
+    let names: Vec<&str> = opened.channels.iter().map(|c| c.name.as_str()).collect();
+    assert_eq!(names, ["White"]);
+    assert!(opened.channels[0].spot.is_some());
+    assert_eq!(ink(&opened), (1.0, 0.0));
+
+    let r = tiff(&opened, true);
+    let (isd, _) = ImageSourceData::from_bytes(&tags(&r.bytes).1.unwrap()).unwrap();
+    assert!(!isd.global_blocks.iter().any(TaggedBlock::is_merged_transparency_marker));
+    let back = import("t.tif", &r.bytes).unwrap().document;
+    let names: Vec<&str> = back.channels.iter().map(|c| c.name.as_str()).collect();
+    assert_eq!(names, ["White"]);
+    assert_eq!(ink(&back), (1.0, 0.0));
+}
+
+/// The same Photoshop layout in a flat TIFF (no layer data): the image keeps its transparency,
+/// and the spot gets its own name and display record, not the leading "Transparency" ones, so
+/// it opens as a spot with its ink the right way round.
+#[test]
+fn photoshop_flat_tiff_with_transparency_opens_its_spot_as_a_spot() {
+    let bytes = photoshop_transparency_and_spot_tiff(&transparent_art_with_white_spot(), false);
+    assert!(tags(&bytes).1.is_none(), "flat: no layer data");
+    let opened = import("t.tif", &bytes).unwrap().document;
+    let names: Vec<&str> = opened.channels.iter().map(|c| c.name.as_str()).collect();
+    assert_eq!(names, ["White"]);
+    assert!(opened.channels[0].spot.is_some(), "a spot, not an alpha channel");
+    assert_eq!(ink(&opened), (1.0, 0.0));
+    let LayerContent::Raster(s) = &opened.layers[0].content else { panic!("raster") };
+    assert_eq!(s.pixel(0, 0)[3], 0.0, "the image keeps its transparency");
+}
+
+/// A Lab document with a spot channel keeps the spot as a CIELab extra sample, and its
+/// transparency is matted on Lab white (L* 100, a* and b* 0), not on the maximum of every sample.
+#[test]
+fn lab_tiff_keeps_spot_and_mattes_on_lab_white() {
+    use photocraft_color::{Color, PixelFormat};
+    use photocraft_doc::{AlphaChannel, Layer};
+    use photocraft_geom::{Rect, Size};
+    use photocraft_raster::Surface;
+
+    for sample in [SampleType::U8, SampleType::U16] {
+        let mut doc = Document::new("t", Size::new(4, 4), ColorMode::Lab, sample);
+        let fmt = doc.pixel_format();
+        let mut art = Surface::new(fmt);
+        // (0, 0) stays transparent.
+        art.fill_rect(Rect::new(1, 1, 2, 2), &photocraft_raster::from_rgba(&fmt, [1.0, 0.0, 0.0, 1.0]));
+        doc.layers.push(Layer::new("Art", LayerContent::Raster(art)));
+        let mut plate = Surface::new(PixelFormat::new(ColorMode::Grayscale, sample, false));
+        plate.fill_rect(Rect::new(0, 0, 2, 4), &photocraft_raster::from_rgba(&plate.format(), [1.0, 1.0, 1.0, 1.0]));
+        let mut spot = AlphaChannel::new("Spot Color 1", plate);
+        spot.spot = Some((Color::rgb(0.0, 1.0, 0.0), 1.0));
+        doc.channels.push(spot);
+
+        // Lab is always saved flat, whether layers were asked for or not.
+        for layers in [false, true] {
+            let r = export(&doc, "t.tif", &ExportOptions { tiff_layers: layers, ..ExportOptions::default() }).unwrap();
+            let img = photocraft_codecs::decode(&r.bytes).unwrap();
+            assert_eq!(img.layout(), photocraft_codecs::ChannelLayout::Lab, "{sample:?} {layers}");
+            assert_eq!(img.meta.extra_samples.len(), 1, "{sample:?} {layers}");
+            let white = &img.to_normalized()[..3];
+            assert!((white[0] - 1.0).abs() < 1e-3 && (white[1] - 128.0 / 255.0).abs() < 1e-3 && (white[2] - 128.0 / 255.0).abs() < 1e-3, "{white:?}");
+            let back = import("t.tif", &r.bytes).unwrap().document;
+            assert_eq!(back.pixel_format().mode, ColorMode::Lab, "{sample:?} {layers}");
+            assert_eq!(back.channels.len(), 1, "{sample:?} {layers}");
+            assert_eq!(back.channels[0].name, "Spot Color 1");
+            assert!(back.channels[0].spot.is_some(), "{sample:?} {layers}");
+            let plate = |c: &AlphaChannel| c.surface.to_interleaved(Rect::new(0, 0, 4, 4));
+            assert_eq!(plate(&back.channels[0]), plate(&doc.channels[0]), "{sample:?} {layers}");
+        }
+    }
+}
+
+/// Tag 37724 walked as raw bytes (not through [`ImageSourceData`]).
+///
+/// Matches a Photoshop 27 layered TIFF: classic 4-byte block lengths, `Layr` then a 14-byte
+/// `LMsk`, no `MTrn` (that block is only for a composite that keeps both transparency and a
+/// spot). A 4320×4320 RGB spot plate is 74_649_600 bytes and still fits those u32 lengths;
+/// this check uses the same layout on a smaller image.
+fn assert_photoshop_layered_tiff(bytes: &[u8], with_spot: bool) {
+    assert!(bytes.starts_with(b"II"), "little-endian TIFF");
+    let u16_at = |i: usize| u16::from_le_bytes([bytes[i], bytes[i + 1]]);
+    let u32_at = |i: usize| u32::from_le_bytes(bytes[i..i + 4].try_into().unwrap());
+    let ifd = u32_at(4) as usize;
+    let n = u16_at(ifd) as usize;
+    let mut layers = None;
+    let mut spp = 0u16;
+    let mut extra = Vec::new();
+    for e in 0..n {
+        let at = ifd + 2 + e * 12;
+        let tag = u16_at(at);
+        let typ = u16_at(at + 2);
+        let count = u32_at(at + 4) as usize;
+        let val = u32_at(at + 8) as usize;
+        let unit: usize = match typ {
+            3 => 2,
+            4 => 4,
+            _ => 1,
+        };
+        let size = unit.saturating_mul(count);
+        let inline = at + 8;
+        let raw = if size <= 4 { &bytes[inline..inline + size] } else { &bytes[val..val + size] };
+        match tag {
+            277 => spp = u16::from_le_bytes([raw[0], raw[1]]),
+            338 => extra = raw.as_chunks::<2>().0.iter().map(|c| u16::from_le_bytes(*c)).collect(),
+            37724 => layers = Some(raw),
+            _ => {}
+        }
+    }
+    let isd = layers.expect("37724");
+    let sig = b"Adobe Photoshop Document Data Block\0";
+    assert!(isd.starts_with(sig), "PSB-sized lengths");
+    let mut pos = sig.len();
+    let mut keys = Vec::new();
+    let mut layr: Option<Vec<u8>> = None;
+    while pos + 12 <= isd.len() {
+        assert_eq!(&isd[pos..pos + 4], b"MIB8", "block at {pos}");
+        let key = [isd[pos + 7], isd[pos + 6], isd[pos + 5], isd[pos + 4]];
+        let len = u32::from_le_bytes(isd[pos + 8..pos + 12].try_into().unwrap()) as usize;
+        let body = &isd[pos + 12..pos + 12 + len];
+        if &key == b"Layr" {
+            layr = Some(body.to_vec());
+        }
+        if &key == b"LMsk" {
+            assert_eq!(body, &[0, 0, 0xff, 0xff, 0, 0, 0, 0, 0, 0, 0x32, 0, 0x80, 0]);
+        }
+        keys.push(key);
+        pos += 12 + len;
+        let rest = &isd[pos..];
+        let pad = (0..=3).find(|&k| k == rest.len() || rest.get(k..k + 4) == Some(b"MIB8")).unwrap_or(0);
+        pos += pad;
+    }
+    assert_eq!(pos, isd.len(), "trailing bytes after the last block");
+    assert_eq!(keys.first(), Some(b"Layr"));
+    assert_eq!(keys.get(1), Some(b"LMsk"));
+    assert!(!keys.iter().any(|k| k == b"MTrn" || k == b"Mtrn"));
+    let layr = layr.expect("Layr");
+    let count = i16::from_le_bytes([layr[0], layr[1]]);
+    if with_spot {
+        assert!(count > 0, "layer count {count}");
+        assert_eq!((spp, extra.as_slice()), (4, [0u16].as_slice()));
+    } else {
+        assert!(count < 0, "layer count {count}");
+        assert_eq!(extra, vec![2]);
+    }
+    let nch = u16::from_le_bytes([layr[18], layr[19]]) as usize;
+    let mut ids = Vec::new();
+    let mut p = 20;
+    for _ in 0..nch {
+        ids.push(i16::from_le_bytes([layr[p], layr[p + 1]]));
+        p += 6;
+    }
+    assert!(ids.contains(&-1), "channel ids {ids:?}");
+}
+
+/// Photoshop 27's Kato-Karate TIFF stores spot ink inverted: every non-white artwork pixel
+/// has spot 0, and the white background is spot 255. An alpha channel is the other way
+/// around (255 = selected). Photoshop's PSDs store both the same way, and so does a PSD saved
+/// here. Everything round-trips, PSD → TIFF → PSD included.
+#[test]
+fn spot_ink_is_stored_as_zero_and_alpha_is_not() {
+    use photocraft_color::{Color, PixelFormat};
+    use photocraft_doc::{AlphaChannel, Layer};
+    use photocraft_geom::{Rect, Size};
+    use photocraft_psd::PsdFile;
+    use photocraft_raster::Surface;
+
+    for depth in [SampleType::U8, SampleType::U16, SampleType::F32] {
+        let (w, h) = (8u32, 8u32);
+        let mut doc = Document::new("pol", Size::new(w, h), ColorMode::Rgb, depth);
+        let fmt = doc.pixel_format();
+        let mut art = Surface::new(fmt);
+        art.fill_rect(Rect::new(2, 2, 6, 6), &photocraft_raster::from_rgba(&fmt, [1.0, 0.2, 0.1, 1.0]));
+        doc.layers.push(Layer::new("Art", LayerContent::Raster(art)));
+        let gray = PixelFormat::new(ColorMode::Grayscale, depth, false);
+        let n = (w as usize) * (h as usize);
+        let mut ink = vec![0.0f32; n];
+        for y in 2..6 {
+            for x in 2..6 {
+                ink[y * w as usize + x] = 1.0;
+            }
+        }
+        let mut spot = AlphaChannel::new("Spot Color 1", Surface::new(gray));
+        spot.surface.write_region(Rect::new(0, 0, w as i32, h as i32), &ink);
+        spot.spot = Some((Color::rgb(1.0, 0.0, 0.0), 0.6));
+        doc.channels.push(spot);
+        let mut alpha = AlphaChannel::new("Alpha 1", Surface::new(gray));
+        alpha.surface.write_region(Rect::new(0, 0, w as i32, h as i32), &ink);
+        doc.channels.push(alpha);
+
+        let psd = export(&doc, "pol.psd", &ExportOptions::default()).unwrap();
+        let file = PsdFile::from_bytes(&psd.bytes).unwrap();
+        let merged = file.decode_merged().unwrap();
+        let bps = depth.bytes();
+        let plane = n * bps;
+        let first = 3 + usize::from(file.merged_has_alpha());
+        let spot_plane = &merged[first * plane..(first + 1) * plane];
+        let alpha_plane = &merged[(first + 1) * plane..(first + 2) * plane];
+        // Background (0,0) and artwork (3,3). Spot: 0 = solid ink, max = paper.
+        // Alpha: max = selected, 0 = empty.
+        assert_stored(spot_plane, 0, depth, false, "psd spot background");
+        assert_stored(spot_plane, (3 * w as usize + 3) * bps, depth, true, "psd spot art");
+        assert_stored(alpha_plane, 0, depth, true, "psd alpha background");
+        assert_stored(alpha_plane, (3 * w as usize + 3) * bps, depth, false, "psd alpha art");
+        // The merged transparency (0), then the spot and the alpha channel (3, 4).
+        assert_eq!(file.resource(1053).map(|r| identifiers(&r.data)), Some(vec![0, 3, 4]), "{depth:?}");
+        let back = import("pol.psd", &psd.bytes).unwrap().document;
+        let area = Rect::new(0, 0, w as i32, h as i32);
+        assert_eq!(back.channels[0].surface.to_interleaved(area), doc.channels[0].surface.to_interleaved(area), "{depth:?} psd spot");
+        assert_eq!(back.channels[1].surface.to_interleaved(area), doc.channels[1].surface.to_interleaved(area), "{depth:?} psd alpha");
+        assert!(back.channels[0].spot.is_some(), "{depth:?}");
+        assert!(back.channels[1].spot.is_none(), "{depth:?}");
+
+        if depth == SampleType::U8 {
+            for layers in [false, true] {
+                // The document as opened from the PSD, so the PSD's own resources come along.
+                let r = export(&back, "pol.tif", &ExportOptions { tiff_layers: layers, ..ExportOptions::default() }).unwrap();
+                let (spp, _bps, extra, _rows, samples) = independent_samples(&r.bytes);
+                assert_eq!((spp, extra.as_slice()), (5, [0u16, 0].as_slice()), "{layers}");
+                // Reference TIFF: artwork spot sample is 0, background spot sample is 255.
+                assert_eq!(samples[3], 255, "{layers} background spot");
+                assert_eq!(samples[(3 * w as usize + 3) * 5 + 3], 0, "{layers} art spot");
+                assert_eq!(samples[4], 0, "{layers} background alpha");
+                assert_eq!(samples[(3 * w as usize + 3) * 5 + 4], 255, "{layers} art alpha");
+                // One identifier per extra sample, numbered from 3 (no transparency sample).
+                assert_eq!(tiff_alpha_identifiers(&r.bytes), [3, 4], "{layers}");
+                let from_tiff = import("pol.tif", &r.bytes).unwrap().document;
+                assert_eq!(from_tiff.channels[0].surface.to_interleaved(area), doc.channels[0].surface.to_interleaved(area), "{layers}");
+                assert_eq!(from_tiff.channels[1].surface.to_interleaved(area), doc.channels[1].surface.to_interleaved(area), "{layers}");
+                assert!(from_tiff.channels[0].spot.is_some() && from_tiff.channels[1].spot.is_none(), "{layers}");
+                // Saved as PSD again: the first PSD's planes, and one 1053 of its own. The flat TIFF's
+                // composite was matted on white, so only the layered one brings transparency back.
+                let psd = PsdFile::from_bytes(&export(&from_tiff, "pol.psd", &ExportOptions::default()).unwrap().bytes).unwrap();
+                let again = psd.decode_merged().unwrap();
+                assert_eq!(again[again.len() - 2 * plane..], merged[(first * plane)..(first + 2) * plane], "{layers} tiff to psd");
+                assert_eq!(psd.merged_has_alpha(), layers, "{layers} tiff to psd");
+                let want: Vec<u32> = if layers { vec![0, 3, 4] } else { vec![3, 4] };
+                assert_eq!(psd.resources.iter().filter(|r| r.id == 1053).map(|r| identifiers(&r.data)).collect::<Vec<_>>(), [want], "{layers} tiff to psd");
+                let reopened = import("pol.psd", &psd.to_bytes().unwrap()).unwrap().document;
+                assert_eq!(reopened.channels[0].surface.to_interleaved(area), doc.channels[0].surface.to_interleaved(area), "{layers}");
+                assert_eq!(reopened.channels[1].surface.to_interleaved(area), doc.channels[1].surface.to_interleaved(area), "{layers}");
+            }
+        }
+    }
+}
+
+/// The big-endian u32s of a resource 1053.
+fn identifiers(data: &[u8]) -> Vec<u32> {
+    data.as_chunks::<4>().0.iter().map(|c| u32::from_be_bytes(*c)).collect()
+}
+
+/// The identifiers in a TIFF's resource 1053 (none without one).
+fn tiff_alpha_identifiers(bytes: &[u8]) -> Vec<u32> {
+    let resources = tags(bytes).0.expect("photoshop resources");
+    let (blocks, _) = photocraft_psd::tiff::resources_from_bytes(&resources).unwrap();
+    blocks.iter().find(|b| b.id == 1053).map(|b| identifiers(&b.data)).unwrap_or_default()
+}
+
+/// `at` addresses one sample of a big-endian PSD plane. `zero` expects 0; otherwise the
+/// maximum sample (255 / 65535 / 1.0).
+fn assert_stored(plane: &[u8], at: usize, depth: SampleType, zero: bool, what: &str) {
+    match depth {
+        SampleType::U8 => {
+            let v = plane[at];
+            assert_eq!(v, if zero { 0 } else { 255 }, "{what} {v}");
+        }
+        SampleType::U16 => {
+            let v = u16::from_be_bytes([plane[at], plane[at + 1]]);
+            assert_eq!(v, if zero { 0 } else { 65535 }, "{what} {v}");
+        }
+        SampleType::F32 => {
+            let v = f32::from_be_bytes([plane[at], plane[at + 1], plane[at + 2], plane[at + 3]]);
+            assert_eq!(v, if zero { 0.0 } else { 1.0 }, "{what} {v}");
+        }
+    }
+}
+
+/// Quick Mask stays the last channel after the merged transparency plane is omitted.
+#[test]
+fn spot_tiff_keeps_quick_mask_when_composite_alpha_is_omitted() {
+    use photocraft_color::{Color, PixelFormat};
+    use photocraft_doc::{AlphaChannel, Layer};
+    use photocraft_geom::{Rect, Size};
+    use photocraft_raster::Surface;
+
+    let mut doc = Document::new("q", Size::new(8, 8), ColorMode::Rgb, SampleType::U8);
+    let fmt = doc.pixel_format();
+    let mut art = Surface::new(fmt);
+    art.fill_rect(Rect::new(1, 1, 6, 6), &photocraft_raster::from_rgba(&fmt, [1.0, 0.0, 0.0, 0.5]));
+    doc.layers.push(Layer::new("Art", LayerContent::Raster(art)));
+    let gray = PixelFormat::new(ColorMode::Grayscale, SampleType::U8, false);
+    let area = Rect::new(0, 0, 8, 8);
+    let mut spot_bytes = vec![9u8; 64];
+    spot_bytes[0] = 3;
+    let mut channel = AlphaChannel::new("Spot Color 1", Surface::from_interleaved(gray, area, &spot_bytes));
+    channel.spot = Some((Color::rgb(1.0, 0.0, 0.0), 0.6));
+    doc.channels.push(channel);
+    let mut qbytes = vec![7u8; 64];
+    qbytes[1] = 4;
+    doc.quick_mask = Some(AlphaChannel::new("Quick Mask", Surface::from_interleaved(gray, area, &qbytes)));
+
+    for layers in [false, true] {
+        let r = export(&doc, "q.tif", &ExportOptions { tiff_layers: layers, ..ExportOptions::default() }).unwrap();
+        let (spp, _bps, extra, _rows, samples) = independent_samples(&r.bytes);
+        assert_eq!((spp, extra.as_slice()), (5, [0, 0].as_slice()), "{layers}");
+        let stored_spot: Vec<u8> = spot_bytes.iter().map(|b| 255 - b).collect();
+        assert_plane(&samples, 5, 3, &stored_spot);
+        // A Quick Mask is an alpha channel: stored straight, not as spot ink.
+        assert_plane(&samples, 5, 4, &qbytes);
+        let back = import("q.tif", &r.bytes).unwrap().document;
+        assert_eq!(back.channels.len(), 1, "{layers}");
+        assert_eq!(back.channels[0].surface.to_interleaved(area), spot_bytes, "{layers}");
+        let qm = back.quick_mask.as_ref().unwrap_or_else(|| panic!("{layers}: no quick mask"));
+        assert_eq!(qm.surface.to_interleaved(area), qbytes, "{layers}");
+    }
+}
+
 #[test]
 fn default_export_options_write_a_flat_tiff() {
     // Scripted and agent saves (CLI, batch, MCP) build on the defaults: layers only on request.
@@ -399,3 +1054,70 @@ fn layered_tiff_nested_past_the_cap_is_rejected() {
     let r = import("hundred.tif", &tiff_nested(100)).unwrap();
     assert_eq!(r.document.max_group_depth(), 100);
 }
+
+#[test]
+fn layered_tiff_writes_photoshops_global_layer_mask() {
+    // #9095: Photoshop reads only the composite of a layered TIFF whose `LMsk` block is empty
+    // ("There was a problem reading the layer data"); it writes 14 bytes there itself: overlay
+    // colour space 0, colour (65535, 0, 0, 0), opacity 50, kind 128, one filler byte.
+    for depth in [SampleType::U8, SampleType::U16] {
+        let d = gen_doc(ColorMode::Rgb, depth, Features::PIXELS);
+        let (_, layers) = tags(&tiff(&d, true).bytes);
+        let (isd, _) = ImageSourceData::from_bytes(&layers.expect("layer data")).expect("parse layer data");
+        let mask = isd.global_layer_mask.expect("LMsk block");
+        assert_eq!(mask.data, [0, 0, 0xff, 0xff, 0, 0, 0, 0, 0, 0, 0, 50, 128, 0], "{depth:?}");
+    }
+}
+
+/// Past MAX_EXTRA_SAMPLES (16), a layered TIFF stores the first 16 extra channels. Its channel
+/// resources must describe those 16 and no more: 16 names in 1006 and 1045, 16 DisplayInfo
+/// records and 16 identifiers, and no Quick Mask record for a Quick Mask that wasn't stored.
+#[test]
+fn channels_past_sixteen_leave_no_resources_behind() {
+    use photocraft_color::PixelFormat;
+    use photocraft_doc::{AlphaChannel, Layer};
+    use photocraft_geom::{Rect, Size};
+    use photocraft_raster::Surface;
+
+    let mut doc = Document::new("t", Size::new(8, 8), ColorMode::Rgb, SampleType::U8);
+    let fmt = doc.pixel_format();
+    let mut art = Surface::new(fmt);
+    art.fill_rect(Rect::new(0, 0, 8, 8), &photocraft_raster::from_rgba(&fmt, [1.0, 0.0, 0.0, 1.0]));
+    doc.layers.push(Layer::new("Art", LayerContent::Raster(art)));
+    let gray = PixelFormat::new(ColorMode::Grayscale, SampleType::U8, false);
+    for i in 1..=18 {
+        doc.channels.push(AlphaChannel::new(format!("Alpha {i}"), Surface::new(gray)));
+    }
+    doc.quick_mask = Some(AlphaChannel::new("Quick Mask", Surface::new(gray)));
+
+    let r = tiff(&doc, true);
+    assert!(r.warnings.iter().any(|w| w.contains("19 extra channels") && w.contains("first 16")), "{:?}", r.warnings);
+    let (resources, _) = tags(&r.bytes);
+    let (resources, _) = photocraft_psd::tiff::resources_from_bytes(&resources.expect("resources")).expect("parse resources");
+    let data = |id: u16| resources.iter().find(|r| r.id == id).map(|r| r.data.clone()).unwrap_or_default();
+    let pascal = data(1006);
+    let (mut at, mut names) = (0usize, 0usize);
+    while let Some(&len) = pascal.get(at) {
+        at += 1 + usize::from(len);
+        names += 1;
+    }
+    assert_eq!(names, 16, "1006");
+    let unicode = data(1045);
+    let (mut at, mut names) = (0usize, 0usize);
+    while let Some(b) = unicode.get(at..at + 4) {
+        at += 4 + 2 * u32::from_be_bytes([b[0], b[1], b[2], b[3]]) as usize;
+        names += 1;
+    }
+    assert_eq!(names, 16, "1045");
+    assert_eq!(data(1077).len(), 4 + 16 * 13, "1077");
+    assert_eq!(data(1053).len(), 16 * 4, "1053");
+    assert!(resources.iter().all(|r| r.id != 1022), "the Quick Mask was not stored, so its record goes");
+
+    let flat = photocraft_codecs::decode(&r.bytes).expect("decode");
+    assert_eq!(flat.meta.extra_samples.len(), 16);
+    let back = import("x.tif", &r.bytes).expect("import").document;
+    let names: Vec<&str> = back.channels.iter().map(|c| c.name.as_str()).collect();
+    let want: Vec<String> = (1..=16).map(|i| format!("Alpha {i}")).collect();
+    assert_eq!(names, want.iter().map(String::as_str).collect::<Vec<_>>());
+    assert!(back.quick_mask.is_none());
+}
diff --git a/crates/io/tests/it/tiff_type_geometry.rs b/crates/io/tests/it/tiff_type_geometry.rs
index 8a04c2dc97..326ec35cee 100644
--- a/crates/io/tests/it/tiff_type_geometry.rs
+++ b/crates/io/tests/it/tiff_type_geometry.rs
@@ -5,9 +5,14 @@ use photocraft_doc::text::{CharStyle, TextRun};
 use photocraft_doc::{Document, Layer, LayerContent, Size, TextLayer};
 use photocraft_geom::Affine;
 use photocraft_io::{ExportOptions, PsdExportOptions, document_to_psd_with, export, import, psd_to_document};
+use photocraft_psd::descriptor::{Value, VersionedDescriptor};
 
 fn document() -> Document {
-    let mut doc = Document::new("Synthetic type", Size::new(640, 400), ColorMode::Rgb, SampleType::U8);
+    document_in(ColorMode::Rgb, SampleType::U8)
+}
+
+fn document_in(mode: ColorMode, depth: SampleType) -> Document {
+    let mut doc = Document::new("Synthetic type", Size::new(640, 400), mode, depth);
     doc.resolution_dpi = 300.0;
     let mut t = TextLayer {
         text: "Synthetic".into(),
@@ -46,6 +51,49 @@ fn photoshop_mixed_order_tiff_import_keeps_editable_geometry_and_pixels() {
     assert_eq!(rerendered.content_bounds(), after.cache.as_ref().unwrap().content_bounds());
 }
 
+#[test]
+fn layered_tiff_export_keeps_tysh_text_descriptor_big_endian() {
+    for (mode, depth) in [
+        (ColorMode::Rgb, SampleType::U8),
+        (ColorMode::Rgb, SampleType::U16),
+        (ColorMode::Rgb, SampleType::F32),
+        (ColorMode::Grayscale, SampleType::U8),
+        (ColorMode::Grayscale, SampleType::U16),
+        (ColorMode::Grayscale, SampleType::F32),
+        (ColorMode::Cmyk, SampleType::U8),
+        (ColorMode::Cmyk, SampleType::U16),
+    ] {
+        let doc = document_in(mode, depth);
+        let (psd, _) = document_to_psd_with(&doc, &PsdExportOptions::default());
+        let canonical = &psd.layers()[0].block(b"TySh").unwrap().data;
+        let encoded = export(&doc, "test.tif", &ExportOptions { tiff_layers: true, ..Default::default() }).unwrap();
+        let (_, layers) = photocraft_codecs::tiff_photoshop_tags(&encoded.bytes);
+        let layers = layers.expect("layered TIFF tag 37724");
+        let block_at = layers.windows(8).position(|window| window == b"MIB8hSyT").expect("little-endian TySh block");
+        let length_at = block_at + 8;
+        let length_bytes: [u8; 4] = layers.get(length_at..length_at + 4).expect("TySh length").try_into().expect("four-byte length");
+        let length = usize::try_from(u32::from_le_bytes(length_bytes)).expect("test block length fits usize");
+        let data_at = length_at + 4;
+        let payload = layers.get(data_at..data_at + length).expect("TySh payload");
+        let (_, descriptor_len) = VersionedDescriptor::parse_prefix(canonical.get(52..).unwrap()).unwrap();
+        let text_section_len = 2 + descriptor_len;
+        assert_eq!(payload.get(50..52), Some(&50u16.to_be_bytes()[..]), "{mode:?} {depth:?}");
+        assert_eq!(payload.get(52..56), Some(&16u32.to_be_bytes()[..]), "{mode:?} {depth:?}");
+        assert_eq!(payload.get(50..50 + text_section_len), canonical.get(50..50 + text_section_len), "{mode:?} {depth:?}");
+        let descriptor = VersionedDescriptor::parse_prefix(payload.get(52..).unwrap()).unwrap().0;
+        assert!(matches!(descriptor.descriptor.get("Txt "), Some(Value::Text(value)) if value.to_string_lossy() == doc.layers[0].name));
+
+        let opened = import("photoshop.tif", &encoded.bytes).unwrap();
+        assert!(!opened.warnings.iter().any(|warning| warning.contains("TySh")), "{:?}", opened.warnings);
+        let LayerContent::Text(before) = &doc.layers[0].content else { panic!("source type") };
+        let LayerContent::Text(after) = &opened.document.layers[0].content else { panic!("imported type") };
+        assert_eq!(after.transform, before.transform, "{mode:?} {depth:?}");
+        assert_eq!(after.size_pt, before.size_pt, "{mode:?} {depth:?}");
+        assert_eq!(after.text, before.text, "{mode:?} {depth:?}");
+        assert_eq!(after.cache.as_ref().unwrap().content_bounds(), before.cache.as_ref().unwrap().content_bounds(), "{mode:?} {depth:?}");
+    }
+}
+
 #[test]
 fn foreign_or_unsafe_type_keeps_cached_pixels_without_editable_geometry() {
     let doc = document();
diff --git a/crates/paint/Cargo.toml b/crates/paint/Cargo.toml
index afb9a196d0..b72880c40c 100644
--- a/crates/paint/Cargo.toml
+++ b/crates/paint/Cargo.toml
@@ -13,5 +13,10 @@ photocraft-color = { workspace = true }
 photocraft-raster = { workspace = true }
 serde = { workspace = true }
 
+# Large tips rasterize, accumulate and composite in parallel (the same pixels as serially).
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+rayon = { workspace = true }
+
 [dev-dependencies]
+photocraft-cms = { workspace = true }
 serde_json = { workspace = true }
diff --git a/crates/paint/examples/big_dab_bench.rs b/crates/paint/examples/big_dab_bench.rs
new file mode 100644
index 0000000000..a31265224c
--- /dev/null
+++ b/crates/paint/examples/big_dab_bench.rs
@@ -0,0 +1,44 @@
+//! Where a large brush's time goes: one dab of a 2000 px tip, by stage.
+//! `cargo run --release -p photocraft-paint --example big_dab_bench [size] [hardness]`
+use photocraft_color::PixelFormat;
+use photocraft_geom::Rect;
+use photocraft_paint::{BrushContext, BrushSettings, Dab, StrokePoint, StrokeRenderer};
+use photocraft_raster::Surface;
+use std::time::Instant;
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    let size: f32 = args.get(1).and_then(|s| s.parse().ok()).unwrap_or(2000.0);
+    let hardness: f32 = args.get(2).and_then(|s| s.parse().ok()).unwrap_or(0.0);
+    let brush = BrushSettings { size, hardness, spacing: 0.25, color: [1.0, 0.0, 0.0, 1.0], ..Default::default() };
+    let fmt = PixelFormat::RGBA8;
+    let mut pre = Surface::new(fmt);
+    pre.fill_rect(Rect::new(0, 0, 4928, 3280), &[0.5, 0.5, 0.5, 1.0]);
+    let mut target = pre.clone();
+    // Stage 1: the tip's coverage alone.
+    let ctx = BrushContext::new(&brush);
+    let dab = Dab::round(photocraft_geom::Point::new(2464.0, 1640.0), size / 2.0, 1.0);
+    let rect = ctx.dab_rect(&dab, false);
+    let mut cov = Vec::new();
+    let t = Instant::now();
+    ctx.rasterize(&dab, false, rect, &mut cov);
+    let raster = t.elapsed();
+    println!("tip {size} px, hardness {hardness}: dab rect {}x{} = {:.1} MP", rect.width(), rect.height(), rect.width() as f64 * rect.height() as f64 / 1e6);
+    println!("  rasterize (coverage):      {:>7.1} ms", raster.as_secs_f64() * 1e3);
+    // Stage 2+3: push through the renderer (rasterize + accumulate), then composite.
+    let mut r = StrokeRenderer::new(&brush, Some(fmt), 1.0);
+    let t = Instant::now();
+    // Two points a pixel apart: the generator places the first dab at once (a lone point waits).
+    r.push(&[StrokePoint::new(2464.0, 1640.0, 1.0), StrokePoint::new(2465.0, 1640.0, 1.0)]);
+    let push = t.elapsed();
+    println!("  push (rasterize+accumulate): {:>5.1} ms  (accumulate ≈ {:.1} ms)", push.as_secs_f64() * 1e3, push.saturating_sub(raster).as_secs_f64() * 1e3);
+    let t = Instant::now();
+    let dmg = r.composite(&pre, &mut target, None, false, false);
+    let comp = t.elapsed();
+    println!("  composite (dirty tiles):   {:>7.1} ms  over {}x{}", comp.as_secs_f64() * 1e3, dmg.width(), dmg.height());
+    // A second dab half a spacing away, as a stroke does: the same again.
+    let t = Instant::now();
+    r.push(&[StrokePoint::new(2464.0 + f64::from(size) * 0.25, 1640.0, 1.0), StrokePoint::new(2466.0 + f64::from(size) * 0.25, 1640.0, 1.0)]);
+    let dmg = r.composite(&pre, &mut target, None, false, false);
+    println!("  next dab push+composite:   {:>7.1} ms  over {}x{}", t.elapsed().as_secs_f64() * 1e3, dmg.width(), dmg.height());
+}
diff --git a/crates/paint/examples/stroke_bench.rs b/crates/paint/examples/stroke_bench.rs
new file mode 100644
index 0000000000..2a6b59cfa7
--- /dev/null
+++ b/crates/paint/examples/stroke_bench.rs
@@ -0,0 +1,64 @@
+//! A long stroke of one tip, timed per dab: a zigzag over a 4928×3280 RGBA8 document that sweeps
+//! the whole page, `push` then `composite` after every point, as painting does per frame. Small
+//! tips are the everyday case; a long stroke grows the stroke's tile map to thousands of tiles,
+//! and the time per dab must not grow with it.
+//! `cargo run --release -p photocraft-paint --example stroke_bench -- [size] [hardness] [dabs]`
+use photocraft_color::PixelFormat;
+use photocraft_geom::Rect;
+use photocraft_paint::{BrushSettings, StrokePoint, StrokeRenderer};
+use photocraft_raster::Surface;
+use std::time::Instant;
+
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    let size: f32 = args.get(1).and_then(|s| s.parse().ok()).unwrap_or(20.0);
+    let hardness: f32 = args.get(2).and_then(|s| s.parse().ok()).unwrap_or(0.0);
+    let dabs: usize = args.get(3).and_then(|s| s.parse().ok()).unwrap_or(6000);
+    let (w, h) = (4928.0f64, 3280.0f64);
+    let brush = BrushSettings { size, hardness, spacing: 0.25, color: [1.0, 0.0, 0.0, 1.0], ..Default::default() };
+    let fmt = PixelFormat::RGBA8;
+    let mut pre = Surface::new(fmt);
+    pre.fill_rect(Rect::new(0, 0, w as i32, h as i32), &[0.5, 0.5, 0.5, 1.0]);
+    let mut target = pre.clone();
+    // Segments from the top margin to the bottom one and back, advancing across the width so that
+    // `dabs` dabs at the brush's spacing sweep the document once.
+    let step = f64::from(size) * 0.25;
+    let margin = f64::from(size);
+    let span = h - 2.0 * margin;
+    let segments = ((dabs as f64 * step) / span).ceil().max(1.0) as usize;
+    let dx = (w - 2.0 * margin) / segments as f64;
+    let mut r = StrokeRenderer::new(&brush, Some(fmt), 1.0);
+    let (mut t_push, mut t_comp) = (0.0f64, 0.0f64);
+    let t_all = Instant::now();
+    let mut pos = (margin, margin);
+    r.push(&[StrokePoint::new(pos.0, pos.1, 1.0)]);
+    let mut pushes = 0usize;
+    'stroke: for seg in 0..segments {
+        let (x0, y0) = pos;
+        let (x1, y1) = (margin + (seg + 1) as f64 * dx, if seg % 2 == 0 { h - margin } else { margin });
+        let n = (((x1 - x0).powi(2) + (y1 - y0).powi(2)).sqrt() / step).ceil().max(1.0) as usize;
+        for i in 1..=n {
+            let f = i as f64 / n as f64;
+            let t = Instant::now();
+            r.push(&[StrokePoint::new(x0 + (x1 - x0) * f, y0 + (y1 - y0) * f, 1.0)]);
+            let tp = t.elapsed().as_secs_f64();
+            r.composite(&pre, &mut target, None, false, false);
+            t_comp += t.elapsed().as_secs_f64() - tp;
+            t_push += tp;
+            pushes += 1;
+            if r.dab_count() >= dabs {
+                break 'stroke;
+            }
+        }
+        pos = (x1, y1);
+    }
+    let total = t_all.elapsed().as_secs_f64();
+    let placed = r.dab_count();
+    println!(
+        "tip {size} px, hardness {hardness}: {placed} dabs in {pushes} pushes over {segments} segments: {:.0} ms (push {:.0}, composite {:.0}), {:.1} µs per dab",
+        total * 1e3,
+        t_push * 1e3,
+        t_comp * 1e3,
+        total * 1e6 / placed.max(1) as f64
+    );
+}
diff --git a/crates/paint/src/brush_tests.rs b/crates/paint/src/brush_tests.rs
index d71e245fc5..d573e7cb3f 100644
--- a/crates/paint/src/brush_tests.rs
+++ b/crates/paint/src/brush_tests.rs
@@ -278,6 +278,58 @@ fn stroke_has_no_seams() {
     }
 }
 
+#[test]
+fn hard_round_presets_have_smooth_large_stroke_outlines() {
+    // #8842: the centre can be solid while widely spaced discs scallop the outline.
+    // Measure the rendered 50% edge of a 150 px stroke, including its sub-pixel position.
+    for preset in crate::presets::builtin().into_iter().filter(|p| p.name.starts_with("Hard Round")) {
+        for fmt in [PixelFormat::RGBA8, PixelFormat::RGBA16, PixelFormat::RGBA32F] {
+            for smoothing in [0.0, 0.49] {
+                let mut b = preset.brush.clone();
+                b.size = 150.0;
+                b.smoothing.amount = smoothing;
+                let mut s = Surface::new(fmt);
+                render_stroke(&mut s, &b, &line(100.0, 800.0, 120.0), None, false, 1.0);
+                let (mut min, mut max) = (f32::INFINITY, f32::NEG_INFINITY);
+                for x in 220..680 {
+                    let edge = (0..120)
+                        .find_map(|y| {
+                            let (a, next) = (s.rgba(x, y)[3], s.rgba(x, y + 1)[3]);
+                            (a <= 0.5 && next > 0.5).then(|| y as f32 + (0.5 - a) / (next - a))
+                        })
+                        .expect("a full-pressure stroke has a half-coverage edge");
+                    min = min.min(edge);
+                    max = max.max(edge);
+                }
+                assert!(max - min < 0.25, "{} {fmt:?} smoothing {smoothing}: scalloped edge spans {} px", preset.name, max - min);
+            }
+        }
+    }
+}
+
+#[test]
+fn hard_round_presets_have_continuous_pressure_opacity_tapers() {
+    // #8842 also shows nested disc boundaries when pressure controls opacity and size.
+    // A smooth input ramp must not turn into several-percent steps between adjacent pixels.
+    let points: Vec<_> =
+        (0..=100).map(|i| StrokePoint { time: i as f64 * 8.0, ..StrokePoint::new(100.0 + i as f64 * 7.0, 120.0, 0.95 - i as f32 * 0.009) }).collect();
+    for preset in crate::presets::builtin().into_iter().filter(|p| p.name.starts_with("Hard Round")) {
+        for fmt in [PixelFormat::RGBA8, PixelFormat::RGBA16, PixelFormat::RGBA32F] {
+            for smoothing in [0.0, 0.49] {
+                let mut b = preset.brush.clone();
+                b.size = 150.0;
+                b.pressure_opacity = true;
+                b.smoothing.amount = smoothing;
+                let mut s = Surface::new(fmt);
+                render_stroke(&mut s, &b, &points, None, false, 1.0);
+                assert!(s.rgba(200, 120)[3] > 0.7 && s.rgba(699, 120)[3] < 0.3, "{}: the stroke must still taper", preset.name);
+                let max_jump = (200..699).map(|x| (s.rgba(x + 1, 120)[3] - s.rgba(x, 120)[3]).abs()).fold(0.0f32, f32::max);
+                assert!(max_jump < 0.02, "{} {fmt:?} smoothing {smoothing}: opacity jumps by {max_jump}", preset.name);
+            }
+        }
+    }
+}
+
 // ---------- dynamics ----------
 
 #[test]
@@ -1688,6 +1740,106 @@ fn an_aliased_stroke_at_partial_opacity_is_one_flat_colour() {
     }
 }
 
+/// Large tips rasterize, accumulate and composite in parallel (rows of a dab, tiles of a stroke);
+/// the pixels are the ones the serial path gives, with 8-bit dithering, a selection, Dissolve and
+/// per-dab colour included.
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn large_tips_render_the_same_in_parallel_and_serially() {
+    let mut sel = Surface::new(PixelFormat::GRAY8);
+    sel.fill_rect(Rect::new(0, 0, 900, 700), &[1.0]);
+    sel.fill_rect(Rect::new(300, 0, 400, 700), &[0.0]);
+    let strokes: Vec<(BrushSettings, Vec<StrokePoint>)> = vec![
+        (BrushSettings { size: 700.0, hardness: 0.0, flow: 0.6, color: [0.9, 0.2, 0.1, 1.0], ..brush() }, line(200.0, 700.0, 350.0)),
+        (
+            BrushSettings { size: 420.0, hardness: 1.0, opacity: 0.5, mode: BlendMode::Dissolve, color: [0.1, 0.5, 0.9, 1.0], ..brush() },
+            line(150.0, 750.0, 300.0),
+        ),
+        (
+            BrushSettings {
+                size: 500.0,
+                hardness: 0.3,
+                color_dynamics: ColorDynamics { enabled: true, hue_jitter: 0.5, per_tip: true, ..Default::default() },
+                color: [0.2, 0.8, 0.3, 1.0],
+                ..brush()
+            },
+            line(100.0, 800.0, 400.0),
+        ),
+    ];
+    let render = |parallel_from: usize| -> Vec<Vec<f32>> {
+        crate::render::set_parallel_min_pixels(parallel_from);
+        strokes
+            .iter()
+            .map(|(b, pts)| {
+                let mut s = Surface::new(PixelFormat::RGBA8);
+                s.fill_rect(Rect::new(0, 0, 900, 700), &[0.5, 0.5, 0.5, 1.0]);
+                let (mut with_sel, mut plain) = (s.clone(), s);
+                render_stroke(&mut with_sel, b, pts, Some(&sel), false, 1.0);
+                render_stroke(&mut plain, b, pts, None, false, 1.0);
+                let mut px = with_sel.read_region(Rect::new(0, 0, 900, 700));
+                px.extend(plain.read_region(Rect::new(0, 0, 900, 700)));
+                px
+            })
+            .collect()
+    };
+    // The threshold is process-wide: put the default back however the test ends, a panic
+    // inside a render included.
+    struct Restore;
+    impl Drop for Restore {
+        fn drop(&mut self) {
+            crate::render::set_parallel_min_pixels(crate::render::DEFAULT_PARALLEL_MIN_PIXELS);
+        }
+    }
+    let _restore = Restore;
+    let parallel = render(0);
+    let serial = render(usize::MAX);
+    for (i, (p, s)) in parallel.iter().zip(&serial).enumerate() {
+        assert_eq!(p.len(), s.len());
+        let diff = p.iter().zip(s).filter(|(a, b)| a != b).count();
+        assert_eq!(diff, 0, "stroke {i}: {diff} pixels differ between the parallel and the serial render");
+        assert!(p.iter().any(|v| (*v - 0.5).abs() > 0.1), "stroke {i} painted something");
+    }
+}
+
+/// A CMYK document with its own profile: blend modes other than Normal convert each pixel through
+/// that profile, which is active per thread, so a stroke composited in parallel gives the pixels the
+/// serial path gives (the workers enter the caller's CMYK space too).
+#[cfg(not(target_arch = "wasm32"))]
+#[test]
+fn a_parallel_composite_converts_through_the_documents_cmyk_profile() {
+    use photocraft_cms::synth::{CmykParams, cmyk_profile};
+    use photocraft_color::convert::{CmykSpace, with_cmyk_space};
+    let profile =
+        cmyk_profile(&CmykParams { description: "Brush Test CMYK".into(), tvi: [0.26, 0.26, 0.26, 0.3], grid_a2b: 5, grid_b2a: 9, ..Default::default() });
+    let bytes = profile.to_bytes();
+    let Some(space) = CmykSpace::for_profile(Some(&bytes)) else { panic!("the synthetic profile is a CMYK space") };
+    let fmt = PixelFormat::new(ColorMode::Cmyk, SampleType::U16, true);
+    // A 40 px Multiply line over 1100 px dirties more than 16 tiles: the composite's batch is
+    // worth the threads at the default threshold, and always at threshold 0.
+    let b = BrushSettings { size: 40.0, hardness: 0.5, mode: BlendMode::Multiply, color: [0.2, 0.4, 0.9, 1.0], ..brush() };
+    let pts = line(40.0, 1140.0, 60.0);
+    let full = Rect::new(0, 0, 1200, 120);
+    let render = |parallel_from: usize| -> Vec<f32> {
+        crate::render::set_parallel_min_pixels(parallel_from);
+        let mut s = Surface::new(fmt);
+        s.fill_rect(full, &[0.1, 0.5, 0.3, 0.05, 1.0]);
+        with_cmyk_space(Some(&space), || render_stroke(&mut s, &b, &pts, None, false, 1.0));
+        s.read_region(full)
+    };
+    struct Restore;
+    impl Drop for Restore {
+        fn drop(&mut self) {
+            crate::render::set_parallel_min_pixels(crate::render::DEFAULT_PARALLEL_MIN_PIXELS);
+        }
+    }
+    let _restore = Restore;
+    let parallel = render(0);
+    let serial = render(usize::MAX);
+    let diff = parallel.iter().zip(&serial).filter(|(a, b)| a != b).count();
+    assert_eq!(diff, 0, "{diff} samples differ between the parallel and the serial composite in a profiled CMYK document");
+    assert!(serial.chunks(5).any(|p| (p[1] - 0.5).abs() > 0.05), "the stroke painted something");
+}
+
 /// Photoshop (measured): a 100 px brush with a 20 px Dual Brush tip resized to 50 / 2 / 1 px has a
 /// 10 / 0.4 / 0.2 px dual tip, unrounded and with no floor, and back at 100 px it is 20 px again; past
 /// 5000 px the dual tip is capped there and the proportion is lost (#4809).
diff --git a/crates/paint/src/mixer.rs b/crates/paint/src/mixer.rs
index 49abb127a1..f620520b9b 100644
--- a/crates/paint/src/mixer.rs
+++ b/crates/paint/src/mixer.rs
@@ -6,7 +6,7 @@
 //! weight. The reservoir amount drains per dab unless `load` is 100 %, so low Load strokes dry out.
 //! A dry brush (`wet = 0`) paints only reservoir colour; an empty, wet brush smears canvas colour.
 
-use photocraft_raster::{Surface, from_rgba, to_rgba};
+use photocraft_raster::{Surface, from_rgba, from_rgba_into, to_rgba};
 use serde::{Deserialize, Serialize};
 
 use crate::Stroke;
@@ -27,6 +27,7 @@ pub struct MixerSettings {
     /// Pick up colour from all visible layers instead of the target layer only.
     pub sample_all_layers: bool,
     /// Load the brush with the stroke color after each stroke (the automatic Load option).
+    #[serde(alias = "reloadAfterStroke")]
     pub load_after_stroke: bool,
     /// Empty the brush after each stroke (the automatic Clean option).
     pub clean_after_stroke: bool,
@@ -34,7 +35,7 @@ pub struct MixerSettings {
 
 impl Default for MixerSettings {
     fn default() -> Self {
-        Self { wet: 0.5, load: 0.5, mix: 0.5, flow: 1.0, sample_all_layers: false, load_after_stroke: true, clean_after_stroke: true }
+        Self { wet: 0.5, load: 0.5, mix: 0.5, flow: 1.0, sample_all_layers: false, clean_after_stroke: true, load_after_stroke: true }
     }
 }
 
@@ -48,6 +49,8 @@ pub struct MixerState {
     pub amount: f32,
     /// Colour picked up from the canvas (straight RGBA), None = clean.
     pub pickup: Option<[f32; 4]>,
+    /// A bounded 64 x 64 spatial load in tip-local coordinates. Empty cells carry no paint.
+    pub spatial: Option<Vec<[f32; 4]>>,
     /// The color recorded by the last stroke (its color) or the last Load Brush or Clean Brush
     /// (the foreground). None = no stroke, load or clean yet.
     pub color: Option<[f32; 4]>,
@@ -56,11 +59,13 @@ pub struct MixerState {
 impl MixerState {
     /// Load Brush: fill the reservoir with a color (full).
     pub fn load(&mut self, color: [f32; 4]) {
+        self.spatial = None;
         self.reservoir = Some(color);
         self.amount = 1.0;
     }
     /// Clean Brush: empty the reservoir and the pickup well.
     pub fn clean(&mut self) {
+        self.spatial = None;
         self.reservoir = None;
         self.amount = 0.0;
         self.pickup = None;
@@ -76,11 +81,16 @@ impl MixerState {
     /// After a stroke in `color`: the automatic Clean empties the brush, then the automatic Load
     /// fills the reservoir again.
     pub fn end_stroke(&mut self, color: [f32; 4], clean: bool, load: bool) {
+        // Automatic Load replenishes a sampled tip as well as a solid-color load.
+        // Move its bounded buffer through Clean instead of allocating a copy.
+        let spatial = if load { self.spatial.take() } else { None };
+        let paint = if spatial.is_some() { self.reservoir.unwrap_or(color) } else { color };
         if clean {
             self.clean();
         }
         if load {
-            self.load(color);
+            self.load(paint);
+            self.spatial = spatial;
         }
         self.color = Some(color);
     }
@@ -91,6 +101,34 @@ impl MixerState {
     }
 }
 
+/// Sample a spatial load at a dab pixel using the dab's rotation, aspect and flips.
+/// Keeping the reservoir in tip coordinates lets it follow subsequent brush poses.
+pub fn load_at(load: &[[f32; 4]], dab: &crate::Dab, x: f32, y: f32) -> [f32; 4] {
+    let mut dx = x - dab.center.x as f32;
+    let mut dy = y - dab.center.y as f32;
+    if dab.proj_scale < 0.999 {
+        let (sin, cos) = dab.proj_angle.sin_cos();
+        let along = (dx * cos - dy * sin) * (1.0 / dab.proj_scale.max(0.05) - 1.0);
+        dx += along * cos;
+        dy -= along * sin;
+    }
+    let (sin, cos) = dab.angle.sin_cos();
+    let mut u = (dx * cos - dy * sin) / dab.radius.max(0.01);
+    let mut v = (dx * sin + dy * cos) / (dab.radius * dab.roundness).max(0.5);
+    if dab.flip_x {
+        u = -u;
+    }
+    if dab.flip_y {
+        v = -v;
+    }
+    if !(-1.0..1.0).contains(&u) || !(-1.0..1.0).contains(&v) {
+        return [0.0; 4];
+    }
+    let col = ((u + 1.0) * 32.0) as usize;
+    let row = ((v + 1.0) * 32.0) as usize;
+    load.get(row * 64 + col).copied().unwrap_or([0.0; 4])
+}
+
 /// Paint a Mixer Brush stroke. `sample` is the surface colour is picked up from (the layer itself
 /// when None; a flattened composite for Sample All Layers). Returns the damaged rectangle.
 pub fn apply_mixer_stroke(
@@ -103,6 +141,50 @@ pub fn apply_mixer_stroke(
     lock_transparency: bool,
 ) -> Rect {
     let fmt = target.format();
+    let mut st = stroke.clone();
+    st.brush.opacity = 1.0;
+    apply_dab_stroke(target, &st, selection, lock_transparency, 0, |work, fp| {
+        apply_mixer_dab(work, fp, fmt, sample, m, state, lock_transparency);
+    })
+}
+
+/// One incremental wet-paint dab, shared by recorded strokes and the live document transaction.
+pub fn apply_mixer_dab(
+    work: &mut crate::retouch::Region,
+    fp: &crate::retouch::Footprint,
+    fmt: photocraft_color::PixelFormat,
+    sample: Option<&Surface>,
+    m: &MixerSettings,
+    state: &mut MixerState,
+    lock_transparency: bool,
+) {
+    let sample = sample.map(|surface| {
+        let source = crate::retouch::Region::read(surface, work.rect);
+        if surface.format().mode == fmt.mode && surface.format().alpha == fmt.alpha {
+            source
+        } else {
+            let mut native = crate::retouch::Region::new(work.rect, fmt.channels());
+            for (src, dst) in source.data.chunks_exact(source.ch).zip(native.data.chunks_exact_mut(native.ch)) {
+                from_rgba_into(&fmt, to_rgba(&surface.format(), src), dst);
+            }
+            native
+        }
+    });
+    apply_mixer_dab_region(work, fp, fmt, sample.as_ref(), m, state, lock_transparency);
+}
+
+/// Contiguous native-channel sample variant. `sample` must have the same rectangle and
+/// channel layout as `work`. The live compositor supplies it directly, avoiding a tiled
+/// temporary surface and a heap allocation for every sampled/deposited pixel.
+pub fn apply_mixer_dab_region(
+    work: &mut crate::retouch::Region,
+    fp: &crate::retouch::Footprint,
+    fmt: photocraft_color::PixelFormat,
+    sample: Option<&crate::retouch::Region>,
+    m: &MixerSettings,
+    state: &mut MixerState,
+    lock_transparency: bool,
+) {
     let n = fmt.channels();
     let a = alpha_index(&fmt);
     let nc = fmt.mode.color_channels();
@@ -117,70 +199,81 @@ pub fn apply_mixer_stroke(
     let mut amount = if res.is_some() { state.amount.clamp(0.0, 1.0) } else { 0.0 };
     let mut pickup: Option<Vec<f32>> = state.pickup.map(native);
     let (wet, mix, flow, load) = (m.wet.clamp(0.0, 1.0), m.mix.clamp(0.0, 1.0), m.flow.clamp(0.0, 1.0), m.load.clamp(0.0, 1.0));
-    let mut st = stroke.clone();
-    st.brush.opacity = 1.0;
     let mut acc = vec![0.0f32; n];
     let mut paint = vec![0.0f32; n];
-    let dmg = apply_dab_stroke(target, &st, selection, lock_transparency, 0, |work, fp| {
-        // Transfer › Wetness / Mix Jitter scale the settings per dab.
-        let (wet, mix) = (wet * fp.dab.wet.clamp(0.0, 1.0), mix * fp.dab.mix.clamp(0.0, 1.0));
-        // Sample the canvas under the dab.
-        acc.iter_mut().for_each(|v| *v = 0.0);
-        let (mut wsum, mut asum) = (0.0f32, 0.0f32);
-        let r = fp.rect.intersect(&work.rect);
+    // Transfer › Wetness / Mix Jitter scale the settings per dab.
+    let (wet, mix) = (wet * fp.dab.wet.clamp(0.0, 1.0), mix * fp.dab.mix.clamp(0.0, 1.0));
+    // Sample the canvas under the dab.
+    acc.iter_mut().for_each(|v| *v = 0.0);
+    let (mut wsum, mut asum) = (0.0f32, 0.0f32);
+    let r = fp.rect.intersect(&work.rect);
+    for y in r.y0..r.y1 {
+        for x in r.x0..r.x1 {
+            let w = fp.at(x, y);
+            if w <= 0.0 {
+                continue;
+            }
+            let px = sample.unwrap_or(work).px(x, y);
+            let al = a.map_or(1.0, |ai| px[ai]);
+            for c in 0..nc {
+                acc[c] += px[c] * w * al;
+            }
+            wsum += w;
+            asum += w * al;
+        }
+    }
+    if asum > 1e-6 && wet > 0.0 {
+        let ca = asum / wsum.max(1e-6);
+        let canvas: Vec<f32> = (0..n).map(|c| if c < nc { acc[c] / asum } else { 1.0 }).collect();
+        pickup = Some(match pickup.take() {
+            None => canvas,
+            Some(p) => p.iter().zip(&canvas).map(|(p, c)| p + (c - p) * PICKUP_RATE * wet * ca).collect(),
+        });
+    }
+    let wr = if res.is_some() { amount * (1.0 - mix * wet) } else { 0.0 };
+    let wp = if pickup.is_some() { mix * wet } else { 0.0 };
+    let total = wr + wp;
+    if total > 1e-6 {
+        for c in 0..n {
+            let rv = res.as_ref().map_or(0.0, |v| v[c]);
+            let pv = pickup.as_ref().map_or(0.0, |v| v[c]);
+            paint[c] = (rv * wr + pv * wp) / total;
+        }
+        let dep = total.min(1.0) * flow;
+        let mut local = vec![0.0; n];
+        let mut mixed = vec![0.0; n];
         for y in r.y0..r.y1 {
             for x in r.x0..r.x1 {
-                let w = fp.at(x, y);
-                if w <= 0.0 {
-                    continue;
-                }
-                let px: Vec<f32> = match sample {
-                    Some(s) => {
-                        let v = s.pixel(x, y);
-                        if s.format() == fmt { v } else { from_rgba(&fmt, s.rgba(x, y)) }
-                    }
-                    None => work.px(x, y).to_vec(),
-                };
-                let al = a.map_or(1.0, |ai| px[ai]);
-                for c in 0..nc {
-                    acc[c] += px[c] * w * al;
-                }
-                wsum += w;
-                asum += w * al;
-            }
-        }
-        if asum > 1e-6 && wet > 0.0 {
-            let ca = asum / wsum.max(1e-6);
-            let canvas: Vec<f32> = (0..n).map(|c| if c < nc { acc[c] / asum } else { 1.0 }).collect();
-            pickup = Some(match pickup.take() {
-                None => canvas,
-                Some(p) => p.iter().zip(&canvas).map(|(p, c)| p + (c - p) * PICKUP_RATE * wet * ca).collect(),
-            });
-        }
-        let wr = if res.is_some() { amount * (1.0 - mix * wet) } else { 0.0 };
-        let wp = if pickup.is_some() { mix * wet } else { 0.0 };
-        let total = wr + wp;
-        if total > 1e-6 {
-            for c in 0..n {
-                let rv = res.as_ref().map_or(0.0, |v| v[c]);
-                let pv = pickup.as_ref().map_or(0.0, |v| v[c]);
-                paint[c] = (rv * wr + pv * wp) / total;
-            }
-            let dep = total.min(1.0) * flow;
-            for y in r.y0..r.y1 {
-                for x in r.x0..r.x1 {
-                    let k = fp.at(x, y) * dep;
-                    if k > 0.0 {
+                let k = fp.at(x, y) * dep;
+                if k > 0.0 {
+                    if let Some(load) = &state.spatial {
+                        let loaded = load_at(load, &fp.dab, x as f32 + 0.5, y as f32 + 0.5);
+                        from_rgba_into(&fmt, loaded, &mut local);
+                        let local_wr = wr * loaded[3];
+                        let local_total = local_wr + wp;
+                        if local_total > 1e-6 {
+                            for (c, value) in mixed.iter_mut().enumerate() {
+                                *value = (local.get(c).copied().unwrap_or(0.0) * local_wr
+                                    + pickup.as_ref().and_then(|p| p.get(c)).copied().unwrap_or(0.0) * wp)
+                                    / local_total;
+                            }
+                            if let Some(ai) = a
+                                && let Some(alpha) = mixed.get_mut(ai)
+                            {
+                                *alpha = 1.0;
+                            }
+                            over_native(&fmt, work.px_mut(x, y), &mixed, fp.at(x, y) * local_total.min(1.0) * flow, lock_transparency);
+                        }
+                    } else {
                         over_native(&fmt, work.px_mut(x, y), &paint, k, lock_transparency);
                     }
                 }
             }
         }
-        amount *= 1.0 - 0.08 * (1.0 - load);
-    });
+    }
+    amount *= 1.0 - 0.08 * (1.0 - load);
     state.amount = amount;
     state.pickup = pickup.map(|p| to_rgba(&fmt, &p));
-    dmg
 }
 
 #[cfg(test)]
@@ -284,6 +377,38 @@ mod tests {
         assert_eq!((st.reservoir, st.amount, st.pickup), (Some(green), 1.0, None));
     }
 
+    /// Spatial paint reservoirs honor independent automatic clean and reload choices.
+    #[test]
+    fn spatial_load_obeys_automatic_clean_and_load() {
+        let foreground = [0.0, 0.0, 1.0, 1.0];
+        let sampled = [1.0, 0.0, 0.0, 1.0];
+        let tip = vec![sampled; 4096];
+        let mut state = MixerState::default();
+        state.load(sampled);
+        state.spatial = Some(tip.clone());
+        state.color = Some(foreground);
+        state.amount = 0.1;
+        state.end_stroke(foreground, true, true);
+        assert_eq!(state.spatial.as_ref(), Some(&tip));
+        assert_eq!((state.reservoir, state.amount, state.pickup), (Some(sampled), 1.0, None));
+        state.begin_stroke(foreground);
+        assert_eq!(state.spatial.as_ref(), Some(&tip));
+        state.end_stroke(foreground, true, false);
+        assert!(state.spatial.is_none() && state.reservoir.is_none());
+        state.begin_stroke(foreground);
+        assert!(state.reservoir.is_none(), "Clean stays empty until a new color or Load");
+    }
+
+    /// Older serialized reload settings remain compatible with the automatic load field.
+    #[test]
+    fn earlier_reload_setting_deserializes_as_automatic_load() {
+        let settings: MixerSettings = serde_json::from_value(serde_json::json!({"reloadAfterStroke":false})).unwrap();
+        assert!(!settings.load_after_stroke);
+        let saved = serde_json::to_value(settings).unwrap();
+        assert_eq!(saved["loadAfterStroke"], false);
+        assert!(saved.get("reloadAfterStroke").is_none());
+    }
+
     #[test]
     fn dry_empty_brush_paints_nothing() {
         let mut s = Surface::new(PixelFormat::RGBA8);
@@ -313,3 +438,7 @@ mod tests {
         assert!(run(1.0).is_some_and(|p| p[2] > 0.2));
     }
 }
+
+#[cfg(test)]
+#[path = "mixer_reference_tests.rs"]
+mod reference_tests;
diff --git a/crates/paint/src/mixer_reference_tests.rs b/crates/paint/src/mixer_reference_tests.rs
new file mode 100644
index 0000000000..73242fa2f9
--- /dev/null
+++ b/crates/paint/src/mixer_reference_tests.rs
@@ -0,0 +1,154 @@
+// Frozen pre-optimization dab kernel. Keep independent of the optimized implementation.
+use super::*;
+/// Keep the allocation-heavy scalar kernel independent so optimizations cannot silently change pickup or blending.
+fn reference(
+    work: &mut crate::retouch::Region,
+    fp: &crate::retouch::Footprint,
+    fmt: photocraft_color::PixelFormat,
+    sample: Option<&Surface>,
+    m: &MixerSettings,
+    state: &mut MixerState,
+    lock_transparency: bool,
+) {
+    let n = fmt.channels();
+    let a = alpha_index(&fmt);
+    let nc = fmt.mode.color_channels();
+    let native = |c: [f32; 4]| {
+        let mut v = from_rgba(&fmt, c);
+        if let Some(ai) = a {
+            v[ai] = 1.0;
+        }
+        v
+    };
+    let res = state.reservoir.map(native);
+    let mut amount = if res.is_some() { state.amount.clamp(0.0, 1.0) } else { 0.0 };
+    let mut pickup: Option<Vec<f32>> = state.pickup.map(native);
+    let (wet, mix, flow, load) = (m.wet.clamp(0.0, 1.0), m.mix.clamp(0.0, 1.0), m.flow.clamp(0.0, 1.0), m.load.clamp(0.0, 1.0));
+    let mut acc = vec![0.0f32; n];
+    let mut paint = vec![0.0f32; n];
+    // Transfer › Wetness / Mix Jitter scale the settings per dab.
+    let (wet, mix) = (wet * fp.dab.wet.clamp(0.0, 1.0), mix * fp.dab.mix.clamp(0.0, 1.0));
+    // Sample the canvas under the dab.
+    acc.iter_mut().for_each(|v| *v = 0.0);
+    let (mut wsum, mut asum) = (0.0f32, 0.0f32);
+    let r = fp.rect.intersect(&work.rect);
+    for y in r.y0..r.y1 {
+        for x in r.x0..r.x1 {
+            let w = fp.at(x, y);
+            if w <= 0.0 {
+                continue;
+            }
+            let px: Vec<f32> = match sample {
+                Some(s) => {
+                    let v = s.pixel(x, y);
+                    if s.format() == fmt { v } else { from_rgba(&fmt, s.rgba(x, y)) }
+                }
+                None => work.px(x, y).to_vec(),
+            };
+            let al = a.map_or(1.0, |ai| px[ai]);
+            for c in 0..nc {
+                acc[c] += px[c] * w * al;
+            }
+            wsum += w;
+            asum += w * al;
+        }
+    }
+    if asum > 1e-6 && wet > 0.0 {
+        let ca = asum / wsum.max(1e-6);
+        let canvas: Vec<f32> = (0..n).map(|c| if c < nc { acc[c] / asum } else { 1.0 }).collect();
+        pickup = Some(match pickup.take() {
+            None => canvas,
+            Some(p) => p.iter().zip(&canvas).map(|(p, c)| p + (c - p) * PICKUP_RATE * wet * ca).collect(),
+        });
+    }
+    let wr = if res.is_some() { amount * (1.0 - mix * wet) } else { 0.0 };
+    let wp = if pickup.is_some() { mix * wet } else { 0.0 };
+    let total = wr + wp;
+    if total > 1e-6 {
+        for c in 0..n {
+            let rv = res.as_ref().map_or(0.0, |v| v[c]);
+            let pv = pickup.as_ref().map_or(0.0, |v| v[c]);
+            paint[c] = (rv * wr + pv * wp) / total;
+        }
+        let dep = total.min(1.0) * flow;
+        for y in r.y0..r.y1 {
+            for x in r.x0..r.x1 {
+                let k = fp.at(x, y) * dep;
+                if k > 0.0 {
+                    if let Some(load) = &state.spatial {
+                        let loaded = load_at(load, &fp.dab, x as f32 + 0.5, y as f32 + 0.5);
+                        let local = from_rgba(&fmt, loaded);
+                        let local_wr = wr * loaded[3];
+                        let local_total = local_wr + wp;
+                        if local_total > 1e-6 {
+                            let mut mixed = paint.clone();
+                            for (c, value) in mixed.iter_mut().enumerate() {
+                                *value = (local.get(c).copied().unwrap_or(0.0) * local_wr
+                                    + pickup.as_ref().and_then(|p| p.get(c)).copied().unwrap_or(0.0) * wp)
+                                    / local_total;
+                            }
+                            if let Some(ai) = a
+                                && let Some(alpha) = mixed.get_mut(ai)
+                            {
+                                *alpha = 1.0;
+                            }
+                            over_native(&fmt, work.px_mut(x, y), &mixed, fp.at(x, y) * local_total.min(1.0) * flow, lock_transparency);
+                        }
+                    } else {
+                        over_native(&fmt, work.px_mut(x, y), &paint, k, lock_transparency);
+                    }
+                }
+            }
+        }
+    }
+    amount *= 1.0 - 0.08 * (1.0 - load);
+    state.amount = amount;
+    state.pickup = pickup.map(|p| to_rgba(&fmt, &p));
+}
+
+/// The incremental kernel matches the frozen reference across color models, bit depths and spatial loads.
+#[test]
+fn contiguous_mixer_matches_frozen_kernel_across_models_depths_and_spatial_loads() {
+    use crate::retouch::Region;
+    use crate::{BrushContext, BrushSettings, Stroke, StrokePoint};
+    use photocraft_color::{ColorMode, PixelFormat, SampleType};
+    let rect = Rect::new(-16, -16, 32, 32);
+    for mode in [ColorMode::Rgb, ColorMode::Grayscale, ColorMode::Cmyk, ColorMode::Lab] {
+        for depth in [SampleType::U8, SampleType::U16, SampleType::F32] {
+            for alpha in [false, true] {
+                let fmt = PixelFormat::new(mode, depth, alpha);
+                let mut surface = Surface::new(fmt);
+                let values: Vec<_> = (0..rect.width() * rect.height()).flat_map(|i| from_rgba(&fmt, [(i % 31) as f32 / 30.0, 0.3, 0.7, 0.6])).collect();
+                surface.write_region(rect, &values);
+                let mut source = Surface::new(PixelFormat::RGBA32F);
+                source.fill_rect(rect, &[0.8, 0.2, 0.1, 0.75]);
+                let brush = BrushSettings { size: 24.0, angle: 33.0, roundness: 0.6, pressure_size: false, ..Default::default() };
+                let dabs = crate::dabs(&Stroke { brush: brush.clone(), points: vec![StrokePoint::new(4.0, 4.0, 1.0)] });
+                let ctx = BrushContext::new(&brush);
+                for spatial in [false, true] {
+                    for sample in [None, Some(&source), Some(&surface)] {
+                        for lock in [false, true] {
+                            let mut state = MixerState::default();
+                            state.load([0.1, 0.8, 0.2, 1.0]);
+                            if spatial {
+                                state.spatial =
+                                    Some((0..4096).map(|i| [if i % 64 < 32 { 1.0 } else { 0.0 }, 0.2, 0.8, if i % 7 == 0 { 0.0 } else { 1.0 }]).collect());
+                            }
+                            let mut expected_state = state.clone();
+                            let mut actual = Region::read(&surface, rect);
+                            let mut expected = actual.clone();
+                            let settings = MixerSettings::default();
+                            for (index, dab) in dabs.iter().enumerate() {
+                                let fp = ctx.footprint(dab, index);
+                                reference(&mut expected, &fp, fmt, sample, &settings, &mut expected_state, lock);
+                                apply_mixer_dab(&mut actual, &fp, fmt, sample, &settings, &mut state, lock);
+                            }
+                            assert_eq!(actual, expected, "{mode:?} {depth:?} alpha={alpha} spatial={spatial} lock={lock}");
+                            assert_eq!(state, expected_state);
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/crates/paint/src/presets.rs b/crates/paint/src/presets.rs
index f711d0eb51..dd87d2554e 100644
--- a/crates/paint/src/presets.rs
+++ b/crates/paint/src/presets.rs
@@ -36,19 +36,18 @@ fn paper(seed: u32, depth: f32) -> Texture {
 
 fn general(base: &BrushSettings) -> Vec<BrushPreset> {
     let g = |n: &str, b: BrushSettings| preset("General", n, b);
+    // Dense dabs keep large hard-round outlines and pressure-opacity tapers continuous (#8842).
+    let hard_round = BrushSettings { spacing: 0.05, ..base.clone() };
     vec![
-        g("Hard Round", BrushSettings { size: 30.0, hardness: 1.0, ..base.clone() }),
+        g("Hard Round", BrushSettings { size: 30.0, hardness: 1.0, ..hard_round.clone() }),
         g("Soft Round", BrushSettings { size: 45.0, hardness: 0.0, ..base.clone() }),
-        g("Hard Round Fine", BrushSettings { size: 5.0, hardness: 1.0, spacing: 0.1, ..base.clone() }),
+        g("Hard Round Fine", BrushSettings { size: 5.0, hardness: 1.0, ..hard_round.clone() }),
         g("Soft Round Large", BrushSettings { size: 300.0, hardness: 0.0, spacing: 0.15, ..base.clone() }),
-        g("Hard Round Pressure Size", BrushSettings { size: 30.0, hardness: 1.0, shape_dynamics: size_dyn(pressure()), ..base.clone() }),
+        g("Hard Round Pressure Size", BrushSettings { size: 30.0, hardness: 1.0, shape_dynamics: size_dyn(pressure()), ..hard_round.clone() }),
         g("Soft Round Pressure Size", BrushSettings { size: 45.0, hardness: 0.0, shape_dynamics: size_dyn(pressure()), ..base.clone() }),
-        g("Hard Round Pressure Opacity", BrushSettings { size: 30.0, hardness: 1.0, transfer: transfer(pressure(), Dynamic::default()), ..base.clone() }),
+        g("Hard Round Pressure Opacity", BrushSettings { size: 30.0, hardness: 1.0, transfer: transfer(pressure(), Dynamic::default()), ..hard_round.clone() }),
         g("Soft Round Pressure Opacity", BrushSettings { size: 45.0, hardness: 0.0, transfer: transfer(pressure(), Dynamic::default()), ..base.clone() }),
-        g(
-            "Hard Round Pressure Opacity and Flow",
-            BrushSettings { size: 30.0, hardness: 0.9, transfer: transfer(pressure(), pressure_min(0.2)), ..base.clone() },
-        ),
+        g("Hard Round Pressure Opacity and Flow", BrushSettings { size: 30.0, hardness: 0.9, transfer: transfer(pressure(), pressure_min(0.2)), ..hard_round }),
         g("Airbrush Soft", BrushSettings { size: 80.0, hardness: 0.0, flow: 0.1, spacing: 0.1, build_up: true, build_up_rate: 25.0, ..base.clone() }),
         g(
             "Airbrush Pressure Flow",
diff --git a/crates/paint/src/render.rs b/crates/paint/src/render.rs
index b68e7a3190..b3246f1f57 100644
--- a/crates/paint/src/render.rs
+++ b/crates/paint/src/render.rs
@@ -39,6 +39,57 @@ fn dither8(px: &mut [f32], x: i32, y: i32) {
 
 /// Edge of a stroke-buffer tile.
 pub const COV_TILE: i32 = 64;
+
+/// Work on at least this many pixels runs in parallel (rows of a dab, tiles of a stroke): below
+/// it the threads cost more than they save. A large soft tip is tens of megapixels per dab, and
+/// every stage of it is independent per row or tile, so the pixels come out the same.
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) const DEFAULT_PARALLEL_MIN_PIXELS: usize = 256 * 256;
+
+/// The threshold in use: [`DEFAULT_PARALLEL_MIN_PIXELS`] (tests move it).
+#[cfg(not(target_arch = "wasm32"))]
+static PARALLEL_MIN_PIXELS: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(DEFAULT_PARALLEL_MIN_PIXELS);
+
+/// Whether `pixels` of independent work are worth the thread pool (the web has none: there every
+/// stage takes its serial path).
+#[cfg(not(target_arch = "wasm32"))]
+fn parallel(pixels: usize) -> bool {
+    pixels >= PARALLEL_MIN_PIXELS.load(std::sync::atomic::Ordering::Relaxed)
+}
+
+/// Tests: the pixel count from which work runs in parallel (`usize::MAX` keeps everything serial).
+/// The static is process-wide, so brush tests on other threads see the change too; that is
+/// harmless, because every stage gives the same pixels serially and in parallel (the point of
+/// the test that uses this), so no test can tell which way it ran.
+#[cfg(all(test, not(target_arch = "wasm32")))]
+pub(crate) fn set_parallel_min_pixels(n: usize) {
+    PARALLEL_MIN_PIXELS.store(n, std::sync::atomic::Ordering::Relaxed);
+}
+
+/// `f` over `items`, in parallel when `pixels` are worth it.
+fn for_each_item<T: Send>(items: &mut [T], pixels: usize, f: impl Fn(&mut T) + Sync) {
+    #[cfg(not(target_arch = "wasm32"))]
+    if parallel(pixels) {
+        use rayon::prelude::*;
+        items.par_iter_mut().for_each(&f);
+        return;
+    }
+    #[cfg(target_arch = "wasm32")]
+    let _ = pixels;
+    items.iter_mut().for_each(&f);
+}
+
+/// `f` over `items`, collecting its results in order, in parallel when `pixels` are worth it.
+fn map_items<T: Sync, R: Send>(items: &[T], pixels: usize, f: impl Fn(&T) -> R + Sync) -> Vec<R> {
+    #[cfg(not(target_arch = "wasm32"))]
+    if parallel(pixels) {
+        use rayon::prelude::*;
+        return items.par_iter().map(&f).collect();
+    }
+    #[cfg(target_arch = "wasm32")]
+    let _ = pixels;
+    items.iter().map(&f).collect()
+}
 /// Computed tips with a smaller radius (in pixels) are rasterised by area, not at pixel centres.
 const SMALL_TIP_RADIUS: f32 = 3.0;
 /// Sub-pixel sample offsets (a 4×4 grid) for the area coverage of small tips.
@@ -466,61 +517,62 @@ impl CoverageMap {
         let (t0x, t0y) = (rect.x0.div_euclid(COV_TILE), rect.y0.div_euclid(COV_TILE));
         let (t1x, t1y) = ((rect.x1 - 1).div_euclid(COV_TILE), (rect.y1 - 1).div_euclid(COV_TILE));
         let want_col = color.is_some() && nc > 0;
+        // The tiles this dab touches (a tile with no value in it is skipped), each independent of
+        // the others: a large dab's tiles accumulate in parallel, to the same values.
+        let mut keys: Vec<((i32, i32), Rect)> = Vec::new();
         for ty in t0y..=t1y {
             for tx in t0x..=t1x {
                 let tr = Rect::new(tx * COV_TILE, ty * COV_TILE, (tx + 1) * COV_TILE, (ty + 1) * COV_TILE).intersect(&rect);
                 if tr.is_empty() {
                     continue;
                 }
-                // Skip tiles this dab doesn't touch.
-                let any = (tr.y0..tr.y1).any(|y| {
-                    let row = (y - rect.y0) as usize * w;
-                    vals[row + (tr.x0 - rect.x0) as usize..row + (tr.x1 - rect.x0) as usize].iter().any(|&v| v > 0.0)
-                });
-                if !any {
-                    continue;
-                }
-                let tile = self.tiles.entry((tx, ty)).or_insert_with(|| CovTile {
-                    cov: vec![0.0; (COV_TILE * COV_TILE) as usize],
-                    depth: Vec::new(),
-                    col: if want_col { vec![0.0; (COV_TILE * COV_TILE) as usize * nc] } else { Vec::new() },
-                });
+                keys.push(((tx, ty), tr));
+            }
+        }
+        let touched = map_items(&keys, keys.len() * (COV_TILE * COV_TILE) as usize, |(_, tr)| {
+            (tr.y0..tr.y1).any(|y| {
+                let row = (y - rect.y0) as usize * w;
+                vals[row + (tr.x0 - rect.x0) as usize..row + (tr.x1 - rect.x0) as usize].iter().any(|&v| v > 0.0)
+            })
+        });
+        // The touched tiles leave the map while they accumulate and go back after: the dab's cost
+        // follows the tiles under it (one to four for a small tip), not the size of the map, which a
+        // long stroke grows to thousands of tiles.
+        let n = (COV_TILE * COV_TILE) as usize;
+        let mut tiles: Vec<(Rect, (i32, i32), CovTile)> = keys
+            .into_iter()
+            .zip(touched)
+            .filter(|(_, t)| *t)
+            .map(|((key, tr), _)| {
+                let mut tile = self.tiles.remove(&key).unwrap_or_else(|| CovTile { cov: vec![0.0; n], depth: Vec::new(), col: Vec::new() });
                 if want_col && tile.col.is_empty() {
-                    tile.col = vec![0.0; (COV_TILE * COV_TILE) as usize * nc];
+                    tile.col = vec![0.0; n * nc];
                 }
                 if depth.is_some() && tile.depth.is_empty() {
-                    tile.depth = vec![0.0; (COV_TILE * COV_TILE) as usize];
-                }
-                self.dirty.insert((tx, ty));
-                for y in tr.y0..tr.y1 {
-                    let row = (y - rect.y0) as usize * w;
-                    let trow = ((y - ty * COV_TILE) * COV_TILE) as usize;
-                    for x in tr.x0..tr.x1 {
-                        let v = vals[row + (x - rect.x0) as usize];
-                        if v <= 0.0 {
-                            continue;
-                        }
-                        let ti = trow + (x - tx * COV_TILE) as usize;
-                        if let (Some(dv), Some(slot)) = (depth.and_then(|dp| dp.get(row + (x - rect.x0) as usize)), tile.depth.get_mut(ti)) {
-                            *slot = slot.max(*dv);
-                        }
-                        let c = tile.cov[ti];
-                        let nv = if ceil > c { c + v * (ceil - c) } else { c };
-                        if nv <= c {
-                            continue;
-                        }
-                        if let (true, Some(col)) = (want_col, color) {
-                            let k = if c < 1.0 { (nv - c) / (1.0 - c) } else { 0.0 };
-                            let p = &mut tile.col[ti * nc..(ti + 1) * nc];
-                            for i in 0..nc {
-                                p[i] = col[i] * k + p[i] * (1.0 - k);
-                            }
-                        }
-                        tile.cov[ti] = nv;
-                    }
+                    tile.depth = vec![0.0; n];
                 }
+                self.dirty.insert(key);
+                (tr, key, tile)
+            })
+            .collect();
+        let dab = DabValues { vals, rect, w, ceil, color: if want_col { color } else { None }, depth, nc };
+        // The serial path stays a plain loop over an inlined step (see `rasterize_round`).
+        #[cfg(not(target_arch = "wasm32"))]
+        if parallel(tiles.len() * n) {
+            use rayon::prelude::*;
+            tiles.par_iter_mut().for_each(|(tr, key, tile)| dab.tile(*tr, *key, tile));
+        } else {
+            for (tr, key, tile) in &mut tiles {
+                dab.tile(*tr, *key, tile);
             }
         }
+        #[cfg(target_arch = "wasm32")]
+        for (tr, key, tile) in &mut tiles {
+            dab.tile(*tr, *key, tile);
+        }
+        for (_, key, tile) in tiles {
+            self.tiles.insert(key, tile);
+        }
     }
 
     fn take_dirty(&mut self) -> Vec<(i32, i32)> {
@@ -587,6 +639,55 @@ impl UnionLive {
     }
 }
 
+/// One dab's coverage (`vals` over `rect`, `w` wide) as [`CoverageMap::accumulate`] adds it to
+/// a tile: the dab's opacity ceiling, its colour when the stroke has per-dab colour (`nc` channels),
+/// its Wet Edges depth.
+#[derive(Clone, Copy)]
+struct DabValues<'a> {
+    vals: &'a [f32],
+    rect: Rect,
+    w: usize,
+    ceil: f32,
+    color: Option<&'a [f32]>,
+    depth: Option<&'a [f32]>,
+    nc: usize,
+}
+
+impl DabValues<'_> {
+    /// Adds the dab over `tr` (within tile `(tx, ty)`) to `tile`.
+    #[inline(always)]
+    fn tile(self, tr: Rect, (tx, ty): (i32, i32), tile: &mut CovTile) {
+        let DabValues { vals, rect, w, ceil, color, depth, nc } = self;
+        for y in tr.y0..tr.y1 {
+            let row = (y - rect.y0) as usize * w;
+            let trow = ((y - ty * COV_TILE) * COV_TILE) as usize;
+            for x in tr.x0..tr.x1 {
+                let v = vals[row + (x - rect.x0) as usize];
+                if v <= 0.0 {
+                    continue;
+                }
+                let ti = trow + (x - tx * COV_TILE) as usize;
+                if let (Some(dv), Some(slot)) = (depth.and_then(|dp| dp.get(row + (x - rect.x0) as usize)), tile.depth.get_mut(ti)) {
+                    *slot = slot.max(*dv);
+                }
+                let c = tile.cov[ti];
+                let nv = if ceil > c { c + v * (ceil - c) } else { c };
+                if nv <= c {
+                    continue;
+                }
+                if let Some(col) = color {
+                    let k = if c < 1.0 { (nv - c) / (1.0 - c) } else { 0.0 };
+                    let p = &mut tile.col[ti * nc..(ti + 1) * nc];
+                    for i in 0..nc {
+                        p[i] = col[i] * k + p[i] * (1.0 - k);
+                    }
+                }
+                tile.cov[ti] = nv;
+            }
+        }
+    }
+}
+
 /// Incremental stroke rendering: feed points, composite dirty tiles from the pre-stroke pixels.
 #[derive(Clone, Debug)]
 pub struct StrokeRenderer {
@@ -603,6 +704,19 @@ pub struct StrokeRenderer {
     dab_buf: Vec<Dab>,
     dual_buf: Vec<Dab>,
     all_dabs: Option<Vec<Dab>>,
+    regions: RegionPool,
+}
+
+/// The tile buffers [`StrokeRenderer::composite`] works in, kept from one composite to the next:
+/// a small stroke's few tiles reuse theirs instead of growing and trimming the heap every frame
+/// (that cost a 50 px stroke a third of its time). A clone starts with none.
+#[derive(Debug, Default)]
+struct RegionPool(Vec<Vec<f32>>);
+
+impl Clone for RegionPool {
+    fn clone(&self) -> Self {
+        Self::default()
+    }
 }
 
 impl StrokeRenderer {
@@ -695,6 +809,7 @@ impl StrokeRenderer {
                         dab_buf: Vec::new(),
                         dual_buf: Vec::new(),
                         all_dabs: None,
+                        regions: RegionPool::default(),
                     })
                 }
                 Some(m) => {
@@ -746,6 +861,7 @@ impl StrokeRenderer {
             dab_buf: Vec::new(),
             dual_buf: Vec::new(),
             all_dabs: None,
+            regions: RegionPool::default(),
         }
     }
 
@@ -876,6 +992,7 @@ impl StrokeRenderer {
             dab_buf: dabs,
             dual_buf: duals,
             all_dabs: None,
+            regions: RegionPool::default(),
         };
         t.raster_pending();
         // Tiles whose coverage the tail doesn't change still composite the same: redraw them all.
@@ -989,77 +1106,106 @@ impl StrokeRenderer {
         // colour, as in Photoshop, not grain that a tolerance-0 Magic Wand or Paint Bucket trips on.
         let dither = fmt.sample == SampleType::U8 && !b.aliased;
         let mut dmg = Rect::EMPTY;
-        let mut region = Vec::new();
-        for (tx, ty) in keys {
-            let Some(tile) = self.cov.tiles.get(&(tx, ty)) else { continue };
-            let tr = Rect::new(tx * COV_TILE, ty * COV_TILE, (tx + 1) * COV_TILE, (ty + 1) * COV_TILE).intersect(&bounds);
-            if tr.is_empty() {
-                continue;
-            }
-            pre.read_region_into(tr, &mut region);
-            let sel = selection.map(|s| (s.channels(), s.read_region(tr)));
-            let w = tr.width() as usize;
-            for y in tr.y0..tr.y1 {
-                for x in tr.x0..tr.x1 {
-                    let ti = ((y - ty * COV_TILE) * COV_TILE + (x - tx * COV_TILE)) as usize;
-                    let c = tile.cov[ti];
-                    if c <= 0.0 {
-                        continue;
-                    }
-                    let i = (y - tr.y0) as usize * w + (x - tr.x0) as usize;
-                    let m = self.ctx.stroke_mask_wet(c, tile.depth.get(ti).copied(), self.dual.as_ref().map(|d| d.get(x, y)), x, y);
-                    let s = sel.as_ref().map_or(1.0, |(sc, v)| v[i * sc]);
-                    let mut k = (m * opacity * s).min(1.0);
-                    if k <= 0.0 {
-                        continue;
-                    }
-                    if b.mode == BlendMode::Dissolve {
-                        k = if hash2(x, y, b.seed) < k { 1.0 } else { 0.0 };
-                        if k == 0.0 {
+        // Each tile composites into a buffer of its own (a large stroke's tiles in parallel, to
+        // the same pixels); the writes to the target go one by one, in order. Batches keep the
+        // pending buffers few, and the pool keeps them from one composite to the next.
+        const BATCH: usize = 256;
+        let mut pool = std::mem::take(&mut self.regions.0);
+        // The document's CMYK profile is active per thread: the workers enter the caller's, or a
+        // blend mode other than Normal would convert their tiles through the built-in coated CMYK.
+        let cmyk = photocraft_color::convert::active_cmyk_space();
+        for batch in keys.chunks(BATCH) {
+            let mut items: Vec<((i32, i32), Rect, Vec<f32>)> = batch.iter().map(|&key| (key, Rect::EMPTY, pool.pop().unwrap_or_default())).collect();
+            let composite_tile = |(key, done, region): &mut ((i32, i32), Rect, Vec<f32>)| {
+                let (tx, ty) = *key;
+                let Some(tile) = self.cov.tiles.get(&(tx, ty)) else { return };
+                let tr = Rect::new(tx * COV_TILE, ty * COV_TILE, (tx + 1) * COV_TILE, (ty + 1) * COV_TILE).intersect(&bounds);
+                if tr.is_empty() {
+                    return;
+                }
+                pre.read_region_into(tr, region);
+                let sel = selection.map(|s| (s.channels(), s.read_region(tr)));
+                // Per-dab colour rewrites the source per pixel, so each tile works on its own copy
+                // that starts from the brush colour. (Before the tiles ran in parallel, one `src`
+                // carried over from tile to tile; a tile without per-dab colour then painted with
+                // whatever colour the previous tile's last pixel had left in it. Such a tile only
+                // occurs when the stroke has no per-dab colour at all, and then `src` is never
+                // rewritten, so the pixels are the same either way; the copy per tile is the
+                // intended reading.)
+                let mut src = src;
+                let w = tr.width() as usize;
+                for y in tr.y0..tr.y1 {
+                    for x in tr.x0..tr.x1 {
+                        let ti = ((y - ty * COV_TILE) * COV_TILE + (x - tx * COV_TILE)) as usize;
+                        let c = tile.cov[ti];
+                        if c <= 0.0 {
                             continue;
                         }
-                    }
-                    let px = &mut region[i * n..(i + 1) * n];
-                    if b.erase {
-                        if let (Some(a), false) = (a_idx, lock_transparency) {
-                            px[a] *= 1.0 - k;
+                        let i = (y - tr.y0) as usize * w + (x - tr.x0) as usize;
+                        let m = self.ctx.stroke_mask_wet(c, tile.depth.get(ti).copied(), self.dual.as_ref().map(|d| d.get(x, y)), x, y);
+                        let s = sel.as_ref().map_or(1.0, |(sc, v)| v[i * sc]);
+                        let mut k = (m * opacity * s).min(1.0);
+                        if k <= 0.0 {
+                            continue;
+                        }
+                        if b.mode == BlendMode::Dissolve {
+                            k = if hash2(x, y, b.seed) < k { 1.0 } else { 0.0 };
+                            if k == 0.0 {
+                                continue;
+                            }
+                        }
+                        let px = &mut region[i * n..(i + 1) * n];
+                        if b.erase {
+                            if let (Some(a), false) = (a_idx, lock_transparency) {
+                                px[a] *= 1.0 - k;
+                            }
+                            if dither {
+                                dither8(px, x, y);
+                            }
+                            continue;
+                        }
+                        if lock_transparency && a_idx.is_some_and(|a| px[a] <= 0.0) {
+                            continue;
+                        }
+                        if self.per_dab_color && !tile.col.is_empty() {
+                            let p = &tile.col[ti * nc..(ti + 1) * nc];
+                            for ch in 0..nc {
+                                src[ch] = p[ch] / c;
+                            }
+                        }
+                        if matches!(b.mode, BlendMode::Normal | BlendMode::Dissolve) {
+                            over_native(&fmt, px, &src[..n], k, lock_transparency);
+                        } else {
+                            let d = to_rgba(&fmt, px);
+                            let sr = to_rgba(&fmt, &src[..n]);
+                            let o = if lock_transparency {
+                                photocraft_color::blend::composite_atop(b.mode, d, sr, k)
+                            } else {
+                                photocraft_color::blend::composite(b.mode, d, sr, k)
+                            };
+                            let mut enc = [0.0f32; 8];
+                            from_rgba_into(&fmt, o, &mut enc);
+                            px.copy_from_slice(&enc[..n]);
                         }
                         if dither {
                             dither8(px, x, y);
                         }
-                        continue;
-                    }
-                    if lock_transparency && a_idx.is_some_and(|a| px[a] <= 0.0) {
-                        continue;
-                    }
-                    if self.per_dab_color && !tile.col.is_empty() {
-                        let p = &tile.col[ti * nc..(ti + 1) * nc];
-                        for ch in 0..nc {
-                            src[ch] = p[ch] / c;
-                        }
-                    }
-                    if matches!(b.mode, BlendMode::Normal | BlendMode::Dissolve) {
-                        over_native(&fmt, px, &src[..n], k, lock_transparency);
-                    } else {
-                        let d = to_rgba(&fmt, px);
-                        let sr = to_rgba(&fmt, &src[..n]);
-                        let o = if lock_transparency {
-                            photocraft_color::blend::composite_atop(b.mode, d, sr, k)
-                        } else {
-                            photocraft_color::blend::composite(b.mode, d, sr, k)
-                        };
-                        let mut enc = [0.0f32; 8];
-                        from_rgba_into(&fmt, o, &mut enc);
-                        px.copy_from_slice(&enc[..n]);
-                    }
-                    if dither {
-                        dither8(px, x, y);
                     }
                 }
+                *done = tr;
+            };
+            for_each_item(&mut items, batch.len() * (COV_TILE * COV_TILE) as usize, |item| {
+                photocraft_color::convert::with_cmyk_space(cmyk.as_ref(), || composite_tile(item))
+            });
+            for (_, tr, region) in items {
+                if !tr.is_empty() {
+                    target.write_region(tr, &region);
+                    dmg = dmg.union(&tr);
+                }
+                pool.push(region);
             }
-            target.write_region(tr, &region);
-            dmg = dmg.union(&tr);
         }
+        self.regions.0 = pool;
         if all { bounds } else { dmg }
     }
 }
@@ -1090,22 +1236,57 @@ fn rasterize_round(d: &Dab, rect: Rect, out: &mut [f32], hardness: f32, aliased:
     let ro = d.roundness.max(0.5 / d.radius).min(1.0);
     let rm = (d.radius * ro).max(0.5);
     let w = rect.width() as usize;
+    if w == 0 {
+        return;
+    }
     let reach = if aliased { rm } else { tip_reach(rm, hardness).max(rm) };
-    let reach2 = (reach + 0.5) * (reach + 0.5);
+    let tip = RoundTip { cx, cy, ro, rm, reach2: (reach + 0.5) * (reach + 0.5), hardness, alpha: d.alpha, aliased, x0: rect.x0, y0: rect.y0 };
+    // Rows are independent: a large tip's rows run in parallel, to the same values. The serial
+    // path stays a plain loop over an inlined row: the same code as before the threads (a closure
+    // passed to a helper cost a small tip half its rasterization time).
+    #[cfg(not(target_arch = "wasm32"))]
+    if parallel(out.len()) {
+        use rayon::prelude::*;
+        out.par_chunks_exact_mut(w).enumerate().for_each(|(yy, row)| tip.row(yy, row));
+        return;
+    }
     for (yy, row) in out.chunks_exact_mut(w).enumerate() {
-        let dy = (rect.y0 + yy as i32) as f32 + 0.5 - cy;
-        if aliased {
+        tip.row(yy, row);
+    }
+}
+
+/// A round tip's coverage, computed row by row (see [`rasterize_round`]).
+#[derive(Clone, Copy)]
+struct RoundTip {
+    cx: f32,
+    cy: f32,
+    ro: f32,
+    rm: f32,
+    reach2: f32,
+    hardness: f32,
+    alpha: f32,
+    aliased: bool,
+    x0: i32,
+    y0: i32,
+}
+
+impl RoundTip {
+    /// Row `yy` of the tip's rectangle into `row`.
+    #[inline(always)]
+    fn row(self, yy: usize, row: &mut [f32]) {
+        let dy = (self.y0 + yy as i32) as f32 + 0.5 - self.cy;
+        if self.aliased {
             for (xx, dst) in row.iter_mut().enumerate() {
-                let dx = (rect.x0 + xx as i32) as f32 + 0.5 - cx;
-                let d2 = (dx * ro).powi(2) + dy * dy;
-                *dst = if d2 < reach2 && d2.sqrt() <= rm { d.alpha } else { 0.0 };
+                let dx = (self.x0 + xx as i32) as f32 + 0.5 - self.cx;
+                let d2 = (dx * self.ro).powi(2) + dy * dy;
+                *dst = if d2 < self.reach2 && d2.sqrt() <= self.rm { self.alpha } else { 0.0 };
             }
         } else {
             for (xx, dst) in row.iter_mut().enumerate() {
-                let dx = (rect.x0 + xx as i32) as f32 + 0.5 - cx;
-                let d2 = (dx * ro).powi(2) + dy * dy;
-                let val = if d2 >= reach2 { 0.0 } else { tip_falloff(d2.sqrt(), rm, hardness) };
-                *dst = if val <= 0.0 { 0.0 } else { val * d.alpha };
+                let dx = (self.x0 + xx as i32) as f32 + 0.5 - self.cx;
+                let d2 = (dx * self.ro).powi(2) + dy * dy;
+                let val = if d2 >= self.reach2 { 0.0 } else { tip_falloff(d2.sqrt(), self.rm, self.hardness) };
+                *dst = if val <= 0.0 { 0.0 } else { val * self.alpha };
             }
         }
     }
diff --git a/crates/plugins/src/manifest.rs b/crates/plugins/src/manifest.rs
index 2606b34c2b..133c0fa843 100644
--- a/crates/plugins/src/manifest.rs
+++ b/crates/plugins/src/manifest.rs
@@ -316,10 +316,16 @@ fn ordered_params<'de, D: serde::Deserializer<'de>>(d: D) -> std::result::Result
         }
         fn visit_map<A: serde::de::MapAccess<'de>>(self, mut map: A) -> std::result::Result<Self::Value, A::Error> {
             let mut out = Vec::new();
-            while let Some((k, v)) = map.next_entry::<String, ParamSpec>()? {
+            while let Some(k) = map.next_key::<String>()? {
+                // A repeated key would give one value two dialog controls, the last spec winning.
+                // Named before its spec is read or counted, so the error is about the key.
+                if out.iter().any(|(seen, _)| *seen == k) {
+                    return Err(serde::de::Error::custom(format!("parameter {k:?} is declared twice")));
+                }
                 if out.len() >= MAX_PARAMS {
                     return Err(serde::de::Error::custom(format!("too many parameters (limit {MAX_PARAMS})")));
                 }
+                let v = map.next_value::<ParamSpec>()?;
                 out.push((k, v));
             }
             Ok(out)
@@ -486,6 +492,25 @@ mod tests {
         assert!(Manifest::parse(&vec![b' '; MAX_MANIFEST_BYTES + 1]).is_err());
     }
 
+    #[test]
+    fn rejects_a_parameter_declared_twice() {
+        // Both entries were kept: two dialog controls for one value, and the last spec won.
+        let twice = br#"{"id":"a","name":"x","kind":"filter",
+            "params":{"n":{"type":"bool"},"n":{"type":"number","min":0,"max":1,"default":0}}}"#;
+        assert!(matches!(Manifest::parse(twice), Err(Error::Manifest(_))));
+        // The error names the key, also when the second spec is broken or past the limit.
+        let broken = br#"{"id":"a","name":"x","kind":"filter","params":{"n":{"type":"bool"},"n":{"type":"nope"}}}"#;
+        let many: Vec<String> = (0..MAX_PARAMS).map(|i| format!(r#""p{i}":{{"type":"bool"}}"#)).collect();
+        let past = format!(r#"{{"id":"a","name":"x","kind":"filter","params":{{{},"p0":{{"type":"bool"}}}}}}"#, many.join(","));
+        for (json, key) in [(&broken[..], "n"), (past.as_bytes(), "p0")] {
+            let e = Manifest::parse(json).err().map(|e| e.to_string()).unwrap_or_default();
+            assert!(e.contains(&format!("parameter {key:?} is declared twice")), "{e}");
+        }
+        // Keys differing in case are different parameters.
+        let m = Manifest::parse(br#"{"id":"a","name":"x","kind":"filter","params":{"n":{"type":"bool"},"N":{"type":"bool"}}}"#).unwrap();
+        assert_eq!(m.params_notation(), r#"{"n":bool=false,"N":bool=false}"#);
+    }
+
     /// Chromatic Aberration-like: a pixel shift, a pixel int, a signed pixel offset and a unitless
     /// `size` (a name the built-in filters treat as pixels).
     const PIXELS: &str = r#"{"id":"org.example.fringe","name":"Fringe","kind":"filter",
diff --git a/crates/plugins/tests/abi.rs b/crates/plugins/tests/abi.rs
index e0d6d8aa35..61ee32791f 100644
--- a/crates/plugins/tests/abi.rs
+++ b/crates/plugins/tests/abi.rs
@@ -348,7 +348,11 @@ fn a_fifo_in_place_of_a_module_file_does_not_block_loading() {
     std::fs::create_dir_all(&dir).unwrap();
     let path = dir.join("evil.wasm");
     let _ = std::fs::remove_file(&path);
-    rustix::fs::mknodat(rustix::fs::CWD, &path, rustix::fs::FileType::Fifo, rustix::fs::Mode::RUSR | rustix::fs::Mode::WUSR, 0).unwrap();
+    // `rustix::fs::mknodat` is unavailable on Apple targets. `mkfifo` is the
+    // POSIX utility for creating this special file and keeps this regression
+    // test available on macOS as well as other Unix platforms.
+    let status = std::process::Command::new("mkfifo").arg(&path).status().unwrap();
+    assert!(status.success(), "mkfifo failed with {status}");
     let (tx, rx) = std::sync::mpsc::channel();
     let p = path.clone();
     std::thread::spawn(move || {
diff --git a/crates/psd/src/file.rs b/crates/psd/src/file.rs
index 086e6974f0..ccc1e7ba0d 100644
--- a/crates/psd/src/file.rs
+++ b/crates/psd/src/file.rs
@@ -39,6 +39,14 @@ pub struct GlobalLayerMask {
 }
 
 impl GlobalLayerMask {
+    /// The mask Photoshop writes for a layered file that has no global mask of its own:
+    /// an RGB red overlay at 50% opacity, kind 128 (use the per-layer setting), plus the
+    /// filler byte. A zero-length `LMsk` block in a TIFF makes Photoshop give up on the
+    /// layer data (it reads this 14-byte record from the block).
+    pub fn photoshop_default() -> Self {
+        GlobalLayerMask { data: vec![0, 0, 0xff, 0xff, 0, 0, 0, 0, 0, 0, 0, 50, 128, 0] }
+    }
+
     fn be16(&self, at: usize) -> Option<u16> {
         self.data.get(at..at + 2).map(|b| u16::from_be_bytes([b[0], b[1]]))
     }
@@ -490,12 +498,12 @@ impl PsdFile {
     }
 
     /// `true` if the merged image carries a transparency channel: its first extra channel, when
-    /// the layer count was stored negative or a "Saving Merged Transparency" global block (`Mtrn`,
-    /// `Mt16`, `Mt32`) is present. Photoshop marks 32-bit documents with `Mt32` and a positive
-    /// layer count (psd-tools transparentbg.psd). Photoshop also names the merged transparency
-    /// "Transparency" and lists it first among the alpha channel names, and some of its 16-bit
-    /// PSBs carry no other mark (#4654): when the layers sit in a global `Lr16`/`Lr32` block, that
-    /// name with one name per extra channel marks it too.
+    /// the layer count was stored negative or a "Saving Merged Transparency" global block (see
+    /// [`TaggedBlock::is_merged_transparency_marker`]) is present. Photoshop marks 32-bit documents
+    /// with `Mt32` and a positive layer count (psd-tools transparentbg.psd). Photoshop also names
+    /// the merged transparency "Transparency" and lists it first among the alpha channel names,
+    /// and some of its 16-bit PSBs carry no other mark (#4654): when the layers sit in a global
+    /// `Lr16`/`Lr32` block, that name with one name per extra channel marks it too.
     pub fn merged_has_alpha(&self) -> bool {
         let Some(color) = self.header.color_mode.color_channels() else {
             return false;
@@ -503,7 +511,7 @@ impl PsdFile {
         if self.header.channels <= color {
             return false;
         }
-        let marked = self.global_blocks.iter().any(|b| matches!(&b.key, b"Mtrn" | b"Mt16" | b"Mt32"));
+        let marked = self.global_blocks.iter().any(TaggedBlock::is_merged_transparency_marker);
         match &self.layer_info {
             Some(li) => {
                 let in_block = matches!(self.layer_info_placement, LayerInfoPlacement::GlobalBlock { .. });
@@ -804,4 +812,27 @@ mod write_tests {
             }
         }
     }
+
+    /// A positive layer count plus a merged-transparency marker still makes the first extra
+    /// channel the transparency, for the specification's keys and for the `MTrn` Photoshop
+    /// writes in a layered TIFF.
+    #[test]
+    fn merged_transparency_markers_mark_the_first_extra_channel() {
+        let mut file = testgen::small(Version::Psd, Compression::Raw);
+        if let Some(li) = &mut file.layer_info {
+            li.merged_alpha = false;
+        }
+        assert!(!file.merged_has_alpha());
+        for key in [*b"Mtrn", *b"MTrn", *b"Mt16", *b"Mt32"] {
+            let mut marked = file.clone();
+            marked.global_blocks.push(TaggedBlock::new(key, Vec::new()));
+            assert!(marked.merged_has_alpha(), "{}", String::from_utf8_lossy(&key));
+        }
+        // Other keys, and the marker's letters in another case, do not.
+        for key in [*b"MTRN", *b"mtrn", *b"Lr16"] {
+            let mut other = file.clone();
+            other.global_blocks.push(TaggedBlock::new(key, Vec::new()));
+            assert!(!other.merged_has_alpha(), "{}", String::from_utf8_lossy(&key));
+        }
+    }
 }
diff --git a/crates/psd/src/patterns.rs b/crates/psd/src/patterns.rs
index 15558a700e..85bf285db9 100644
--- a/crates/psd/src/patterns.rs
+++ b/crates/psd/src/patterns.rs
@@ -391,6 +391,10 @@ fn write_pattern(p: &PsdPattern, out: &mut Vec<u8>) -> Result<()> {
     out.extend_from_slice(&(p.height as u16).to_be_bytes());
     out.extend_from_slice(&(p.width as u16).to_be_bytes());
     let units: Vec<u16> = p.name.encode_utf16().chain(std::iter::once(0)).collect();
+    // The reader refuses longer names (see `read_pattern`).
+    if units.len() > 65_536 {
+        return Err(PsdError::LimitExceeded("pattern name length"));
+    }
     out.extend_from_slice(&(units.len() as u32).to_be_bytes());
     for u in units {
         out.extend_from_slice(&u.to_be_bytes());
@@ -533,6 +537,9 @@ pub fn block_key(depth: u16) -> [u8; 4] {
     }
 }
 
+/// The most patterns a `.pat` file may hold: more are refused on read and on write.
+pub const MAX_PAT_PATTERNS: usize = 100_000;
+
 /// Parses a `.pat` pattern file.
 pub fn parse_pat_file(data: &[u8]) -> Result<Vec<PsdPattern>> {
     let mut r = Rd { b: data, p: 0 };
@@ -541,10 +548,13 @@ pub fn parse_pat_file(data: &[u8]) -> Result<Vec<PsdPattern>> {
         return Err(PsdError::InvalidSignature { expected: "8BPT", found: [sig[0], sig[1], sig[2], sig[3]] });
     }
     let _version = r.u16()?;
-    let count = r.u32()?;
+    let count = r.u32()? as usize;
+    if count > MAX_PAT_PATTERNS {
+        return Err(PsdError::LimitExceeded("pattern count"));
+    }
     let mut out = Vec::new();
     let mut budget = PatternBudget::default();
-    for _ in 0..count.min(100_000) {
+    for _ in 0..count {
         out.push(read_pattern(&mut r, &mut budget)?);
     }
     Ok(out)
@@ -552,6 +562,9 @@ pub fn parse_pat_file(data: &[u8]) -> Result<Vec<PsdPattern>> {
 
 /// Writes a `.pat` pattern file.
 pub fn write_pat_file(patterns: &[PsdPattern]) -> Result<Vec<u8>> {
+    if patterns.len() > MAX_PAT_PATTERNS {
+        return Err(PsdError::LimitExceeded("pattern count"));
+    }
     let mut out = b"8BPT".to_vec();
     out.extend_from_slice(&1u16.to_be_bytes());
     out.extend_from_slice(&(patterns.len() as u32).to_be_bytes());
@@ -582,6 +595,28 @@ mod tests {
         }
     }
 
+    /// #9318 review: a name the reader refuses (more than 65,536 UTF-16 units with its NUL) is
+    /// refused on write, so a saved library can't become a file that loads nothing.
+    #[test]
+    fn a_name_the_reader_refuses_is_refused_on_write() {
+        let long = PsdPattern { name: "a".repeat(65_536), ..pat(8, false) };
+        assert!(matches!(write_pat_file(&[long]), Err(PsdError::LimitExceeded(_))));
+        let longest = PsdPattern { name: "a".repeat(65_535), ..pat(8, false) };
+        assert_eq!(parse_pat_file(&write_pat_file(std::slice::from_ref(&longest)).unwrap()).unwrap(), [longest]);
+    }
+
+    /// #9318 review: more patterns than a `.pat` holds are refused on write, and a file claiming
+    /// more is refused on read rather than silently cut to the first 100,000.
+    #[test]
+    fn more_patterns_than_a_pat_file_holds_are_refused() {
+        let many = vec![pat(8, false); MAX_PAT_PATTERNS + 1];
+        assert!(matches!(write_pat_file(&many), Err(PsdError::LimitExceeded(_))));
+        let mut header = b"8BPT".to_vec();
+        header.extend_from_slice(&1u16.to_be_bytes());
+        header.extend_from_slice(&(MAX_PAT_PATTERNS as u32 + 1).to_be_bytes());
+        assert!(matches!(parse_pat_file(&header), Err(PsdError::LimitExceeded(_))));
+    }
+
     #[test]
     fn block_and_pat_file_round_trip_at_every_depth() {
         for depth in [8, 16, 32] {
diff --git a/crates/psd/src/tagged.rs b/crates/psd/src/tagged.rs
index ad51a02caa..098b720a22 100644
--- a/crates/psd/src/tagged.rs
+++ b/crates/psd/src/tagged.rs
@@ -155,6 +155,14 @@ impl TaggedBlock {
         Self::is_foreign_order_signature(&self.signature)
     }
 
+    /// `true` for a "Saving Merged Transparency" marker: the merged image's first extra channel
+    /// is its transparency. The specification's keys are `Mtrn`, `Mt16` and `Mt32`; Photoshop
+    /// (27.11) writes `MTrn`, with a positive layer count, in a layered TIFF saved with Save
+    /// Transparency next to spot and alpha channels.
+    pub fn is_merged_transparency_marker(&self) -> bool {
+        matches!(&self.key, b"Mtrn" | b"MTrn" | b"Mt16" | b"Mt32")
+    }
+
     /// Key as a string (lossy).
     pub fn key_str(&self) -> String {
         String::from_utf8_lossy(&self.key).into_owned()
diff --git a/crates/psd/src/tiff.rs b/crates/psd/src/tiff.rs
index 1f7445e4f4..d2e2bed75c 100644
--- a/crates/psd/src/tiff.rs
+++ b/crates/psd/src/tiff.rs
@@ -1163,16 +1163,16 @@ pub mod transcode {
         fn type_layer(&mut self) -> Result<()> {
             self.u16()?;
             self.f64s(6)?;
-            self.type_descriptor(50)?;
-            self.type_descriptor(1)?;
+            self.type_descriptor(50, ByteOrder::Big)?;
+            self.type_descriptor(1, self.to)?;
             self.i32s(4)
         }
 
-        fn type_descriptor(&mut self, version: u16) -> Result<()> {
+        fn type_descriptor(&mut self, version: u16, to: ByteOrder) -> Result<()> {
             let [hi, lo] = version.to_be_bytes();
             let from = if self.from.is_little() && self.r.peek_rest().starts_with(&[hi, lo, 0, 0, 0, 16]) { ByteOrder::Big } else { self.from };
             let data = self.r.peek_rest();
-            let mut descriptor = Tx::new(data, self.version, from, self.to);
+            let mut descriptor = Tx::new(data, self.version, from, to);
             descriptor.depth = self.depth;
             descriptor.u16()?;
             descriptor.versioned_descriptor()?;
@@ -1837,6 +1837,132 @@ mod tests {
         block_rt(*b"lfx2", data);
     }
 
+    fn type_layer_data() -> Vec<u8> {
+        let mut data = Vec::new();
+        data.put_u16(1);
+        for value in [1.5, 0.0, -0.25, 1.75, 12.5, -3.25] {
+            data.put_f64(value);
+        }
+        data.put_u16(50);
+        let text = Descriptor::new("TxLr").with("Txt ", Value::Text(UnicodeString::new_nul("Synthetic Ω 🦀")));
+        data.extend(VersionedDescriptor::new(text).to_bytes());
+        data.put_u16(1);
+        data.extend(VersionedDescriptor::new(Descriptor::new("warp")).to_bytes());
+        for value in [11, -22, 333, 4_444] {
+            data.put_i32(value);
+        }
+        data
+    }
+
+    fn tagged_payload<'a>(bytes: &'a [u8], signature_and_key: &[u8; 8], little: bool) -> &'a [u8] {
+        let block_at = bytes.windows(8).position(|window| window == signature_and_key).expect("tagged block");
+        let length_at = block_at + 8;
+        let length_bytes: [u8; 4] = bytes.get(length_at..length_at + 4).expect("tagged block length").try_into().expect("four-byte length");
+        let length = if little { u32::from_le_bytes(length_bytes) } else { u32::from_be_bytes(length_bytes) };
+        let data_at = length_at + 4;
+        let data_end = data_at + usize::try_from(length).expect("test block length fits usize");
+        bytes.get(data_at..data_end).expect("tagged block payload")
+    }
+
+    fn legacy_little_endian_type_block() -> Vec<u8> {
+        let mut tysh = Vec::new();
+        tysh.extend_from_slice(&1u16.to_le_bytes());
+        for value in [1.5f64, 0.0, -0.25, 1.75, 12.5, -3.25] {
+            tysh.extend_from_slice(&value.to_le_bytes());
+        }
+        tysh.extend_from_slice(&50u16.to_le_bytes());
+        // Independently encode a little-endian `VersionedDescriptor` with a single TEXT value.
+        tysh.extend_from_slice(&16u32.to_le_bytes());
+        tysh.extend_from_slice(&0u32.to_le_bytes()); // empty descriptor name
+        tysh.extend_from_slice(&0u32.to_le_bytes()); // four-character class id
+        tysh.extend_from_slice(b"rLxT"); // little-endian four-character class id
+        tysh.extend_from_slice(&1u32.to_le_bytes()); // one item
+        tysh.extend_from_slice(&0u32.to_le_bytes()); // four-character key
+        tysh.extend_from_slice(b" txT"); // little-endian four-character key
+        tysh.extend_from_slice(b"TXET"); // little-endian OSType
+        let mut units: Vec<u16> = "Synthetic Ω 🦀".encode_utf16().collect();
+        units.push(0); // `new_nul`, matching the canonical fixture
+        tysh.extend_from_slice(&u32::try_from(units.len()).expect("short test string").to_le_bytes());
+        for unit in units {
+            tysh.extend_from_slice(&unit.to_le_bytes());
+        }
+        tysh.extend_from_slice(&1u16.to_le_bytes());
+        // Empty warp descriptor, also encoded independently in little-endian order.
+        tysh.extend_from_slice(&16u32.to_le_bytes());
+        tysh.extend_from_slice(&0u32.to_le_bytes()); // empty descriptor name
+        tysh.extend_from_slice(&4u32.to_le_bytes()); // `warp` is a four-byte string id
+        tysh.extend_from_slice(b"warp");
+        tysh.extend_from_slice(&0u32.to_le_bytes()); // no items
+        for value in [11i32, -22, 333, 4_444] {
+            tysh.extend_from_slice(&value.to_le_bytes());
+        }
+
+        let mut image_source = super::SIGNATURE.to_vec();
+        image_source.extend_from_slice(b"MIB8hSyT");
+        image_source.extend_from_slice(&u32::try_from(tysh.len()).expect("short test block").to_le_bytes());
+        image_source.extend_from_slice(&tysh);
+        let padding = (4 - tysh.len() % 4) % 4;
+        image_source.resize(image_source.len() + padding, 0);
+        image_source
+    }
+
+    #[test]
+    fn type_block_write_keeps_text_descriptor_in_psd_order() {
+        let canonical = type_layer_data();
+        let source = ImageSourceData { global_blocks: vec![TaggedBlock::new(*b"TySh", canonical.clone())], ..Default::default() };
+
+        let (little, warnings) = source.to_bytes(ByteOrder::Little).unwrap();
+        assert!(warnings.is_empty(), "{warnings:?}");
+        let payload = tagged_payload(&little, b"MIB8hSyT", true);
+        assert_eq!(payload.get(..2), Some(&[1, 0][..]), "TySh header stays in TIFF order");
+        for (index, expected) in [1.5f64, 0.0, -0.25, 1.75, 12.5, -3.25].into_iter().enumerate() {
+            let start = 2 + index * 8;
+            let bytes: [u8; 8] = payload.get(start..start + 8).unwrap().try_into().unwrap();
+            assert_eq!(f64::from_le_bytes(bytes), expected, "matrix element {index}");
+        }
+
+        let (text_descriptor, descriptor_len) = VersionedDescriptor::parse_prefix(canonical.get(52..).unwrap()).unwrap();
+        let text_section_len = 2 + descriptor_len;
+        assert_eq!(payload.get(50..52), Some(&50u16.to_be_bytes()[..]));
+        assert_eq!(payload.get(52..56), Some(&16u32.to_be_bytes()[..]));
+        assert_eq!(payload.get(50..50 + text_section_len), canonical.get(50..50 + text_section_len));
+        assert!(matches!(text_descriptor.descriptor.get("Txt "), Some(Value::Text(value)) if value.to_string_lossy() == "Synthetic Ω 🦀"));
+        let text_descriptor_from_output = VersionedDescriptor::parse_prefix(payload.get(52..).unwrap()).unwrap().0;
+        assert!(matches!(text_descriptor_from_output.descriptor.get("Txt "), Some(Value::Text(value)) if value.to_string_lossy() == "Synthetic Ω 🦀"));
+
+        let warp_at = 50 + text_section_len;
+        assert_eq!(payload.get(warp_at..warp_at + 2), Some(&1u16.to_le_bytes()[..]));
+        let (_, warp_len) = VersionedDescriptor::parse_prefix(canonical.get(warp_at + 2..).unwrap()).unwrap();
+        let warp_descriptor_at = warp_at + 2;
+        assert_eq!(payload.get(warp_descriptor_at..warp_descriptor_at + 4), Some(&16u32.to_le_bytes()[..]));
+        assert_eq!(payload.get(warp_descriptor_at + 4..warp_descriptor_at + 8), Some(&0u32.to_le_bytes()[..]));
+        assert_eq!(payload.get(warp_descriptor_at + 8..warp_descriptor_at + 12), Some(&4u32.to_le_bytes()[..]));
+        assert_eq!(payload.get(warp_descriptor_at + 12..warp_descriptor_at + 16), Some(b"warp".as_slice()));
+        assert_eq!(payload.get(warp_descriptor_at + 16..warp_descriptor_at + 20), Some(&0u32.to_le_bytes()[..]));
+        let bounds_at = warp_descriptor_at + warp_len;
+        for (index, expected) in [11i32, -22, 333, 4_444].into_iter().enumerate() {
+            let start = bounds_at + index * 4;
+            assert_eq!(payload.get(start..start + 4), Some(&expected.to_le_bytes()[..]), "bound {index}");
+        }
+
+        let (big, warnings) = source.to_bytes(ByteOrder::Big).unwrap();
+        assert!(warnings.is_empty(), "{warnings:?}");
+        assert_eq!(tagged_payload(&big, b"8BIMTySh", false), canonical);
+
+        let (reopened, warnings) = ImageSourceData::from_bytes(&little).unwrap();
+        assert!(warnings.is_empty(), "{warnings:?}");
+        assert_eq!(reopened.global_blocks[0].data, canonical);
+        assert_eq!(reopened.to_bytes(ByteOrder::Big).unwrap().0, big);
+    }
+
+    #[test]
+    fn legacy_little_endian_type_descriptor_still_imports() {
+        let input = legacy_little_endian_type_block();
+        let (reopened, warnings) = ImageSourceData::from_bytes(&input).unwrap();
+        assert!(warnings.is_empty(), "{warnings:?}");
+        assert_eq!(reopened.global_blocks[0].data, type_layer_data());
+    }
+
     #[test]
     fn type_block_layout() {
         let mut data = Vec::new();
diff --git a/crates/psd/tests/it/roundtrip.rs b/crates/psd/tests/it/roundtrip.rs
index 1f23ee6284..49ad412e7c 100644
--- a/crates/psd/tests/it/roundtrip.rs
+++ b/crates/psd/tests/it/roundtrip.rs
@@ -232,6 +232,7 @@ fn global_mask_accessors() {
     assert_eq!(gm.opacity(), Some(50));
     assert_eq!(gm.kind(), Some(128));
     assert_eq!(GlobalLayerMask::default().kind(), None);
+    assert_eq!(GlobalLayerMask::photoshop_default().data, gm.data);
 }
 
 #[test]
diff --git a/crates/raster/src/lib.rs b/crates/raster/src/lib.rs
index f3778ccbe5..ce70830f37 100644
--- a/crates/raster/src/lib.rs
+++ b/crates/raster/src/lib.rs
@@ -245,6 +245,56 @@ fn convert_tiles(tiles: &mut [(TileCoord, Arc<Tile>)], r: Rect, data: &[f32], w:
     }
 }
 
+fn decode_tile_row_rgba(fmt: &PixelFormat, t: &Tile, base: usize, dst: &mut [[f32; 4]], row: &mut Vec<f32>) {
+    let n = fmt.channels();
+    match (fmt.mode, fmt.sample, fmt.alpha) {
+        (ColorMode::Rgb, SampleType::U8, true) => {
+            let src = &t.data[base..base + dst.len() * 4];
+            for (d, s) in dst.iter_mut().zip(src.as_chunks::<4>().0) {
+                *d = [s[0] as f32 / 255.0, s[1] as f32 / 255.0, s[2] as f32 / 255.0, s[3] as f32 / 255.0];
+            }
+        }
+        (ColorMode::Grayscale, SampleType::U8, true) => {
+            let src = &t.data[base..base + dst.len() * 2];
+            for (d, s) in dst.iter_mut().zip(src.as_chunks::<2>().0) {
+                let g = s[0] as f32 / 255.0;
+                *d = [g, g, g, s[1] as f32 / 255.0];
+            }
+        }
+        (ColorMode::Cmyk, SampleType::U8, _) => {
+            // Identical ink bytes share the exact ICC result; alpha is independent.
+            let mut previous: Option<([u8; 4], [f32; 3])> = None;
+            let src = &t.data[base..base + dst.len() * n];
+            for (d, s) in dst.iter_mut().zip(src.chunks_exact(n)) {
+                let ink = [s[0], s[1], s[2], s[3]];
+                let rgb = match previous {
+                    Some((key, rgb)) if key == ink => rgb,
+                    _ => {
+                        let rgb = photocraft_color::convert::cmyk_to_rgb(ink.map(|v| v as f32 / 255.0));
+                        previous = Some((ink, rgb));
+                        rgb
+                    }
+                };
+                *d = [rgb[0], rgb[1], rgb[2], s.get(4).map_or(1.0, |v| *v as f32 / 255.0)];
+            }
+        }
+        _ => {
+            // The row's samples in one pass, then its colour model resolved once:
+            // RGB and grey take their channels as `to_rgba` does, other models go
+            // through it.
+            row.resize(dst.len() * n, 0.0);
+            read_samples(&t.data, fmt.sample, base, row);
+            let a = |s: &[f32], i: usize| if fmt.alpha { s[i] } else { 1.0 };
+            let pixels = dst.iter_mut().zip(row.chunks_exact(n));
+            match fmt.mode {
+                ColorMode::Rgb => pixels.for_each(|(d, s)| *d = [s[0], s[1], s[2], a(s, 3)]),
+                ColorMode::Grayscale | ColorMode::Bitmap | ColorMode::Duotone => pixels.for_each(|(d, s)| *d = [s[0], s[0], s[0], a(s, 1)]),
+                _ => pixels.for_each(|(d, s)| *d = to_rgba(fmt, s)),
+            }
+        }
+    }
+}
+
 impl Surface {
     /// Reads a region into a newly allocated buffer, returning an error instead of aborting if
     /// the requested pixel buffer cannot be represented or reserved.
@@ -577,52 +627,7 @@ impl Surface {
                     continue;
                 };
                 let base = (((y - tc.ty * TILE_SIZE) as usize) * TILE_SIZE as usize + (tr.x0 - tc.tx * TILE_SIZE) as usize) * n;
-                match (fmt.mode, fmt.sample, fmt.alpha) {
-                    (ColorMode::Rgb, SampleType::U8, true) => {
-                        let src = &t.data[base..base + dst.len() * 4];
-                        for (d, s) in dst.iter_mut().zip(src.as_chunks::<4>().0) {
-                            *d = [s[0] as f32 / 255.0, s[1] as f32 / 255.0, s[2] as f32 / 255.0, s[3] as f32 / 255.0];
-                        }
-                    }
-                    (ColorMode::Grayscale, SampleType::U8, true) => {
-                        let src = &t.data[base..base + dst.len() * 2];
-                        for (d, s) in dst.iter_mut().zip(src.as_chunks::<2>().0) {
-                            let g = s[0] as f32 / 255.0;
-                            *d = [g, g, g, s[1] as f32 / 255.0];
-                        }
-                    }
-                    (ColorMode::Cmyk, SampleType::U8, _) => {
-                        // Identical ink bytes share the exact ICC result; alpha is independent.
-                        let mut previous: Option<([u8; 4], [f32; 3])> = None;
-                        let src = &t.data[base..base + dst.len() * n];
-                        for (d, s) in dst.iter_mut().zip(src.chunks_exact(n)) {
-                            let ink = [s[0], s[1], s[2], s[3]];
-                            let rgb = match previous {
-                                Some((key, rgb)) if key == ink => rgb,
-                                _ => {
-                                    let rgb = photocraft_color::convert::cmyk_to_rgb(ink.map(|v| v as f32 / 255.0));
-                                    previous = Some((ink, rgb));
-                                    rgb
-                                }
-                            };
-                            *d = [rgb[0], rgb[1], rgb[2], s.get(4).map_or(1.0, |v| *v as f32 / 255.0)];
-                        }
-                    }
-                    _ => {
-                        // The row's samples in one pass, then its colour model resolved once:
-                        // RGB and grey take their channels as `to_rgba` does, other models go
-                        // through it.
-                        row.resize(dst.len() * n, 0.0);
-                        read_samples(&t.data, fmt.sample, base, &mut row);
-                        let a = |s: &[f32], i: usize| if fmt.alpha { s[i] } else { 1.0 };
-                        let pixels = dst.iter_mut().zip(row.chunks_exact(n));
-                        match fmt.mode {
-                            ColorMode::Rgb => pixels.for_each(|(d, s)| *d = [s[0], s[1], s[2], a(s, 3)]),
-                            ColorMode::Grayscale | ColorMode::Bitmap | ColorMode::Duotone => pixels.for_each(|(d, s)| *d = [s[0], s[0], s[0], a(s, 1)]),
-                            _ => pixels.for_each(|(d, s)| *d = to_rgba(&fmt, s)),
-                        }
-                    }
-                }
+                decode_tile_row_rgba(&fmt, t, base, dst, &mut row);
             }
         }
     }
diff --git a/crates/raw/README.md b/crates/raw/README.md
index e266c64cde..268e200b7f 100644
--- a/crates/raw/README.md
+++ b/crates/raw/README.md
@@ -67,8 +67,8 @@ camera colour tables were copied.
 
 | Format | Status |
 |---|---|
-| DNG | Uncompressed (8–16 bit, packed or not), Deflate (compression 8, predictors 1 and 2), lossless JPEG, lossy JPEG (DNG 1.4 compression 34892: 8-bit baseline JPEG tiles or strips, gray for CFA, YCbCr-coded RGB for LinearRaw; decoded by `zune-jpeg`, the stored 8-bit values then go through the same LinearizationTable / BlackLevel / WhiteLevel as every other depth) and JPEG XL (DNG 1.7, e.g. Samsung Expert RAW; decoded by `jxl-oxide`; not in wasm32 builds, where it is `Unsupported`); strips and tiles; CFA (Bayer) and LinearRaw (three-sample colour, or one-sample monochrome such as Leica Monochrom and film-scanner DNGs, developed as neutral grey with no white balance or colour matrix); LinearizationTable, BlackLevel (+ repeat, DeltaH/V), WhiteLevel, ActiveArea, DefaultCrop, ColorMatrix1/2, CameraCalibration, ForwardMatrix, AnalogBalance, AsShotNeutral / AsShotWhiteXY, BaselineExposure, Orientation, OpcodeList2 GainMap (lens shading) |
-| DNG (lossy JPEG, floating point; opcodes other than GainMap; ProfileGainTableMap) | Unsupported / not applied (reported) |
+| DNG | Uncompressed (8–16 bit, packed or not), Deflate (compression 8, predictors 1 and 2), lossless JPEG, lossy JPEG (DNG 1.4 compression 34892: 8-bit baseline JPEG tiles or strips, gray for CFA, YCbCr-coded RGB for LinearRaw; decoded by `zune-jpeg`, the stored 8-bit values then go through the same LinearizationTable / BlackLevel / WhiteLevel as every other depth) and JPEG XL (DNG 1.7, e.g. Samsung Expert RAW; decoded by `jxl-oxide`; not in wasm32 builds, where it is `Unsupported`); strips and tiles; CFA (Bayer) and LinearRaw (three-sample colour, or one-sample monochrome such as Leica Monochrom and film-scanner DNGs, developed as neutral grey with no white balance or colour matrix); LinearizationTable, BlackLevel (+ repeat, DeltaH/V), WhiteLevel, ActiveArea, DefaultCrop, ColorMatrix1/2, CameraCalibration, ForwardMatrix, AnalogBalance, AsShotNeutral / AsShotWhiteXY, BaselineExposure, Orientation, floating-point JPEG XL raw data (DNG 1.7 lossy LinearRaw, as Adobe DNG Converter writes it; scaled by the highest WhiteLevel), OpcodeList2 GainMap (lens shading) and MapPolynomial |
+| DNG (floating point other than JPEG XL; opcodes other than OpcodeList2 GainMap and MapPolynomial; ProfileGainTableMap) | Unsupported / not applied (reported) |
 | CR2 | Lossless JPEG with slices, borders and as-shot white balance from the maker note, black measured on the masked border. CR2 has no CFA tag and the row phase varies by model, so it is measured from the data (the green diagonal), with a Canon model-ID table as the fallback (see `src/cr2.rs`) |
 | CR2 sRAW / mRAW | Unsupported |
 | NEF / NRW, ARW, PEF and other TIFF/EP raws | Uncompressed and lossless-JPEG (incl. Sony lossless ARW) CFA data |
diff --git a/crates/raw/src/demosaic.rs b/crates/raw/src/demosaic.rs
index 8b87f14a69..fa703b2bb4 100644
--- a/crates/raw/src/demosaic.rs
+++ b/crates/raw/src/demosaic.rs
@@ -472,6 +472,14 @@ pub(crate) fn ahd_bands(h: usize) -> usize {
 
 pub(crate) const AHD_TABLE_BYTES: u64 = (LABF_STEPS as u64 + 2) * 4;
 
+/// `v` limited to `lo..=hi` like `f32::clamp`, without its panic on NaN bounds (hostile black
+/// levels can put NaN in the plane): same result for every non-NaN bound.
+#[inline(always)]
+fn clampf(v: f32, lo: f32, hi: f32) -> f32 {
+    let v = if v < lo { lo } else { v };
+    if v > hi { hi } else { v }
+}
+
 fn ahd(p: &Padded, phase: [u8; 4], to_xyz: &Mat3, out: &mut [f32], jobs: usize) {
     let (w, s) = (p.w, p.stride);
     let d = &p.data;
@@ -500,10 +508,10 @@ fn ahd(p: &Padded, phase: [u8; 4], to_xyz: &Mat3, out: &mut [f32], jobs: usize)
                 }
                 let (l, r) = (d[i - 1], d[i + 1]);
                 let gh = (l + r) * 0.5 + (2.0 * c - d[i - 2] - d[i + 2]) * 0.25;
-                g[0][k] = gh.clamp(l.min(r), l.max(r));
+                g[0][k] = clampf(gh, l.min(r), l.max(r));
                 let (u, dn) = (d[i - s], d[i + s]);
                 let gv = (u + dn) * 0.5 + (2.0 * c - d[i - 2 * s] - d[i + 2 * s]) * 0.25;
-                g[1][k] = gv.clamp(u.min(dn), u.max(dn));
+                g[1][k] = clampf(gv, u.min(dn), u.max(dn));
             }
         }
         // 2. RGB candidates and their Lab, band rows 1..n-1, columns 3..s-3.
@@ -600,6 +608,12 @@ mod tests {
         }
     }
 
+    #[test]
+    fn ahd_survives_nan_planes() {
+        let p = Padded::from_plane(&[f32::NAN; 64], 8, 8);
+        assert_eq!(demosaic(&p, [0, 1, 1, 2], Demosaic::Ahd, &IDENTITY, 1).len(), 192);
+    }
+
     /// Mosaics an RGB image with the given phase.
     fn mosaic(rgb: &[[f32; 3]], w: usize, h: usize, phase: [u8; 4]) -> Vec<f32> {
         (0..w * h).map(|i| rgb[i][phase[((i / w) & 1) * 2 + ((i % w) & 1)] as usize]).collect()
diff --git a/crates/raw/src/develop.rs b/crates/raw/src/develop.rs
index 71a8384cd0..ca08846a85 100644
--- a/crates/raw/src/develop.rs
+++ b/crates/raw/src/develop.rs
@@ -279,8 +279,12 @@ pub fn develop_sensor(s: &Sensor, opts: &DevelopOptions) -> Result<Developed> {
                                 let x = c.x + p;
                                 let black = bl.at(x.saturating_sub(s.active.x), y.saturating_sub(s.active.y), 0, 1);
                                 let range = s.white[0] - black;
-                                let gain = if range >= 1.0 { mult[usize::from(cfa.color(x, y)).min(2)] / range } else { 0.0 };
-                                (black, gain)
+                                // A non-finite black (a BlackLevel DOUBLE beyond f32) gives 0, as
+                                // `Scale::value` does, instead of (raw - inf) * 0 = NaN.
+                                if !(range >= 1.0 && black.is_finite()) {
+                                    return (0.0, 0.0);
+                                }
+                                (black, mult[usize::from(cfa.color(x, y)).min(2)] / range)
                             })
                             .collect();
                         let src = &s.data[y * s.width + c.x..y * s.width + c.x + w];
@@ -375,9 +379,23 @@ pub fn develop_sensor(s: &Sensor, opts: &DevelopOptions) -> Result<Developed> {
         Some(l) => GammaLut::with_tone(l.tone.as_ref()),
         None => GammaLut::with_curve(&s.tone_curve),
     };
+    // The default rendering (no Dehaze, no local tone): matrix then encode, in blocks so the
+    // encode's clamp and square root run over whole slices.
+    let plain = map.is_none() && haze.is_none();
     par::chunks_mut(&mut out, band * w * 3, |b, chunk| {
         let start = b * band * w * 3;
         let src = &rgb[start..start + chunk.len()];
+        if plain {
+            let mut buf = [0.0f32; ENCODE_BLOCK];
+            for (oc, sc) in chunk.chunks_mut(ENCODE_BLOCK).zip(src.chunks(ENCODE_BLOCK)) {
+                let n = sc.len();
+                for (t, p) in buf[..n].as_chunks_mut::<3>().0.iter_mut().zip(sc.as_chunks::<3>().0) {
+                    *t = pro(p);
+                }
+                lut.encode_into(&buf[..n], oc);
+            }
+            return;
+        }
         for (i, (o, p)) in chunk.as_chunks_mut::<3>().0.iter_mut().zip(src.as_chunks::<3>().0).enumerate() {
             let mut v = linear(b * band * w + i, p);
             if let Some(m) = &map {
@@ -476,9 +494,13 @@ fn gain_row(s: &Sensor, y: usize, x0: usize, w: usize, k: usize) -> Option<Vec<f
 /// (error below 0.2 code values).
 struct GammaLut {
     table: Vec<f32>,
+    /// `[table[i], table[i + 1] - table[i]]`: the same interpolation from one load.
+    pairs: Vec<[f32; 2]>,
 }
 
 const GAMMA_STEPS: usize = 4096;
+/// Samples per block of [`GammaLut::encode_into`] (whole pixels).
+const ENCODE_BLOCK: usize = 3 * 256;
 
 impl GammaLut {
     #[cfg(test)]
@@ -494,7 +516,7 @@ impl GammaLut {
                 tone(curve, s * s).clamp(0.0, 1.0).powf(1.0 / 1.8) * 65535.0
             })
             .collect();
-        GammaLut { table }
+        Self::from_table(table)
     }
 
     /// The gamma-1.8 encoding after a fitted [`ToneCurve`] (`None`: none, plain gamma 1.8).
@@ -508,7 +530,30 @@ impl GammaLut {
                 }
             })
             .collect();
-        GammaLut { table }
+        Self::from_table(table)
+    }
+
+    fn from_table(table: Vec<f32>) -> Self {
+        let pairs = table.windows(2).map(|p| [p[0], p[1] - p[0]]).collect();
+        GammaLut { table, pairs }
+    }
+
+    /// [`Self::encode`] of every sample of `v` into `out` (at most [`ENCODE_BLOCK`] samples):
+    /// the clamp and square root first over the whole block, then the table.
+    #[inline]
+    fn encode_into(&self, v: &[f32], out: &mut [u16]) {
+        let mut xs = [0.0f32; ENCODE_BLOCK];
+        let n = v.len().min(ENCODE_BLOCK).min(out.len());
+        for (x, &v) in xs[..n].iter_mut().zip(&v[..n]) {
+            let v = if v.is_nan() { 0.0 } else { v.clamp(0.0, 1.0) };
+            *x = v.sqrt() * GAMMA_STEPS as f32;
+        }
+        for (o, &x) in out[..n].iter_mut().zip(&xs[..n]) {
+            let i = (x as usize).min(GAMMA_STEPS);
+            let f = x - i as f32;
+            let [a, step] = self.pairs[i];
+            *o = (a + step * f + 0.5) as u16;
+        }
     }
 
     #[inline]
@@ -589,6 +634,17 @@ pub(crate) fn orient(src: Vec<u16>, w: usize, h: usize, o: u16) -> (Vec<u16>, us
 mod tests {
     use super::*;
 
+    #[test]
+    fn block_encode_matches_per_sample_encode() {
+        let lut = GammaLut::with_curve(&[[0.25, 0.5], [1.0, 1.0]]);
+        let v: Vec<f32> = (0..2000).map(|i| (i as f32 - 300.0) / 1500.0).chain([f32::NAN, f32::INFINITY, f32::NEG_INFINITY, 0.0, 1.0]).collect();
+        for n in [0, 1, 3, 255, ENCODE_BLOCK, v.len().min(ENCODE_BLOCK)] {
+            let mut out = vec![0u16; n];
+            lut.encode_into(&v[..n], &mut out);
+            assert_eq!(out, v[..n].iter().map(|&x| lut.encode(x)).collect::<Vec<_>>(), "{n}");
+        }
+    }
+
     #[test]
     fn hundred_megapixel_bayer_fits_without_raising_default_limits() {
         let mut opts = DevelopOptions::default();
diff --git a/crates/raw/src/dng.rs b/crates/raw/src/dng.rs
index e8422b5419..8329a80d39 100644
--- a/crates/raw/src/dng.rs
+++ b/crates/raw/src/dng.rs
@@ -193,18 +193,26 @@ pub(crate) fn decode(t: &Tiff, limits: &Limits) -> Result<Sensor> {
     if scale.len() == 2 && (scale[0] - scale[1]).abs() > 1e-6 {
         warnings.push("non-square pixels (DefaultScale) are not resampled".to_string());
     }
-    // Opcode lists: OpcodeList2 gain maps (lens shading) are applied; everything else is reported.
+    // Opcode lists: OpcodeList2 gain maps (lens shading) and polynomials (the tone mapping lossy
+    // DNGs carry per plane, #8125) are applied; everything else is reported.
     let mut gain_maps = Vec::new();
+    let mut polynomials = Vec::new();
     for (tg, what) in [(tag::OPCODE_LIST_1, 1), (tag::OPCODE_LIST_2, 2), (tag::OPCODE_LIST_3, 3)] {
         let Some(bytes) = raw.get(tg).and_then(|e| t.raw(e)) else { continue };
-        let (maps, skipped) = opcodes::parse(bytes);
+        let ops = opcodes::parse(bytes);
         if what == 2 {
-            gain_maps = maps;
-        } else if !maps.is_empty() {
-            warnings.push(format!("DNG OpcodeList{what}: GainMap is not applied"));
+            gain_maps = ops.gain_maps;
+            polynomials = ops.polynomials;
+        } else {
+            if !ops.gain_maps.is_empty() {
+                warnings.push(format!("DNG OpcodeList{what}: GainMap is not applied"));
+            }
+            if !ops.polynomials.is_empty() {
+                warnings.push(format!("DNG OpcodeList{what}: MapPolynomial is not applied"));
+            }
         }
-        if !skipped.is_empty() {
-            warnings.push(format!("DNG OpcodeList{what}: {} not applied", skipped.join(", ")));
+        if !ops.skipped.is_empty() {
+            warnings.push(format!("DNG OpcodeList{what}: {} not applied", ops.skipped.join(", ")));
         }
     }
 
@@ -215,14 +223,18 @@ pub(crate) fn decode(t: &Tiff, limits: &Limits) -> Result<Sensor> {
     }
 
     let max = ((1u32 << plane.bits) - 1) as f32;
-    let linearization = raw.get(tag::LINEARIZATION_TABLE).map(|e| t.uints(e)).filter(|v| !v.is_empty() && v.len() <= 65536);
-    let linearization: Option<Vec<u16>> = linearization.map(|v| v.into_iter().map(|x| x.min(65535) as u16).collect());
+    // A LinearizationTable maps integer samples; floating-point data is linear already.
+    let linearization =
+        raw.get(tag::LINEARIZATION_TABLE).filter(|_| plane.float_scale.is_none()).map(|e| t.uints(e)).filter(|v| !v.is_empty() && v.len() <= 65536);
+    let mut linearization: Option<Vec<u16>> = linearization.map(|v| v.into_iter().map(|x| x.min(65535) as u16).collect());
     let white_default = match &linearization {
         Some(l) => f32::from(l.iter().copied().max().unwrap_or(u16::MAX)),
         None => max,
     };
+    // Floating-point levels are in the floats' units: scale them as the samples were.
+    let unit = plane.float_scale.unwrap_or(1.0);
     let wl = t.tag_floats(&raw, tag::WHITE_LEVEL);
-    let white = [0, 1, 2].map(|s| wl.get(s).or_else(|| wl.first()).map(|v| *v as f32).filter(|v| *v > 0.0).unwrap_or(white_default));
+    let white = [0, 1, 2].map(|s| wl.get(s).or_else(|| wl.first()).map(|v| *v as f32 * unit).filter(|v| v.is_finite() && *v > 0.0).unwrap_or(white_default));
 
     let (rows, cols) = match t.tag_uints(&raw, tag::BLACK_LEVEL_REPEAT_DIM).as_slice() {
         [r, c] if (1..=16).contains(r) && (1..=16).contains(c) => (*r as usize, *c as usize),
@@ -230,17 +242,29 @@ pub(crate) fn decode(t: &Tiff, limits: &Limits) -> Result<Sensor> {
     };
     let bl = t.tag_floats(&raw, tag::BLACK_LEVEL);
     let mut black = if bl.len() == rows * cols * samples {
-        BlackLevels { rows, cols, values: bl.iter().map(|v| *v as f32).collect(), delta_h: Vec::new(), delta_v: Vec::new() }
+        BlackLevels { rows, cols, values: bl.iter().map(|v| *v as f32 * unit).collect(), delta_h: Vec::new(), delta_v: Vec::new() }
     } else {
-        BlackLevels::uniform(bl.first().copied().unwrap_or(0.0) as f32)
+        BlackLevels::uniform(bl.first().copied().unwrap_or(0.0) as f32 * unit)
     };
     let dh = t.tag_floats(&raw, tag::BLACK_LEVEL_DELTA_H);
     if dh.len() == active.width {
-        black.delta_h = dh.iter().map(|v| *v as f32).collect();
+        black.delta_h = dh.iter().map(|v| *v as f32 * unit).collect();
     }
     let dv = t.tag_floats(&raw, tag::BLACK_LEVEL_DELTA_V);
     if dv.len() == active.height {
-        black.delta_v = dv.iter().map(|v| *v as f32).collect();
+        black.delta_v = dv.iter().map(|v| *v as f32 * unit).collect();
+    }
+
+    // MapPolynomial maps linear reference values: linearize the samples first (the table is then
+    // done with), and map them in place.
+    let mut data = plane.data;
+    if !polynomials.is_empty() {
+        if let Some(l) = linearization.take() {
+            for v in &mut data {
+                *v = l.get(usize::from(*v)).or_else(|| l.last()).copied().unwrap_or(*v);
+            }
+        }
+        opcodes::apply_polynomials(&mut data, plane.width, samples, active, &polynomials, &black, white);
     }
 
     let color = color_info(t, &ifd0);
@@ -258,7 +282,7 @@ pub(crate) fn decode(t: &Tiff, limits: &Limits) -> Result<Sensor> {
         width: plane.width,
         height: plane.height,
         samples,
-        data: plane.data,
+        data,
         cfa,
         linearization,
         black,
diff --git a/crates/raw/src/jxl.rs b/crates/raw/src/jxl.rs
index 0717dbb3cd..8dc2ff064f 100644
--- a/crates/raw/src/jxl.rs
+++ b/crates/raw/src/jxl.rs
@@ -18,15 +18,18 @@ use crate::error::{RawError, Result};
 
 /// The browser build has no JPEG XL decoder (see the module docs).
 #[cfg(target_arch = "wasm32")]
-pub(crate) fn decode(_src: &[u8], _w: usize, _h: usize, _samples: usize, _bits: u32, _limits: &Limits) -> Result<Vec<u16>> {
+pub(crate) fn decode(_src: &[u8], _w: usize, _h: usize, _samples: usize, _bits: u32, _float_scale: Option<f32>, _limits: &Limits) -> Result<Vec<u16>> {
     Err(RawError::unsupported("JPEG XL-compressed DNG (DNG 1.7) can't be opened in the browser version of PhotoCraft; open it in the desktop app"))
 }
 
 /// Decodes one segment into `w * h * samples` interleaved samples at `bits` per sample (the
-/// TIFF BitsPerSample, which DNG requires the codestream's bit depth to match).
+/// TIFF BitsPerSample, which DNG requires the codestream's bit depth to match). Floating-point
+/// samples (SampleFormat 3) come back multiplied by `float_scale`, clipped to 0..=65535.
 #[cfg(not(target_arch = "wasm32"))]
-pub(crate) fn decode(src: &[u8], w: usize, h: usize, samples: usize, bits: u32, limits: &Limits) -> Result<Vec<u16>> {
-    limits.check(w as u64, h as u64, samples as u64 * 2)?;
+pub(crate) fn decode(src: &[u8], w: usize, h: usize, samples: usize, bits: u32, float_scale: Option<f32>, limits: &Limits) -> Result<Vec<u16>> {
+    // Floating-point samples are read into an f32 buffer first: four bytes a sample, not two.
+    let sample_bytes = if float_scale.is_some() { 4 } else { 2 };
+    limits.check(w as u64, h as u64, samples as u64 * sample_bytes)?;
     // jxl-oxide decodes into f32/i32 planes: allow a few times the output size, and never more
     // than the caller's per-buffer limit.
     let budget = (w as u64).saturating_mul(h as u64).saturating_mul(samples as u64).saturating_mul(16).min(limits.max_alloc);
@@ -50,6 +53,13 @@ pub(crate) fn decode(src: &[u8], w: usize, h: usize, samples: usize, bits: u32,
             return Err(RawError::unsupported("rotated JPEG XL raw tile"));
         }
         let n = w.checked_mul(h).and_then(|p| p.checked_mul(samples)).ok_or_else(|| RawError::malformed("JPEG XL raw tile is too large"))?;
+        if let Some(scale) = float_scale {
+            let mut f = vec![0f32; n];
+            if stream.write_to_buffer(&mut f) != n {
+                return Err(RawError::malformed("JPEG XL raw data is truncated"));
+            }
+            return Ok(f.into_iter().map(|v| if v.is_nan() { 0 } else { (v * scale).clamp(0.0, 65535.0).round() as u16 }).collect());
+        }
         let mut out = vec![0u16; n];
         if stream.write_to_buffer(&mut out) != n {
             return Err(RawError::malformed("JPEG XL raw data is truncated"));
diff --git a/crates/raw/src/lib.rs b/crates/raw/src/lib.rs
index 0d1a99e796..24cd852c77 100644
--- a/crates/raw/src/lib.rs
+++ b/crates/raw/src/lib.rs
@@ -76,8 +76,8 @@ pub use crate::demosaic::Demosaic;
 pub use crate::develop::{DevelopOptions, Developed, RawInfo, WhiteBalance, develop_sensor};
 pub use crate::error::RawError;
 pub use crate::look::{CameraLook, LookRejected, PROXY_EDGE, Reference, ToneCurve, fit_look};
-pub use crate::opcodes::GainMap;
-pub use crate::preview::{Preview, PreviewColorSpace, embedded_preview, embedded_preview_color_space, embedded_previews};
+pub use crate::opcodes::{GainMap, MapPolynomial};
+pub use crate::preview::{DecodedPreview, Preview, PreviewColorSpace, embedded_jxl_preview, embedded_preview, embedded_preview_color_space, embedded_previews};
 pub use crate::sensor::{BlackLevels, Cfa, Rect, Sensor};
 pub use crate::tone::{Tone, retone};
 
diff --git a/crates/raw/src/ljpeg.rs b/crates/raw/src/ljpeg.rs
index 4ab32df8b8..070b3757fd 100644
--- a/crates/raw/src/ljpeg.rs
+++ b/crates/raw/src/ljpeg.rs
@@ -249,7 +249,7 @@ impl<'a> Bits<'a> {
     }
 
     /// A difference value: Huffman-coded category SSSS then SSSS extra bits (T.81 H.1.2.2).
-    #[inline]
+    #[inline(always)]
     fn diff(&mut self, h: &Huffman) -> Result<i32> {
         if self.n < 32 {
             self.refill();
@@ -284,8 +284,11 @@ pub(crate) fn frame(data: &[u8]) -> Result<Frame> {
 
 struct Parsed<'a> {
     frame: Frame,
-    /// Per component of the scan (in frame order): its Huffman table.
+    /// The scan's distinct Huffman tables...
     tables: Vec<Huffman>,
+    /// ...and per component of the scan (in frame order) the index of its table: components
+    /// sharing a table share one copy (one 48 KiB lookup pair in cache instead of several).
+    comp_table: Vec<usize>,
     predictor: u8,
     point_transform: u8,
     restart: usize,
@@ -378,7 +381,9 @@ fn parse(data: &[u8]) -> Result<Parsed<'_>> {
                 if ns != f.components || seg.len() < 1 + 2 * ns + 3 {
                     return Err(RawError::unsupported("lossless JPEG with non-interleaved scans"));
                 }
-                let mut tables = Vec::with_capacity(ns);
+                let mut tables: Vec<Huffman> = Vec::with_capacity(ns);
+                let mut ids: Vec<usize> = Vec::with_capacity(ns);
+                let mut comp_table = Vec::with_capacity(ns);
                 for c in 0..ns {
                     let id = seg[1 + 2 * c];
                     if comp_ids.get(c) != Some(&id) {
@@ -386,7 +391,14 @@ fn parse(data: &[u8]) -> Result<Parsed<'_>> {
                     }
                     let td = usize::from(seg[2 + 2 * c] >> 4);
                     let h = huff.get(td).and_then(Option::as_ref).ok_or_else(|| RawError::malformed("missing Huffman table"))?;
-                    tables.push(h.clone());
+                    match ids.iter().position(|&i| i == td) {
+                        Some(k) => comp_table.push(k),
+                        None => {
+                            ids.push(td);
+                            comp_table.push(tables.len());
+                            tables.push(h.clone());
+                        }
+                    }
                 }
                 let predictor = seg[1 + 2 * ns];
                 let point_transform = seg[3 + 2 * ns] & 0x0F;
@@ -397,7 +409,7 @@ fn parse(data: &[u8]) -> Result<Parsed<'_>> {
                     return Err(RawError::malformed("lossless JPEG point transform"));
                 }
                 let entropy = data.get(pos + len..).unwrap_or(&[]);
-                return Ok(Parsed { frame: f, tables, predictor, point_transform, restart, entropy });
+                return Ok(Parsed { frame: f, tables, comp_table, predictor, point_transform, restart, entropy });
             }
             _ => {} // APPn, COM, DQT, DNL… ignored
         }
@@ -427,6 +439,7 @@ pub(crate) fn decode(data: &[u8], max_samples: usize) -> Result<(Frame, Vec<u16>
     let mut out = vec![0u16; total];
     let mut bits = Bits::new(p.entropy);
     let nc = f.components;
+    let tables: Vec<&Huffman> = p.comp_table.iter().map(|&k| &p.tables[k]).collect();
     let initial = 1i32 << (f.precision - p.point_transform - 1);
     let pred = p.predictor;
     let mut interval_row = 0usize;
@@ -447,17 +460,28 @@ pub(crate) fn decode(data: &[u8], max_samples: usize) -> Result<(Frame, Vec<u16>
             // Predictor 1 (or the first line of an interval): Ra after the first column.
             for c in 0..nc {
                 let px = if first_line { initial } else { i32::from(prev[c]) };
-                cur[c] = (px + bits.diff(&p.tables[c])?) as u16;
+                cur[c] = (px + bits.diff(tables[c])?) as u16;
             }
+            // Ra: the previous pixel's sample of the same component, carried in registers.
             if nc == 1 {
-                let t = &p.tables[0];
-                for i in 1..row_len {
-                    cur[i] = (i32::from(cur[i - 1]) + bits.diff(t)?) as u16;
+                let t = tables[0];
+                let mut ra = cur[0];
+                for v in &mut cur[1..] {
+                    ra = (i32::from(ra) + bits.diff(t)?) as u16;
+                    *v = ra;
+                }
+            } else if nc == 2 {
+                let (t0, t1) = (tables[0], tables[1]);
+                let mut ra = [cur[0], cur[1]];
+                for px in cur[2..].as_chunks_mut::<2>().0 {
+                    ra[0] = (i32::from(ra[0]) + bits.diff(t0)?) as u16;
+                    ra[1] = (i32::from(ra[1]) + bits.diff(t1)?) as u16;
+                    *px = ra;
                 }
             } else {
                 for i in (nc..row_len).step_by(nc) {
                     for c in 0..nc {
-                        cur[i + c] = (i32::from(cur[i + c - nc]) + bits.diff(&p.tables[c])?) as u16;
+                        cur[i + c] = (i32::from(cur[i + c - nc]) + bits.diff(tables[c])?) as u16;
                     }
                 }
             }
@@ -468,7 +492,7 @@ pub(crate) fn decode(data: &[u8], max_samples: usize) -> Result<(Frame, Vec<u16>
             continue;
         }
         for x in 0..f.width {
-            for c in 0..nc {
+            for (c, &table) in tables.iter().enumerate() {
                 let i = x * nc + c;
                 let px = if x == 0 {
                     if first_line { initial } else { i32::from(prev[i]) }
@@ -490,7 +514,7 @@ pub(crate) fn decode(data: &[u8], max_samples: usize) -> Result<(Frame, Vec<u16>
                         }
                     }
                 };
-                let d = bits.diff(&p.tables[c])?;
+                let d = bits.diff(table)?;
                 cur[i] = (px + d) as u16;
             }
         }
@@ -510,7 +534,7 @@ pub(crate) fn decode(data: &[u8], max_samples: usize) -> Result<(Frame, Vec<u16>
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::testgen::lj92_encode;
+    use crate::testgen::{lj92_encode, lj92_encode_tables};
 
     /// Deterministic pseudo-random samples with some structure (smooth + noise).
     fn samples(n: usize, precision: u8, seed: u64) -> Vec<u16> {
@@ -554,6 +578,41 @@ mod tests {
         }
     }
 
+    /// Real CR2 frames declare one DHT per component. Each case gives the components
+    /// different tables (or a mixed sharing), so decoding with the wrong table for a
+    /// component, or one table for all, corrupts the output.
+    #[test]
+    fn roundtrip_with_one_huffman_table_per_component() {
+        let (w, h) = (13, 7);
+        for table_of in [&[0u8, 1][..], &[1, 0], &[0, 1, 2, 3], &[0, 1, 0, 1], &[0, 0, 1, 1], &[3, 2, 1, 0]] {
+            let comps = table_of.len();
+            for predictor in [1u8, 4, 7] {
+                for restart_rows in [None, Some(2)] {
+                    let v = samples(w * h * comps, 14, u64::from(predictor) * 7 + comps as u64);
+                    let j = lj92_encode_tables(&v, w, h, table_of, 14, predictor, restart_rows);
+                    let (f, out) = decode(&j, usize::MAX).unwrap();
+                    assert_eq!(f, Frame { precision: 14, width: w, height: h, components: comps });
+                    assert_eq!(out, v, "tables={table_of:?} pred={predictor} restart={restart_rows:?}");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn roundtrip_per_component_tables_with_16_bit_extremes() {
+        let (w, h) = (16, 9);
+        for table_of in [&[0u8, 1][..], &[0, 1, 0, 1]] {
+            let comps = table_of.len();
+            // Alternating 0 / 65535 forces the 16-bit and 32768 difference categories.
+            let v: Vec<u16> = (0..w * h * comps).map(|i| if (i / 3) % 2 == 0 { 0 } else { 65535 }).collect();
+            for (predictor, restart_rows) in [(1u8, Some(1)), (1, Some(4)), (6, Some(2)), (6, None)] {
+                let j = lj92_encode_tables(&v, w, h, table_of, 16, predictor, restart_rows);
+                let (_, out) = decode(&j, usize::MAX).unwrap();
+                assert_eq!(out, v, "tables={table_of:?} pred={predictor} restart={restart_rows:?}");
+            }
+        }
+    }
+
     #[test]
     fn hostile_streams_error_without_panicking() {
         let v = samples(32 * 8, 14, 7);
diff --git a/crates/raw/src/nefc.rs b/crates/raw/src/nefc.rs
index db1f8b1d74..2ae312917d 100644
--- a/crates/raw/src/nefc.rs
+++ b/crates/raw/src/nefc.rs
@@ -69,7 +69,7 @@ pub(crate) fn read_packed(t: &Tiff, ifd: &Ifd, bits: u32, limits: &Limits) -> Re
     };
     let src = t.bytes(*off as usize, *len as usize).ok_or_else(|| RawError::malformed("packed NEF strip lies outside the file"))?;
     let data = unpack_little_rows(src, w, h, bits)?;
-    Ok(Plane { width: w, height: h, samples: 1, bits, data })
+    Ok(Plane { width: w, height: h, samples: 1, bits, data, float_scale: None })
 }
 
 fn unpack_little_rows(src: &[u8], w: usize, h: usize, bits: u32) -> Result<Vec<u16>> {
@@ -377,7 +377,7 @@ pub(crate) fn read_compressed(t: &Tiff, raw: &Ifd, note: Option<&(Tiff, Ifd)>, l
     let end = (last as usize).saturating_add(last_len as usize).min(t.data.len());
     let src = t.data.get(start..end).filter(|s| !s.is_empty()).ok_or_else(|| RawError::malformed("raw data lies outside the file"))?;
     let data = decode(src, width, height, bits, &table)?;
-    Ok(Plane { width, height, samples: 1, bits, data })
+    Ok(Plane { width, height, samples: 1, bits, data, float_scale: None })
 }
 
 #[cfg(test)]
diff --git a/crates/raw/src/opcodes.rs b/crates/raw/src/opcodes.rs
index 6be6d45077..9b333fd4cf 100644
--- a/crates/raw/src/opcodes.rs
+++ b/crates/raw/src/opcodes.rs
@@ -2,8 +2,12 @@
 //!
 //! An opcode list is big-endian whatever the file's byte order: a count, then
 //! per opcode its ID, DNG version, flags (bit 0 = optional), parameter size
-//! and parameters. Only GainMap (ID 9), the lens-shading correction phones
-//! write in OpcodeList2, is applied; other opcodes are reported.
+//! and parameters. OpcodeList2's GainMap (ID 9), the lens-shading correction
+//! phones write, and MapPolynomial (ID 8), the tone mapping lossy DNGs carry
+//! per plane, are applied; other opcodes are reported.
+
+use crate::par;
+use crate::sensor::{BlackLevels, Rect};
 
 /// One GainMap opcode: a grid of gains, bilinearly interpolated, applied to
 /// the pixels of an area (in active-area coordinates) at a row / column pitch.
@@ -154,28 +158,120 @@ fn gain_map(p: &[u8]) -> Option<GainMap> {
     })
 }
 
-/// Parses an opcode list: the gain maps, and the names of opcodes not applied.
-pub(crate) fn parse(list: &[u8]) -> (Vec<GainMap>, Vec<String>) {
-    let mut maps = Vec::new();
-    let mut skipped = Vec::new();
-    let Some(count) = be32(list, 0) else { return (maps, skipped) };
+/// One MapPolynomial opcode: `out = Σ cᵢ · inⁱ` on the linear reference values (0..1, after the
+/// black and white levels) of an area, in active-area coordinates, and a plane range, at a row /
+/// column pitch. Input and output are clipped to 0..1.
+#[derive(Debug, Clone, PartialEq)]
+pub struct MapPolynomial {
+    pub top: usize,
+    pub left: usize,
+    pub bottom: usize,
+    pub right: usize,
+    pub plane: usize,
+    pub planes: usize,
+    pub row_pitch: usize,
+    pub col_pitch: usize,
+    /// `c₀ … c_degree` (degree at most 8).
+    pub coefficients: Vec<f64>,
+}
+
+impl MapPolynomial {
+    /// The polynomial at `x`, both clipped to 0..1.
+    #[inline]
+    pub fn eval(&self, x: f64) -> f64 {
+        let x = x.clamp(0.0, 1.0);
+        let y = self.coefficients.iter().rev().fold(0.0, |acc, c| acc * x + c);
+        if y.is_finite() { y.clamp(0.0, 1.0) } else { 0.0 }
+    }
+
+    /// `true` if the opcode covers active-area pixel (`ax`, `ay`) in sample `s`.
+    #[inline]
+    fn covers(&self, ax: usize, ay: usize, s: usize) -> bool {
+        s >= self.plane
+            && s - self.plane < self.planes
+            && ay >= self.top
+            && ay < self.bottom
+            && ax >= self.left
+            && ax < self.right
+            && (ay - self.top).is_multiple_of(self.row_pitch)
+            && (ax - self.left).is_multiple_of(self.col_pitch)
+    }
+}
+
+fn map_polynomial(p: &[u8]) -> Option<MapPolynomial> {
+    let u = |i: usize| be32(p, 4 * i).map(|v| v as usize);
+    let (top, left, bottom, right) = (u(0)?, u(1)?, u(2)?, u(3)?);
+    let (plane, planes, row_pitch, col_pitch, degree) = (u(4)?, u(5)?, u(6)?, u(7)?, u(8)?);
+    if degree > 8 || planes == 0 || row_pitch == 0 || col_pitch == 0 || bottom <= top || right <= left {
+        return None;
+    }
+    let coefficients = (0..=degree).map(|i| be64f(p, 36 + 8 * i)).collect::<Option<Vec<f64>>>()?;
+    Some(MapPolynomial { top, left, bottom, right, plane, planes, row_pitch, col_pitch, coefficients })
+}
+
+/// Applies `polys` in order to `data` (`width × height` pixels of `samples` interleaved u16
+/// samples), in the sensor's own units: each covered sample is taken to its linear reference value
+/// with `black` and `white`, mapped, and brought back.
+pub(crate) fn apply_polynomials(data: &mut [u16], width: usize, samples: usize, active: Rect, polys: &[MapPolynomial], black: &BlackLevels, white: [f32; 3]) {
+    if polys.is_empty() || width == 0 || samples == 0 {
+        return;
+    }
+    par::chunks_mut(data, width * samples, |y, row| {
+        let Some(ay) = y.checked_sub(active.y).filter(|ay| *ay < active.height) else { return };
+        for ax in 0..active.width {
+            let x = active.x + ax;
+            for s in 0..samples {
+                let Some(v) = row.get_mut(x * samples + s) else { return };
+                let b = black.at(ax, ay, s, samples);
+                let range = white[s.min(2)] - b;
+                if range.is_nan() || range < 1.0 {
+                    continue;
+                }
+                for p in polys.iter().filter(|p| p.covers(ax, ay, s)) {
+                    let n = (f64::from(*v) - f64::from(b)) / f64::from(range);
+                    *v = (f64::from(b) + p.eval(n) * f64::from(range)).round().clamp(0.0, 65535.0) as u16;
+                }
+            }
+        }
+    });
+}
+
+/// What an opcode list holds: the gain maps and polynomials, and the names of opcodes not applied.
+#[derive(Debug, Default)]
+pub(crate) struct Opcodes {
+    pub gain_maps: Vec<GainMap>,
+    pub polynomials: Vec<MapPolynomial>,
+    pub skipped: Vec<String>,
+}
+
+/// The most MapPolynomial opcodes kept from one list. Real files carry one per plane; every
+/// polynomial is checked for every sample, so a crafted list of thousands would hang the open.
+/// Those past the cap are named as not applied.
+const MAX_POLYNOMIALS: usize = 64;
+
+/// Parses an opcode list.
+pub(crate) fn parse(list: &[u8]) -> Opcodes {
+    let mut out = Opcodes::default();
+    let Some(count) = be32(list, 0) else { return out };
     let mut at = 4usize;
     for _ in 0..count.min(4096) {
         let (Some(id), Some(size)) = (be32(list, at), be32(list, at.saturating_add(12))) else { break };
         let start = at.saturating_add(16);
         let Some(params) = list.get(start..start.saturating_add(size as usize)) else { break };
-        match (id, gain_map(params)) {
-            (9, Some(m)) => maps.push(m),
-            _ => {
-                let n = name(id);
-                if !skipped.contains(&n) {
-                    skipped.push(n);
-                }
+        let applied = match id {
+            9 => gain_map(params).map(|m| out.gain_maps.push(m)).is_some(),
+            8 if out.polynomials.len() < MAX_POLYNOMIALS => map_polynomial(params).map(|p| out.polynomials.push(p)).is_some(),
+            _ => false,
+        };
+        if !applied {
+            let n = name(id);
+            if !out.skipped.contains(&n) {
+                out.skipped.push(n);
             }
         }
         at = at.saturating_add(16).saturating_add(size as usize);
     }
-    (maps, skipped)
+    out
 }
 
 #[cfg(test)]
@@ -214,7 +310,7 @@ mod tests {
     #[test]
     fn parses_gain_maps_and_names_others() {
         let b = list(&[(9, gain_map_params([0, 0, 10, 10], 1, &[[1.0, 2.0], [3.0, 4.0]])), (1, vec![0; 8])]);
-        let (maps, skipped) = parse(&b);
+        let Opcodes { gain_maps: maps, skipped, .. } = parse(&b);
         assert_eq!(maps.len(), 1);
         assert_eq!(skipped, vec!["WarpRectilinear".to_string()]);
         let m = &maps[0];
@@ -235,7 +331,42 @@ mod tests {
         }
         let mut huge = b.clone();
         huge[4 + 16 + 32..4 + 16 + 40].copy_from_slice(&[0xFF; 8]); // points
-        assert!(parse(&huge).0.is_empty());
+        assert!(parse(&huge).gain_maps.is_empty());
+    }
+
+    fn polynomial_params(pitch: u32, degree: u32, coefficients: &[f64]) -> Vec<u8> {
+        let mut p = Vec::new();
+        for v in [0, 0, 10, 10, 1, 2, pitch, pitch, degree] {
+            p.extend_from_slice(&v.to_be_bytes());
+        }
+        for c in coefficients {
+            p.extend_from_slice(&c.to_be_bytes());
+        }
+        p
+    }
+
+    #[test]
+    fn parses_map_polynomials_and_refuses_bad_ones() {
+        let ops = parse(&list(&[(8, polynomial_params(1, 2, &[0.1, 0.5, 0.4]))]));
+        assert!(ops.skipped.is_empty());
+        let p = &ops.polynomials[0];
+        assert_eq!((p.plane, p.planes, p.coefficients.clone()), (1, 2, vec![0.1, 0.5, 0.4]));
+        assert!((p.eval(0.5) - (0.1 + 0.25 + 0.1)).abs() < 1e-12);
+        assert_eq!((p.eval(-1.0), p.eval(9.0)), (0.1, 1.0), "input and output clip to 0..1");
+        assert!(p.covers(3, 4, 1) && p.covers(3, 4, 2) && !p.covers(3, 4, 0) && !p.covers(3, 4, 3));
+        // A degree above 8, a zero pitch, or too few coefficients: not applied, and named.
+        for bad in [polynomial_params(1, 9, &[0.0; 10]), polynomial_params(0, 1, &[0.0, 1.0]), polynomial_params(1, 2, &[0.0, 1.0])] {
+            let ops = parse(&list(&[(8, bad)]));
+            assert!(ops.polynomials.is_empty());
+            assert_eq!(ops.skipped, vec!["MapPolynomial".to_string()]);
+        }
+    }
+
+    #[test]
+    fn map_polynomials_past_the_cap_are_named_not_applied() {
+        let ops = parse(&list(&vec![(8, polynomial_params(1, 1, &[0.0, 1.0])); MAX_POLYNOMIALS + 1]));
+        assert_eq!(ops.polynomials.len(), MAX_POLYNOMIALS);
+        assert_eq!(ops.skipped, vec!["MapPolynomial".to_string()]);
     }
 
     #[test]
@@ -243,7 +374,7 @@ mod tests {
         // at_rv (direct 4-corner bilinear) must equal the old row() + at() path for a range of
         // sample positions, including points outside the grid that clamp.
         let b = list(&[(9, gain_map_params([0, 0, 10, 10], 1, &[[1.0, 2.0], [3.0, 4.5]]))]);
-        let (maps, _) = parse(&b);
+        let maps = parse(&b).gain_maps;
         let m = &maps[0];
         for &rv in &[-1.0, 0.0, 0.17, 0.5, 0.83, 1.0, 2.0] {
             let row = m.row(rv, 0);
diff --git a/crates/raw/src/preview.rs b/crates/raw/src/preview.rs
index e85a2851fd..020539a386 100644
--- a/crates/raw/src/preview.rs
+++ b/crates/raw/src/preview.rs
@@ -1,5 +1,7 @@
 //! Finding the camera-rendered JPEG preview embedded in a raw file.
 
+use crate::Limits;
+use crate::sensor::{JPEG_XL, JpegLayout, read_plane};
 use crate::tiff::{Tiff, tag};
 
 /// An embedded baseline-JPEG preview.
@@ -101,11 +103,60 @@ pub fn embedded_previews(bytes: &[u8]) -> Vec<Preview<'_>> {
     found
 }
 
+/// A DNG 1.7 preview compressed with JPEG XL (Compression 52546), decoded. Converters that
+/// write their raw data as JPEG XL store the larger previews that way too, leaving only a small
+/// thumbnail as a JPEG stream for [`embedded_previews`] (#8125).
+#[derive(Debug, Clone, PartialEq)]
+pub struct DecodedPreview {
+    pub width: u32,
+    pub height: u32,
+    /// BitsPerSample: `rgb` holds `0..=2^bits - 1`.
+    pub bits: u32,
+    /// Interleaved RGB, `width * height * 3` samples.
+    pub rgb: Vec<u16>,
+    /// The DNG PreviewColorSpace (tag 50970); `None` when it's unknown or grey.
+    pub color_space: Option<PreviewColorSpace>,
+}
+
+/// DNG PreviewColorSpace (DNG Specification 1.7).
+const PREVIEW_COLOR_SPACE: u16 = 50970;
+
+/// The largest JPEG XL-compressed RGB preview of a DNG that decodes within `limits`: larger ones
+/// that don't (over the limits, or damaged) give way to the next. `None` when none decodes
+/// (always in the browser build, which has no JPEG XL decoder).
+pub fn embedded_jxl_preview(bytes: &[u8], limits: &Limits) -> Option<DecodedPreview> {
+    let t = Tiff::new(bytes)?;
+    let ifd0 = t.ifd_at(t.first_ifd, 0)?;
+    if !ifd0.has(tag::DNG_VERSION) {
+        return None;
+    }
+    let area = |i: &crate::tiff::Ifd| u64::from(t.tag_uint(i, tag::IMAGE_WIDTH).unwrap_or(0)) * u64::from(t.tag_uint(i, tag::IMAGE_LENGTH).unwrap_or(0));
+    let mut previews: Vec<_> = t
+        .all_ifds()
+        .into_iter()
+        .filter(|i| t.tag_uint(i, tag::NEW_SUBFILE_TYPE) == Some(1))
+        .filter(|i| t.tag_uint(i, tag::COMPRESSION) == Some(JPEG_XL) && t.tag_uint(i, tag::SAMPLES_PER_PIXEL) == Some(3))
+        // A rendered RGB (or YCbCr) picture, not a reduced-resolution LinearRaw or CFA image.
+        .filter(|i| matches!(t.tag_uint(i, tag::PHOTOMETRIC), Some(2 | 6)))
+        .collect();
+    previews.sort_by_key(|i| std::cmp::Reverse(area(i)));
+    let (ifd, plane) = previews.into_iter().find_map(|i| read_plane(&t, &i, limits, JpegLayout::Flat).ok().map(|p| (i, p)))?;
+    let color_space = match t.tag_uint(&ifd, PREVIEW_COLOR_SPACE).or_else(|| t.tag_uint(&ifd0, PREVIEW_COLOR_SPACE)) {
+        Some(2) => Some(PreviewColorSpace::Srgb),
+        Some(3) => Some(PreviewColorSpace::AdobeRgb),
+        Some(4) => Some(PreviewColorSpace::ProPhoto),
+        _ => None,
+    };
+    Some(DecodedPreview { width: u32::try_from(plane.width).ok()?, height: u32::try_from(plane.height).ok()?, bits: plane.bits, rgb: plane.data, color_space })
+}
+
 /// The colour space a raw file states for its embedded previews, which carry no ICC profile of their own.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum PreviewColorSpace {
     Srgb,
     AdobeRgb,
+    /// ProPhoto RGB, which a DNG can state for its previews (PreviewColorSpace 4).
+    ProPhoto,
 }
 
 /// Nikon maker note tag ColorSpace: 1 = sRGB, 2 = Adobe RGB (4 = BT.2100, which is not a preview colour space we
diff --git a/crates/raw/src/sensor.rs b/crates/raw/src/sensor.rs
index a7c512a211..677361aae5 100644
--- a/crates/raw/src/sensor.rs
+++ b/crates/raw/src/sensor.rs
@@ -189,6 +189,9 @@ pub(crate) struct Plane {
     pub samples: usize,
     pub bits: u32,
     pub data: Vec<u16>,
+    /// For floating-point samples, the factor they were multiplied by (their white level becomes
+    /// 65535, `bits` is then 16): the file's black and white levels are scaled by it too.
+    pub float_scale: Option<f32>,
 }
 
 pub(crate) struct Segment {
@@ -212,7 +215,7 @@ pub(crate) enum JpegLayout {
 }
 
 /// DNG 1.7 JPEG XL compression.
-const JPEG_XL: u32 = 52546;
+pub(crate) const JPEG_XL: u32 = 52546;
 
 /// Inflates one zlib tile into at most `need` bytes. The stream must run to its end: a truncated
 /// stream, or one that holds more than `need` bytes, is an error rather than a silent cut-off.
@@ -237,9 +240,22 @@ pub(crate) fn read_plane(t: &Tiff, ifd: &Ifd, limits: &Limits, layout: JpegLayou
     if !(1..=4).contains(&samples) {
         return Err(RawError::unsupported(format!("{samples} samples per pixel")));
     }
-    if t.tag_uint(ifd, tag::SAMPLE_FORMAT) == Some(3) {
-        return Err(RawError::unsupported("floating-point raw data"));
+    // Floating-point data is read when it is JPEG XL-compressed, as converters write lossy
+    // LinearRaw (DNG 1.7, #8125): 16, 24 or 32-bit floats, read as 16-bit samples.
+    let float = t.tag_uint(ifd, tag::SAMPLE_FORMAT) == Some(3);
+    if float && compression != JPEG_XL {
+        return Err(RawError::unsupported("floating-point raw data that isn't JPEG XL-compressed"));
     }
+    if float && !matches!(bits, 16 | 24 | 32) {
+        return Err(RawError::unsupported(format!("{bits}-bit floating-point raw samples")));
+    }
+    let bits = if float { 16 } else { bits };
+    // The floats' highest white level (default 1.0; DNG 1.7 WhiteLevel has one per sample plane)
+    // becomes 65535, so no plane is clipped below its own white level.
+    let float_scale = float.then(|| {
+        let white = t.tag_floats(ifd, tag::WHITE_LEVEL).iter().map(|v| *v as f32).filter(|v| v.is_finite() && *v > 0.0).fold(0.0f32, f32::max);
+        65535.0 / if white > 0.0 { white } else { 1.0 }
+    });
     if !(1..=16).contains(&bits) {
         return Err(RawError::unsupported(format!("{bits}-bit raw samples")));
     }
@@ -286,7 +302,7 @@ pub(crate) fn read_plane(t: &Tiff, ifd: &Ifd, limits: &Limits, layout: JpegLayou
                 // The TIFF predictor runs after unpacking, per row, per sample plane.
                 match t.tag_uint(ifd, tag::PREDICTOR).unwrap_or(1) {
                     1 => Ok(v),
-                    2 => Ok(undelta(&v, samples, s.w * samples, rows, bits)),
+                    2 => Ok(undelta(v, samples, s.w * samples, rows, bits)),
                     3 => Err(RawError::unsupported("floating-point predictor (compression 8, predictor 3)")),
                     p => Err(RawError::malformed(format!("unknown predictor {p}"))),
                 }
@@ -294,7 +310,7 @@ pub(crate) fn read_plane(t: &Tiff, ifd: &Ifd, limits: &Limits, layout: JpegLayou
             // A JPEG XL segment codes only the rows inside the image (strips) or the whole tile.
             JPEG_XL => {
                 let coded_rows = if tiled { s.h } else { rows };
-                let mut v = jxl::decode(src, s.w, coded_rows, samples, bits, limits)?;
+                let mut v = jxl::decode(src, s.w, coded_rows, samples, bits, float_scale, limits)?;
                 v.resize(s.w * s.h * samples, 0);
                 Ok(v)
             }
@@ -303,7 +319,21 @@ pub(crate) fn read_plane(t: &Tiff, ifd: &Ifd, limits: &Limits, layout: JpegLayou
             _ => lossless_jpeg(src, s, rows, samples, layout, limits),
         }
     });
-    let mut data = vec![0u16; width * height * samples];
+    // One segment holding the whole image row for row (a single strip): its buffer is the plane, no
+    // second full-size buffer and no copy. The scatter below then has no segment left to place.
+    let whole = matches!(segments.as_slice(), [s] if s.x == 0 && s.y == 0 && s.w == width && s.h >= height);
+    let mut decoded = decoded.into_iter();
+    let taken = if whole {
+        let mut d = decoded.next().ok_or_else(|| RawError::malformed("raw segment missing"))??;
+        if d.len() < width * height * samples {
+            return Err(RawError::malformed("raw segment is smaller than the image"));
+        }
+        d.truncate(width * height * samples);
+        Some(d)
+    } else {
+        None
+    };
+    let mut data = taken.unwrap_or_else(|| vec![0u16; width * height * samples]);
     for (s, d) in segments.iter().zip(decoded) {
         let d = d?;
         let rows = s.h.min(height - s.y);
@@ -314,7 +344,7 @@ pub(crate) fn read_plane(t: &Tiff, ifd: &Ifd, limits: &Limits, layout: JpegLayou
             data[at..at + cols * samples].copy_from_slice(src);
         }
     }
-    Ok(Plane { width, height, samples, bits, data })
+    Ok(Plane { width, height, samples, bits, data, float_scale })
 }
 
 /// Bytes of decoded samples the segments hold at once.
@@ -464,9 +494,8 @@ fn lossy_jpeg(src: &[u8], s: &Segment, rows: usize, samples: usize, bits: u32, t
 
 /// Reverses TIFF predictor 2 (horizontal differencing) on interleaved samples: each sample
 /// gains its channel's predecessor in the row, wrapping at the sample's container (8 or 16 bits).
-fn undelta(v: &[u16], plane: usize, row_samples: usize, rows: usize, bits: u32) -> Vec<u16> {
+fn undelta(mut out: Vec<u16>, plane: usize, row_samples: usize, rows: usize, bits: u32) -> Vec<u16> {
     let mask: u16 = if bits <= 8 { 0xFF } else { 0xFFFF };
-    let mut out = v.to_vec();
     for row in out.chunks_mut(row_samples.max(1)).take(rows) {
         for i in plane..row.len() {
             if let (Some(&prev), Some(&cur)) = (row.get(i - plane), row.get(i)) {
@@ -495,6 +524,18 @@ fn unpack(src: &[u8], w: usize, rows: usize, samples: usize, bits: u32, le: bool
     if src.len() < row_bytes * rows {
         return Err(truncated());
     }
+    // The common packings, a whole group of samples per fixed run of bytes (MSB first).
+    let per_row = w * samples;
+    match bits {
+        12 | 14 | 10 => {
+            let mut out = vec![0u16; n];
+            for (orow, row) in out.chunks_exact_mut(per_row.max(1)).zip(src.chunks_exact(row_bytes.max(1))) {
+                unpack_row_msb(row, orow, bits);
+            }
+            return Ok(out);
+        }
+        _ => {}
+    }
     let mut out = Vec::with_capacity(n);
     for r in 0..rows {
         let row = &src[r * row_bytes..(r + 1) * row_bytes];
@@ -513,10 +554,86 @@ fn unpack(src: &[u8], w: usize, rows: usize, samples: usize, bits: u32, le: bool
     Ok(out)
 }
 
+/// One MSB-first bit-packed row of 10, 12 or 14-bit samples (`row` holds at least
+/// `out.len() * bits / 8` bytes, rounded up; missing bytes read as 0, as [`unpack`] does).
+fn unpack_row_msb(row: &[u8], out: &mut [u16], bits: u32) {
+    let mask = (1u64 << bits) - 1;
+    // Samples per group and bytes per group: 4 × 10 = 40, 2 × 12 = 24, 4 × 14 = 56 bits.
+    let (g, gb) = match bits {
+        10 => (4, 5),
+        12 => (2, 3),
+        _ => (4, 7),
+    };
+    let groups = out.len() / g;
+    for (o, b) in out[..groups * g].chunks_exact_mut(g).zip(row.chunks_exact(gb)) {
+        let mut acc = 0u64;
+        for &x in b {
+            acc = (acc << 8) | u64::from(x);
+        }
+        for (k, v) in o.iter_mut().enumerate() {
+            *v = ((acc >> ((g - 1 - k) as u32 * bits)) & mask) as u16;
+        }
+    }
+    // The tail (fewer than a group): the general reader.
+    let mut acc: u32 = 0;
+    let mut have = 0u32;
+    let mut it = row.iter().skip(groups * gb);
+    for v in &mut out[groups * g..] {
+        while have < bits {
+            acc = (acc << 8) | u32::from(*it.next().unwrap_or(&0));
+            have += 8;
+        }
+        have -= bits;
+        *v = ((acc >> have) & ((1 << bits) - 1)) as u16;
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    /// The grouped 10/12/14-bit readers equal the plain bit reader on every row width.
+    #[test]
+    fn grouped_unpack_matches_the_bit_reader() {
+        let plain = |src: &[u8], w: usize, rows: usize, bits: u32| {
+            let row_bytes = (w * bits as usize).div_ceil(8);
+            let mut out = Vec::new();
+            for r in 0..rows {
+                let row = &src[r * row_bytes..(r + 1) * row_bytes];
+                let (mut acc, mut have, mut it) = (0u32, 0u32, row.iter());
+                for _ in 0..w {
+                    while have < bits {
+                        acc = (acc << 8) | u32::from(*it.next().unwrap_or(&0));
+                        have += 8;
+                    }
+                    have -= bits;
+                    out.push(((acc >> have) & ((1 << bits) - 1)) as u16);
+                }
+            }
+            out
+        };
+        let mut s = 7u64;
+        for bits in [10u32, 12, 14] {
+            for samples in [1usize, 3] {
+                // Widths whose packed rows are shorter than 16-bit containers (else `unpack` reads containers).
+                for w in [4usize, 5, 7, 8, 13, 64, 67] {
+                    let rows = 3;
+                    let src: Vec<u8> = (0..(w * samples * bits as usize).div_ceil(8) * rows)
+                        .map(|_| {
+                            s = s.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
+                            (s >> 40) as u8
+                        })
+                        .collect();
+                    assert_eq!(
+                        unpack(&src, w, rows, samples, bits, true).unwrap(),
+                        plain(&src, w * samples, rows, bits),
+                        "{bits} bits, {samples} samples, {w} wide"
+                    );
+                }
+            }
+        }
+    }
+
     /// #4959: a decoded segment is retained until the scatter, so the segments are charged
     /// together. Each of these is far inside the budget on its own; their sum is not.
     #[test]
diff --git a/crates/raw/src/sony.rs b/crates/raw/src/sony.rs
index b00fd0360a..bb5dc0a86e 100644
--- a/crates/raw/src/sony.rs
+++ b/crates/raw/src/sony.rs
@@ -155,7 +155,7 @@ pub(crate) fn read_craw(t: &Tiff, ifd: &Ifd, limits: &Limits) -> Result<Plane> {
             }
         }
     });
-    Ok(Plane { width, height, samples: 1, bits: 14, data })
+    Ok(Plane { width, height, samples: 1, bits: 14, data, float_scale: None })
 }
 
 #[cfg(test)]
diff --git a/crates/raw/src/testgen.rs b/crates/raw/src/testgen.rs
index 9d8b8fb94c..02ea402161 100644
--- a/crates/raw/src/testgen.rs
+++ b/crates/raw/src/testgen.rs
@@ -88,9 +88,19 @@ impl BitWriter {
 
 /// Encodes `samples` (raster order, `components` interleaved, values below
 /// `2^precision`) as a lossless JPEG with the given predictor (1–7) and an
-/// optional restart interval in rows.
+/// optional restart interval in rows. All components share one Huffman table.
 pub fn lj92_encode(samples: &[u16], width: usize, height: usize, components: usize, precision: u8, predictor: u8, restart_rows: Option<usize>) -> Vec<u8> {
+    lj92_encode_tables(samples, width, height, &vec![0; components], precision, predictor, restart_rows)
+}
+
+/// Like [`lj92_encode`], but component `c` uses Huffman table `table_of[c]`
+/// (0–3; the component count is `table_of.len()`), one DHT per table id as
+/// CR2 writes them. Table `t` assigns its code lengths rotated by `t`, so the
+/// tables differ even when their statistics match.
+pub fn lj92_encode_tables(samples: &[u16], width: usize, height: usize, table_of: &[u8], precision: u8, predictor: u8, restart_rows: Option<usize>) -> Vec<u8> {
+    let components = table_of.len();
     assert_eq!(samples.len(), width * height * components);
+    assert!(table_of.iter().all(|&t| t < 4));
     let row = width * components;
     let interval = restart_rows.unwrap_or(usize::MAX);
     // Differences per sample, following T.81 H.1.2.1 prediction rules.
@@ -127,31 +137,41 @@ pub fn lj92_encode(samples: &[u16], width: usize, height: usize, components: usi
             }
         }
     }
-    // Table: categories ordered by frequency get increasing code lengths.
-    let mut freq = [0usize; 17];
-    for &d in &diffs {
-        freq[category(d) as usize] += 1;
-    }
-    let mut order: Vec<usize> = (0..17).collect();
-    order.sort_by_key(|&c| std::cmp::Reverse(freq[c]));
-    let mut len_of = [0u8; 17];
-    for (rank, &c) in order.iter().enumerate() {
-        len_of[c] = LENGTHS[rank];
-    }
-    let mut counts = [0u8; 16];
-    let mut vals: Vec<u8> = Vec::new();
-    let mut code_of = [(0u32, 0u32); 17];
-    let mut code = 0u32;
-    for len in 1..=16u8 {
-        for c in 0..17 {
-            if len_of[c] == len {
-                counts[len as usize - 1] += 1;
-                vals.push(c as u8);
-                code_of[c] = (code, u32::from(len));
-                code += 1;
+    // Tables: categories ordered by frequency get increasing code lengths.
+    let mut ids: Vec<u8> = table_of.to_vec();
+    ids.sort_unstable();
+    ids.dedup();
+    let mut code_of = [[(0u32, 0u32); 17]; 4];
+    let mut dhts = Vec::new();
+    for &t in &ids {
+        let mut freq = [0usize; 17];
+        for (i, &d) in diffs.iter().enumerate() {
+            if table_of[i % components] == t {
+                freq[category(d) as usize] += 1;
             }
         }
-        code <<= 1;
+        let mut order: Vec<usize> = (0..17).collect();
+        order.sort_by_key(|&c| std::cmp::Reverse(freq[c]));
+        order.rotate_left(usize::from(t));
+        let mut len_of = [0u8; 17];
+        for (rank, &c) in order.iter().enumerate() {
+            len_of[c] = LENGTHS[rank];
+        }
+        let mut counts = [0u8; 16];
+        let mut vals: Vec<u8> = Vec::new();
+        let mut code = 0u32;
+        for len in 1..=16u8 {
+            for c in 0..17 {
+                if len_of[c] == len {
+                    counts[len as usize - 1] += 1;
+                    vals.push(c as u8);
+                    code_of[usize::from(t)][c] = (code, u32::from(len));
+                    code += 1;
+                }
+            }
+            code <<= 1;
+        }
+        dhts.push((t, counts, vals));
     }
     let mut out = vec![0xFF, 0xD8];
     // SOF3
@@ -164,12 +184,14 @@ pub fn lj92_encode(samples: &[u16], width: usize, height: usize, components: usi
     for c in 0..components {
         out.extend_from_slice(&[c as u8 + 1, 0x11, 0]);
     }
-    // DHT (one table, id 0)
-    out.extend_from_slice(&[0xFF, 0xC4]);
-    out.extend_from_slice(&((2 + 17 + vals.len()) as u16).to_be_bytes());
-    out.push(0x00);
-    out.extend_from_slice(&counts);
-    out.extend_from_slice(&vals);
+    // DHT, one per table id
+    for (t, counts, vals) in &dhts {
+        out.extend_from_slice(&[0xFF, 0xC4]);
+        out.extend_from_slice(&((2 + 17 + vals.len()) as u16).to_be_bytes());
+        out.push(*t);
+        out.extend_from_slice(counts);
+        out.extend_from_slice(vals);
+    }
     if let Some(r) = restart_rows {
         out.extend_from_slice(&[0xFF, 0xDD, 0, 4]);
         out.extend_from_slice(&((r * width) as u16).to_be_bytes());
@@ -178,8 +200,8 @@ pub fn lj92_encode(samples: &[u16], width: usize, height: usize, components: usi
     out.extend_from_slice(&[0xFF, 0xDA]);
     out.extend_from_slice(&((6 + 2 * components) as u16).to_be_bytes());
     out.push(components as u8);
-    for c in 0..components {
-        out.extend_from_slice(&[c as u8 + 1, 0x00]);
+    for (c, &t) in table_of.iter().enumerate() {
+        out.extend_from_slice(&[c as u8 + 1, t << 4]);
     }
     out.extend_from_slice(&[predictor, 0, 0]);
     let mut w = BitWriter { out, acc: 0, n: 0 };
@@ -191,7 +213,7 @@ pub fn lj92_encode(samples: &[u16], width: usize, height: usize, components: usi
             rst = (rst + 1) % 8;
         }
         let s = category(d);
-        let (c, l) = code_of[s as usize];
+        let (c, l) = code_of[usize::from(table_of[i % components])][s as usize];
         w.put(c, l);
         if (1..16).contains(&s) {
             let extra = if d < 0 { (d - 1) as u32 & ((1 << s) - 1) } else { d as u32 };
@@ -487,6 +509,8 @@ pub struct DngSpec {
     pub model: String,
     /// Extra IFD0 entries, written after the generated ones (e.g. malformed colour tags).
     pub ifd0_extra: Vec<(u16, Val)>,
+    /// Extra raw-IFD entries, written after the generated ones (e.g. SampleFormat).
+    pub raw_extra: Vec<(u16, Val)>,
 }
 
 impl DngSpec {
@@ -524,6 +548,7 @@ impl DngSpec {
             make: "Photocraft".into(),
             model: "Synthetic".into(),
             ifd0_extra: Vec::new(),
+            raw_extra: Vec::new(),
         }
     }
 
@@ -772,6 +797,7 @@ impl DngSpec {
         if let Some(l) = &self.linearization {
             raw.push((50712, Val::Short(l.clone())));
         }
+        raw.extend(self.raw_extra.iter().cloned());
         let raw_ifd = t.ifd(raw);
         // IFD0: a tiny RGB thumbnail plus the DNG metadata.
         let thumb = t.blob(vec![128; 3 * 4]);
@@ -847,6 +873,27 @@ pub fn gain_map_opcode_list(area: [u32; 4], pitch: u32, gains: [[f32; 2]; 2]) ->
     b
 }
 
+/// An opcode list of MapPolynomial opcodes (ID 8), one per `(plane, coefficients)`, each over
+/// `area` (top, left, bottom, right) at pitch 1.
+pub fn map_polynomial_opcode_list(area: [u32; 4], planes: &[(u32, Vec<f64>)]) -> Vec<u8> {
+    let mut b = (planes.len() as u32).to_be_bytes().to_vec();
+    for (plane, coefficients) in planes {
+        let mut p = Vec::new();
+        let degree = coefficients.len().saturating_sub(1) as u32;
+        for v in [area[0], area[1], area[2], area[3], *plane, 1, 1, 1, degree] {
+            p.extend_from_slice(&v.to_be_bytes());
+        }
+        for c in coefficients {
+            p.extend_from_slice(&c.to_be_bytes());
+        }
+        for v in [8u32, 0x0103_0000, 0, p.len() as u32] {
+            b.extend_from_slice(&v.to_be_bytes());
+        }
+        b.extend_from_slice(&p);
+    }
+    b
+}
+
 // ---------------------------------------------------------------- CR2
 
 /// A synthetic CR2: one lossless JPEG with `components` components, cut into
diff --git a/crates/raw/src/tiff.rs b/crates/raw/src/tiff.rs
index df695e3346..6b5c44d15d 100644
--- a/crates/raw/src/tiff.rs
+++ b/crates/raw/src/tiff.rs
@@ -480,21 +480,21 @@ mod tests {
         assert!(out.len() < 2 << 20, "dump output was {} bytes", out.len());
         assert!(out.contains("output truncated") || out.len() < 1 << 20);
     }
-}
 
-#[test]
-fn linked_directory_values_are_read_only_as_needed() {
-    // The traversal limit is independent of the TIFF entry count: callers should
-    // never need a complete attacker-controlled offset array to visit SubIFDs.
-    let mut b = b"II*\0\x08\0\0\0".to_vec();
-    b.extend_from_slice(&1u16.to_le_bytes());
-    b.extend_from_slice(&330u16.to_le_bytes());
-    b.extend_from_slice(&4u16.to_le_bytes());
-    b.extend_from_slice(&(1_000_000u32).to_le_bytes());
-    b.extend_from_slice(&26u32.to_le_bytes());
-    b.extend_from_slice(&0u32.to_le_bytes());
-    b.extend_from_slice(&0u32.to_le_bytes());
-    b.resize(26 + 16 * 4, 0);
-    let t = Tiff::new(&b).unwrap();
-    assert!(t.all_ifds().len() <= 17);
+    #[test]
+    fn linked_directory_values_are_read_only_as_needed() {
+        // The traversal limit is independent of the TIFF entry count: callers should
+        // never need a complete attacker-controlled offset array to visit SubIFDs.
+        let mut b = b"II*\0\x08\0\0\0".to_vec();
+        b.extend_from_slice(&1u16.to_le_bytes());
+        b.extend_from_slice(&330u16.to_le_bytes());
+        b.extend_from_slice(&4u16.to_le_bytes());
+        b.extend_from_slice(&(1_000_000u32).to_le_bytes());
+        b.extend_from_slice(&26u32.to_le_bytes());
+        b.extend_from_slice(&0u32.to_le_bytes());
+        b.extend_from_slice(&0u32.to_le_bytes());
+        b.resize(26 + 16 * 4, 0);
+        let t = Tiff::new(&b).unwrap();
+        assert!(t.all_ifds().len() <= 17);
+    }
 }
diff --git a/crates/raw/tests/it/dng.rs b/crates/raw/tests/it/dng.rs
index 7cc04d2a92..ca9d895960 100644
--- a/crates/raw/tests/it/dng.rs
+++ b/crates/raw/tests/it/dng.rs
@@ -1,7 +1,7 @@
 //! Synthetic DNG files: every storage layout decodes to the exact sensor
 //! samples, and development reproduces known colours.
 
-use photocraft_raw::testgen::{DngSpec, DngStorage, Val, baseline_jpeg, mosaic, scene};
+use photocraft_raw::testgen::{self, DngSpec, DngStorage, Val, baseline_jpeg, mosaic, scene};
 use photocraft_raw::*;
 
 fn sensor(bytes: &[u8]) -> Sensor {
@@ -685,6 +685,222 @@ fn jpeg_xl_linear_raw_develops() {
     assert_eq!(develop(&spec.build(), &DevelopOptions::default()).unwrap().rgb, d.rgb);
 }
 
+/// A LinearRaw JPEG XL strip of `data` (16-bit samples) whose raw IFD says the samples are
+/// floating-point (SampleFormat 3), as converters write lossy DNGs (#8125). The codestream is
+/// an integer one (the test encoder writes no floats): the decoder reads it as floats in 0..=1,
+/// the same values a float codestream of `data / 65535` holds.
+fn float_jxl_dng(data: &[u16], w: usize, h: usize, white: Option<f64>) -> DngSpec {
+    let mut spec = DngSpec::cfa(w, h, data.to_vec());
+    spec.samples = 3;
+    spec.white = 0;
+    spec.storage = DngStorage::JxlStrips { rows: h };
+    spec.jxl_segments = vec![jxl(data, w, h, 3, 16)];
+    spec.raw_extra = vec![(339, Val::Short(vec![3; 3]))];
+    if let Some(white) = white {
+        spec.raw_extra.push((50717, Val::Double(vec![white; 3])));
+    }
+    spec
+}
+
+#[test]
+fn floating_point_jpeg_xl_linear_raw_decodes() {
+    let (w, h) = (24, 16);
+    let data = noise(w * h * 3, 16);
+    // White level 1.0 (the default) becomes 65535: the samples read back as stored.
+    let s = sensor(&float_jxl_dng(&data, w, h, None).build());
+    assert_eq!((s.width, s.height, s.samples), (w, h, 3));
+    assert_eq!(s.data, data);
+    assert_eq!(s.white, [65535.0; 3]);
+    // A stated white level of 0.5 becomes 65535 too: samples double, those above it clip.
+    let s = sensor(&float_jxl_dng(&data, w, h, Some(0.5)).build());
+    assert_eq!(s.white, [65535.0; 3]);
+    assert_eq!(s.data, data.iter().map(|&v| (u32::from(v) * 2).min(65535) as u16).collect::<Vec<_>>());
+    // It develops like the same samples stored as integers.
+    let pixels: Vec<u16> = scene(w, h).iter().flat_map(|p| p.map(|v| (v * 20000.0) as u16)).collect();
+    let float = develop(&float_jxl_dng(&pixels, w, h, None).build(), &DevelopOptions::default()).unwrap();
+    let mut ints = DngSpec::cfa(w, h, pixels.clone());
+    ints.samples = 3;
+    ints.white = 65535;
+    ints.storage = DngStorage::Strips { rows: h };
+    assert_eq!(float.rgb, develop(&ints.build(), &DevelopOptions::default()).unwrap().rgb);
+}
+
+#[test]
+fn floating_point_raw_data_that_isnt_jpeg_xl_is_unsupported() {
+    let (w, h) = (8, 4);
+    let mut spec = float_jxl_dng(&noise(w * h * 3, 16), w, h, None);
+    spec.storage = DngStorage::Strips { rows: h };
+    match decode(&spec.build(), &Limits::default()) {
+        Err(RawError::Unsupported(m)) => assert!(m.contains("floating-point"), "{m}"),
+        other => panic!("expected unsupported, got {other:?}"),
+    }
+}
+
+/// WhiteLevel has one value per sample plane: the floats are scaled by the highest, so a plane
+/// with a higher white level than the first keeps its highlights.
+#[test]
+fn floating_point_white_levels_per_plane_scale_from_the_highest() {
+    let (w, h) = (24, 16);
+    let data = noise(w * h * 3, 16);
+    let mut spec = float_jxl_dng(&data, w, h, None);
+    spec.raw_extra.push((50717, Val::Double(vec![0.5, 1.0, 0.5])));
+    let s = sensor(&spec.build());
+    assert_eq!(s.data, data, "scaled by 1.0, the highest: nothing clipped");
+    assert_eq!(s.white, [32767.5, 65535.0, 32767.5]);
+}
+
+/// `Σ cᵢ · xⁱ` at `x`, both clipped to 0..1 (as MapPolynomial).
+fn poly(c: &[f64], x: f64) -> f64 {
+    let x = x.clamp(0.0, 1.0);
+    c.iter().rev().fold(0.0, |acc, c| acc * x + c).clamp(0.0, 1.0)
+}
+
+/// #8125: a lossy DNG's OpcodeList2 carries a MapPolynomial per plane, and its colours depend on
+/// it. Each plane's samples are mapped through its polynomial, on the linear reference values.
+#[test]
+fn map_polynomial_maps_each_plane_of_floating_point_data() {
+    let (w, h) = (24, 16);
+    let data = noise(w * h * 3, 16);
+    let planes = [vec![0.0, 0.5, 0.5], vec![0.0, 1.0], vec![0.1, 0.8, 0.0, 0.3]];
+    let mut spec = float_jxl_dng(&data, w, h, None);
+    spec.opcode_list2 = Some(testgen::map_polynomial_opcode_list(
+        [0, 0, h as u32, w as u32],
+        &planes.iter().enumerate().map(|(p, c)| (p as u32, c.clone())).collect::<Vec<_>>(),
+    ));
+    let bytes = spec.build();
+    let s = sensor(&bytes);
+    let want: Vec<u16> = data.iter().enumerate().map(|(i, &v)| (poly(&planes[i % 3], f64::from(v) / 65535.0) * 65535.0).round() as u16).collect();
+    assert_eq!(s.data, want);
+    assert!(s.warnings.iter().all(|w| !w.contains("MapPolynomial")), "{:?}", s.warnings);
+    let d = develop(&bytes, &DevelopOptions::default()).unwrap();
+    assert!(d.warnings.iter().all(|w| !w.contains("MapPolynomial")), "{:?}", d.warnings);
+}
+
+/// With a LinearizationTable, MapPolynomial maps the linearized values: the samples are
+/// linearized first and the table is then done with.
+#[test]
+fn map_polynomial_follows_the_linearization_table() {
+    let (w, h) = (16, 8);
+    let data = noise(w * h, 12);
+    let table: Vec<u16> = (0..4096u16).map(|i| i * 2).collect();
+    let mut spec = DngSpec::cfa(w, h, data.clone());
+    spec.bits = 12;
+    spec.white = 8190;
+    spec.linearization = Some(table.clone());
+    spec.opcode_list2 = Some(testgen::map_polynomial_opcode_list([0, 0, h as u32, w as u32], &[(0, vec![0.0, 0.0, 1.0])]));
+    let s = sensor(&spec.build());
+    assert!(s.linearization.is_none(), "applied with the polynomial");
+    let want: Vec<u16> = data.iter().map(|&v| (poly(&[0.0, 0.0, 1.0], f64::from(table[usize::from(v)]) / 8190.0) * 8190.0).round() as u16).collect();
+    assert_eq!(s.data, want);
+}
+
+/// A LinearizationTable maps integer samples: floating-point data ignores one.
+#[test]
+fn floating_point_raw_data_ignores_a_linearization_table() {
+    let (w, h) = (24, 16);
+    let data = noise(w * h * 3, 16);
+    let mut spec = float_jxl_dng(&data, w, h, None);
+    spec.linearization = Some(vec![0; 4]);
+    let s = sensor(&spec.build());
+    assert!(s.linearization.is_none());
+    assert_eq!(s.data, data);
+}
+
+/// Floating-point samples are read into four bytes each before they become 16-bit: the limits
+/// are charged for that buffer, not for the two-byte result.
+#[test]
+fn floating_point_jpeg_xl_is_charged_four_bytes_a_sample() {
+    let (w, h) = (24, 16);
+    let bytes = float_jxl_dng(&noise(w * h * 3, 16), w, h, None).build();
+    let limits = Limits { max_alloc: (w * h * 3 * 2) as u64, ..Limits::default() };
+    match decode(&bytes, &limits) {
+        Err(RawError::LimitExceeded(_)) => {}
+        other => panic!("expected the limits to refuse the f32 buffer, got {other:?}"),
+    }
+}
+
+/// When the largest JPEG XL preview doesn't decode, the next largest is used.
+#[test]
+fn a_jpeg_xl_preview_that_does_not_decode_gives_way_to_a_smaller_one() {
+    use photocraft_raw::testgen::TiffBuilder;
+    let mut t = TiffBuilder::default();
+    let preview = |t: &mut TiffBuilder, w: usize, h: usize, stream: Vec<u8>| {
+        let len = stream.len() as u32;
+        let strip = t.blob(stream);
+        t.ifd(vec![
+            (254, Val::Long(vec![1])),
+            (256, Val::Long(vec![w as u32])),
+            (257, Val::Long(vec![h as u32])),
+            (258, Val::Short(vec![8, 8, 8])),
+            (259, Val::Short(vec![52546])),
+            (262, Val::Short(vec![2])),
+            (273, Val::Blobs(vec![strip])),
+            (277, Val::Short(vec![3])),
+            (278, Val::Long(vec![h as u32])),
+            (279, Val::Long(vec![len])),
+        ])
+    };
+    let small = noise(20 * 15 * 3, 8);
+    let damaged = preview(&mut t, 40, 30, vec![0xFF, 0x0A, 0, 0, 0, 0, 0, 0]);
+    let valid = preview(&mut t, 20, 15, jxl(&small, 20, 15, 3, 8));
+    let ifd0 = t.ifd(vec![(254, Val::Long(vec![1])), (330, Val::Ifds(vec![damaged, valid])), (50706, Val::Byte(vec![1, 7, 0, 0]))]);
+    t.chain = vec![ifd0];
+    let p = embedded_jxl_preview(&t.build(), &Limits::default()).expect("the 20×15 preview");
+    assert_eq!((p.width, p.height, p.bits), (20, 15, 8));
+    assert_eq!(p.rgb, small);
+}
+
+/// Only a rendered RGB picture is a preview: a reduced-resolution LinearRaw image (NewSubFileType 1,
+/// three samples, JPEG XL) holds undeveloped sensor data, so the RGB one is used even when smaller.
+#[test]
+fn a_reduced_resolution_linear_raw_is_not_a_jpeg_xl_preview() {
+    use photocraft_raw::testgen::TiffBuilder;
+    let mut t = TiffBuilder::default();
+    let mut ifd = |w: usize, h: usize, photometric: u16, data: &[u16]| {
+        let stream = jxl(data, w, h, 3, 8);
+        let len = stream.len() as u32;
+        let strip = t.blob(stream);
+        t.ifd(vec![
+            (254, Val::Long(vec![1])),
+            (256, Val::Long(vec![w as u32])),
+            (257, Val::Long(vec![h as u32])),
+            (258, Val::Short(vec![8, 8, 8])),
+            (259, Val::Short(vec![52546])),
+            (262, Val::Short(vec![photometric])),
+            (273, Val::Blobs(vec![strip])),
+            (277, Val::Short(vec![3])),
+            (278, Val::Long(vec![h as u32])),
+            (279, Val::Long(vec![len])),
+        ])
+    };
+    let small = noise(20 * 15 * 3, 8);
+    let linear_raw = ifd(40, 30, 34892, &noise(40 * 30 * 3, 8));
+    let rgb = ifd(20, 15, 2, &small);
+    let ifd0 = t.ifd(vec![(254, Val::Long(vec![1])), (330, Val::Ifds(vec![linear_raw, rgb])), (50706, Val::Byte(vec![1, 7, 0, 0]))]);
+    t.chain = vec![ifd0];
+    let p = embedded_jxl_preview(&t.build(), &Limits::default()).expect("the 20×15 RGB preview");
+    assert_eq!((p.width, p.height), (20, 15));
+    assert_eq!(p.rgb, small);
+}
+
+/// A WhiteLevel too large for the sensor's levels (a DOUBLE past f32::MAX) is ignored, as a zero
+/// one is: the samples keep the default white instead of an infinite one that blacks them out.
+#[test]
+fn an_infinite_white_level_falls_back_to_the_default() {
+    let (w, h) = (24, 16);
+    let pixels: Vec<u16> = scene(w, h).iter().flat_map(|p| p.map(|v| (v * 20000.0) as u16)).collect();
+    let mut ints = DngSpec::cfa(w, h, pixels.clone());
+    ints.samples = 3;
+    ints.storage = DngStorage::Strips { rows: h };
+    ints.white = 0;
+    ints.raw_extra.push((50717, Val::Double(vec![1e300; 3])));
+    assert_eq!(sensor(&ints.build()).white, [65535.0; 3], "integer data");
+    let float = float_jxl_dng(&pixels, w, h, Some(1e300)).build();
+    assert_eq!(sensor(&float).white, [65535.0; 3], "floating-point data");
+    let default = develop(&float_jxl_dng(&pixels, w, h, None).build(), &DevelopOptions::default()).unwrap();
+    assert_eq!(develop(&float, &DevelopOptions::default()).unwrap().rgb, default.rgb);
+}
+
 #[test]
 fn jpeg_xl_mismatches_are_errors() {
     let (w, h) = (16, 8);
diff --git a/crates/raw/tests/it/hostile.rs b/crates/raw/tests/it/hostile.rs
index e376f23e9a..6fdd0e7434 100644
--- a/crates/raw/tests/it/hostile.rs
+++ b/crates/raw/tests/it/hostile.rs
@@ -270,3 +270,18 @@ fn lossless_jpeg_frame_larger_than_the_budget_is_refused() {
     let budget = Limits { max_alloc: 256 << 10, ..Limits::default() };
     assert!(matches!(decode(&b, &budget), Err(RawError::LimitExceeded(_))));
 }
+
+#[test]
+fn a_non_finite_black_level_develops_without_panicking() {
+    // A BlackLevel DOUBLE beyond f32 reads as inf: the planes must not turn into NaN and trip
+    // the AHD demosaic.
+    let (w, h) = (64, 48);
+    let mut sensor = decode(&DngSpec::cfa(w, h, vec![1000; w * h]).build(), &Limits::default()).unwrap();
+    for black in [f32::INFINITY, f32::NEG_INFINITY, f32::NAN] {
+        sensor.black = BlackLevels::uniform(black);
+        for demosaic in [Demosaic::Ahd, Demosaic::Bilinear, Demosaic::Mhc] {
+            let d = develop_sensor(&sensor, &DevelopOptions { demosaic, ..DevelopOptions::default() });
+            assert!(d.is_ok(), "{black} {demosaic:?}: {:?}", d.err());
+        }
+    }
+}
diff --git a/crates/tablet/Cargo.toml b/crates/tablet/Cargo.toml
index 8f6ad08fca..83e29c4d68 100644
--- a/crates/tablet/Cargo.toml
+++ b/crates/tablet/Cargo.toml
@@ -19,7 +19,7 @@ todo = "warn"
 # Already in Cargo.lock (eframe/wgpu/fmv-macos-events and winit pull them in); pinned exactly:
 # review the diff before bumping.
 [target.'cfg(target_os = "macos")'.dependencies]
-objc2 = "=0.6.4"
+objc2 = "=0.6.5"
 block2 = "=0.6.2"
 objc2-foundation = { version = "=0.3.2", default-features = false, features = ["std", "NSGeometry"] }
 objc2-app-kit = { version = "=0.3.2", default-features = false, features = ["std", "block2", "NSEvent"] }
diff --git a/crates/text/src/lib.rs b/crates/text/src/lib.rs
index df5aa91338..a19588439f 100644
--- a/crates/text/src/lib.rs
+++ b/crates/text/src/lib.rs
@@ -26,6 +26,7 @@ pub mod glyphs;
 pub mod layout;
 pub mod optical;
 pub mod psd;
+mod psd_path;
 pub mod psd_styles;
 pub mod raster;
 pub mod render;
diff --git a/crates/text/src/psd.rs b/crates/text/src/psd.rs
index 13f3244801..4f3f54c367 100644
--- a/crates/text/src/psd.rs
+++ b/crates/text/src/psd.rs
@@ -223,12 +223,59 @@ pub fn apply_txt2(layer: &mut TextLayer, tysh: &[u8], txt2: &E) {
     layer.sync_summary();
 }
 
-/// The frame (`Txt2 /0 /8 /0` entry) of text object `index`: its rendered frame's `/10` names it.
-fn txt2_frame(txt2: &E, index: usize) -> Option<&E> {
+/// The frame (`Txt2 /0 /8 /0` entry) of text object `index`: its rendered frame's `/10` names it
+/// (with `named`, else the frame its view names; see [`object_frame`]).
+fn txt2_frame(txt2: &E, index: usize, named: bool) -> Option<&E> {
     let object = txt2.path(&["1", "1"]).and_then(E::as_array)?.get(index)?;
-    let frame =
-        object.path(&["1", "2"]).and_then(E::as_array)?.first()?.get("6").and_then(E::as_array)?.iter().find_map(|f| f.get("10").and_then(E::as_i64))?;
-    txt2.path(&["0", "8", "0"]).and_then(E::as_array)?.get(usize::try_from(frame).ok()?)?.get("0")
+    txt2.path(&["0", "8", "0"]).and_then(E::as_array)?.get(object_frame(object, named)?)?.get("0")
+}
+
+/// The number of the frame the text object `object` is drawn in: its rendered frame's `/10`, else
+/// (with `named`) the frame its view names (`/1 /0 [ << /0 n >> ]`). Photoshop leaves the rendered
+/// strikes out for type it did not lay out (`text/path-wave-open.psd`, whose EngineData text is
+/// blank).
+fn object_frame(object: &E, named: bool) -> Option<usize> {
+    let rendered = object
+        .path(&["1", "2"])
+        .and_then(E::as_array)
+        .and_then(|s| s.first())
+        .and_then(|s| s.get("6"))
+        .and_then(E::as_array)
+        .and_then(|parts| parts.iter().find_map(|f| f.get("10").and_then(E::as_i64)));
+    let view = || named.then(|| object.path(&["1", "0"]).and_then(E::as_array).and_then(|f| f.first()).and_then(|f| f.get("0")).and_then(E::as_i64)).flatten();
+    usize::try_from(rendered.or_else(view)?).ok()
+}
+
+/// The `TySh` of `tysh` and the `Txt2` frame of its text object (`named`: see [`object_frame`]),
+/// when that object still holds `layer`'s text (an edit elsewhere leaves `Txt2` stale).
+fn layer_frame<'a>(layer: &TextLayer, tysh: &[u8], txt2: &'a E, named: bool) -> Option<(TySh, &'a E)> {
+    let t = parse_tysh(tysh)?;
+    let index = match t.text.get("TextIndex") {
+        Some(D::Integer(i)) => usize::try_from(*i).ok()?,
+        _ => return None,
+    };
+    let text = txt2.path(&["1", "1"]).and_then(E::as_array).and_then(|a| a.get(index)).and_then(|o| o.path(&["0", "0"])).and_then(E::as_str)?;
+    if text.strip_suffix('\r').unwrap_or(text).replace('\r', "\n") != layer.text {
+        return None;
+    }
+    let frame = txt2_frame(txt2, index, named)?;
+    Some((t, frame))
+}
+
+/// Puts `layer` on its path when its `Txt2` frame is type on a path (#7962): Photoshop keeps the
+/// path only there, and EngineData describes the layer as a text box the size of the path's
+/// bounds. The path is read into the `TySh` text space, the type starting where Photoshop starts
+/// it (see `psd_path`). `Ok(true)` when the layer is now path text, `Ok(false)` when its frame is
+/// no path (or `Txt2` holds another text for it), `Err` with the reason when the path can't be
+/// read: the layer then stays the box or point text EngineData describes.
+pub fn apply_txt2_path(layer: &mut TextLayer, tysh: &[u8], txt2: &E) -> Result<bool, String> {
+    let Some((_, frame)) = layer_frame(layer, tysh, txt2, true) else { return Ok(false) };
+    if crate::psd_path::frame_kind(frame) != crate::psd_path::PATH_FRAME {
+        return Ok(false);
+    }
+    let path = crate::psd_path::read(frame)?;
+    layer.shape = TextShape::Path { path, start: 0.0, flip: false };
+    Ok(true)
 }
 
 /// Places `layer` where Photoshop draws it when the text object's frame in `Txt2` is moved
@@ -240,18 +287,11 @@ fn txt2_frame(txt2: &E, index: usize) -> Option<&E> {
 /// alignment anchor. Only when the layer's `TextIndex` entry still holds the layer's text, as
 /// for [`apply_txt2`], and the frame agrees with the `TySh` `bounds`.
 pub fn apply_txt2_frame(layer: &mut TextLayer, tysh: &[u8], txt2: &E) {
-    let Some(t) = parse_tysh(tysh) else { return };
-    let Some(index) = (match t.text.get("TextIndex") {
-        Some(D::Integer(i)) => usize::try_from(*i).ok(),
-        _ => None,
-    }) else {
-        return;
-    };
-    let text = txt2.path(&["1", "1"]).and_then(E::as_array).and_then(|a| a.get(index)).and_then(|o| o.path(&["0", "0"])).and_then(E::as_str);
-    if text.is_none_or(|t| t.strip_suffix('\r').unwrap_or(t).replace('\r', "\n") != layer.text) {
+    // Type on a path: [`apply_txt2_path`] already read the path through the frame's matrix.
+    if matches!(layer.shape, TextShape::Path { .. }) {
         return;
     }
-    let Some(frame) = txt2_frame(txt2, index) else { return };
+    let Some((t, frame)) = layer_frame(layer, tysh, txt2, false) else { return };
     let m = arr_f(frame.path(&["2", "2"]));
     let matrix = if m.len() == 6 && m.iter().all(|v| v.is_finite()) { Affine { m: [m[0], m[1], m[2], m[3], m[4], m[5]] } } else { Affine::IDENTITY };
     let at = match layer.shape {
@@ -1173,6 +1213,20 @@ pub fn build_txt2_at(objects: &[(i32, &TextLayer)], previous: Option<&[u8]>, dpi
     let all_stubs = prev_objects.iter().all(is_stub);
     // A template is copied once per new layer, so a large one is skipped (the stub is written).
     let template = prev_objects.iter().rev().find(|o| names_one_frame(o) && fits(o, &mut { TEMPLATE_NODES }) && edited_object(o, "\r").is_some());
+    // The frame each written object is drawn in, with its layer's shape (type on a path lives
+    // only in the frame, #7962).
+    let mut frame_shapes: Vec<(usize, &TextShape)> = Vec::new();
+    // A new or rebuilt object must not be drawn in a frame another object is drawn in: the two
+    // layers would share one shape. The frames the file's objects name are taken; a free one is
+    // found past the frame list and the slots (`pad_frames` adds it).
+    let frame_count = prev.as_ref().and_then(|p| p.path(&["0", "8", "0"])).and_then(E::as_array).map(<[E]>::len);
+    let mut taken: std::collections::HashSet<usize> = prev_objects.iter().filter_map(|o| object_frame(o, true)).collect();
+    let slot_count =
+        objects.iter().filter_map(|(i, _)| usize::try_from(*i).ok().filter(|_| (0..=MAX_TEXT_INDEX).contains(i))).map(|i| i + 1).max().unwrap_or(0);
+    let mut next_free = frame_count.unwrap_or(0).max(prev_objects.len()).max(slot_count);
+    // The frame list grows only for the frames handed out here, never for a frame number an
+    // object the file kept names past its list.
+    let mut frames_needed = 0usize;
     for (index, layer) in objects {
         if !(0..=MAX_TEXT_INDEX).contains(index) {
             continue;
@@ -1208,8 +1262,28 @@ pub fn build_txt2_at(objects: &[(i32, &TextLayer)], previous: Option<&[u8]>, dpi
         // A new object (#7698): a layer the file's block has no object for (a type layer added
         // here) takes the shape of one of the file's own objects, refitted the same way, with its
         // view naming its own frame. A bare stub beside Photoshop's objects, its slot without a
-        // frame in `/0 /8 /0`, made Photoshop and Photopea refuse the file.
-        let fresh = (kept.is_none() && edited.is_none()).then(|| template.and_then(|t| new_object(t, at, &text))).flatten();
+        // frame in `/0 /8 /0`, made Photoshop and Photopea refuse the file. A slot whose object
+        // can't be refitted keeps the frame that object was drawn in.
+        let fresh = (kept.is_none() && edited.is_none())
+            .then(|| {
+                let template = template?;
+                let own = slot.and_then(|o| object_frame(o, true)).filter(|f| frame_count.is_some_and(|n| *f < n));
+                let frame = match own {
+                    Some(f) => f,
+                    None if frame_count.is_some() && taken.contains(&at) => {
+                        while taken.contains(&next_free) {
+                            next_free += 1;
+                        }
+                        if next_free > MAX_TEXT_INDEX as usize { at } else { next_free }
+                    }
+                    None => at,
+                };
+                let object = new_object(template, frame, &text)?;
+                taken.insert(frame);
+                frames_needed = frames_needed.max(frame.saturating_add(1));
+                Some(object)
+            })
+            .flatten();
         let reuse = kept.is_some() || edited.is_some();
         let unchanged = kept.is_some();
         let mut object = kept.cloned().or(edited).or(fresh).unwrap_or_else(E::dict);
@@ -1239,6 +1313,9 @@ pub fn build_txt2_at(objects: &[(i32, &TextLayer)], previous: Option<&[u8]>, dpi
             _ => model.set("6", E::Dict(vec![("0".into(), E::Array(runs))])),
         }
         object.set("0", model);
+        if let Some(frame) = object_frame(&object, true) {
+            frame_shapes.push((frame, &layer.shape));
+        }
         if slots.len() <= at {
             slots.resize(at + 1, E::dict());
         }
@@ -1249,7 +1326,24 @@ pub fn build_txt2_at(objects: &[(i32, &TextLayer)], previous: Option<&[u8]>, dpi
     // The outer dictionary keeps whatever the block held (`/98` version, block extras, …), and
     // `/1` whatever it holds beside the text objects.
     let mut outer = prev.clone().unwrap_or_else(|| E::Dict(vec![("98".into(), E::Dict(vec![("0".into(), E::Int(14))])), ("0".into(), E::dict())]));
-    pad_frames(&mut outer, slots.len());
+    pad_frames(&mut outer, slots.len().max(frames_needed));
+    // A path layer's frame holds its path; a layer taken off its path loses its path frame. An
+    // unchanged path leaves the file's frame as it was, and so does a frame the file already had
+    // more than one object drawn in (which layer's shape it should hold is unknown).
+    let mut claims: std::collections::HashMap<usize, usize> = std::collections::HashMap::new();
+    for (at, _) in &frame_shapes {
+        *claims.entry(*at).or_default() += 1;
+    }
+    if let Some(E::Array(frames)) = outer.get_mut("0").and_then(|v| v.get_mut("8")).and_then(|v| v.get_mut("0")) {
+        for (at, shape) in frame_shapes {
+            if claims.get(&at) != Some(&1) {
+                continue;
+            }
+            if let Some(entry) = frames.get_mut(at) {
+                crate::psd_path::update_frame(entry, shape);
+            }
+        }
+    }
     if fonts.len() != fonts_before
         && let Some(list @ E::Dict(_)) = outer.get_mut("0").and_then(|v| v.get_mut("1"))
     {
@@ -1373,10 +1467,7 @@ fn pad_frames(outer: &mut E, count: usize) {
     let Some(E::Array(frames)) = outer.get_mut("0").and_then(|v| v.get_mut("8")).and_then(|v| v.get_mut("0")) else { return };
     let count = count.min(MAX_TEXT_INDEX as usize + 1);
     if frames.len() < count {
-        let kind = E::Dict(vec![("4".into(), E::Int(-1)), ("7".into(), E::Bool(false))]);
-        let data = E::Dict(vec![("6".into(), E::Array(vec![E::Real(-1.0), E::Real(-1.0)])), ("11".into(), kind)]);
-        let frame = E::Dict(vec![("0".into(), E::Dict(vec![("2".into(), data)]))]);
-        frames.resize(count, frame);
+        frames.resize(count, crate::psd_path::point_frame());
     }
 }
 
@@ -1694,7 +1785,9 @@ pub fn build_engine_data(layer: &TextLayer, template: Option<E>, dpi: f32) -> E
         dict.set("UseFractionalGlyphWidths", E::Bool(true));
     }
     let (shape_type, box_bounds) = match &layer.shape {
-        // PSD path type is not written yet: the layer saves as point text.
+        // Type on a path: the path goes into the layer's `Txt2` frame ([`build_txt2`], #7962),
+        // which only a file that already has a `Txt2` object for the layer gets; EngineData
+        // keeps it as point text, one line for readers (and files) without that frame.
         TextShape::Point | TextShape::Path { .. } => (0, None),
         TextShape::Box { x, y, width, height } => (1, Some([*x, *y, x + width, y + height])),
         // PSD area type is not written yet: the layer saves as paragraph text over the path's
diff --git a/crates/text/src/psd_path.rs b/crates/text/src/psd_path.rs
new file mode 100644
index 0000000000..68b4af6229
--- /dev/null
+++ b/crates/text/src/psd_path.rs
@@ -0,0 +1,641 @@
+//! Type on a path in a PSD (#7962): the path lives only in the type layer's frame in the
+//! document's `Txt2` block (EngineData marks such a layer as box text, `ShapeType 1`, with the
+//! path's bounds as its `BoxBounds`).
+//!
+//! Observed layout (Photoshop 2026, `text/path-circle.psd` and `text/path-wave-open.psd` in
+//! photocraft-corpus): a frame `<< /0 << /1 << /0 [ … ] >> /2 << /0 2 /2 [ matrix ] … >> >> >>`
+//! has the kind `/2 /0` (absent for point text, 1 for a text box, 2 for type on a path) and its
+//! outline at `/1 /0` as a flat list of cubic Bézier segments, eight numbers each
+//! (`p0 c1 c2 p1`, the next segment starting where the previous one ends, a closed path ending
+//! where it started), in the frame's space; `/2 /2` maps the frame's space to the `TySh` text
+//! space. On a closed path Photoshop sets the type from the path's last anchor (the circle's
+//! glyph 0 sits on its fourth anchor and runs on through the first), on an open path from its
+//! first. Neither oracle has a moved start or flipped type, so those are written into the path
+//! itself (see [`frame_path`]).
+
+use photocraft_doc::text::TextShape;
+use photocraft_doc::vector::{Knot, PathOp, Subpath};
+use photocraft_geom::{Affine, Point};
+
+use crate::engine_data::Value as E;
+
+/// The `Txt2` frame kind (`/2 /0`) of type on a path.
+pub(crate) const PATH_FRAME: i64 = 2;
+/// The `Txt2` frame kind (`/2 /0`) of a text box.
+const BOX_FRAME: i64 = 1;
+/// Most cubic segments read from a frame (a hostile file cannot make this large).
+const MAX_SEGMENTS: usize = 4096;
+/// How close (px) two points must be to count as the same: Photoshop writes a segment's start as
+/// an exact copy of the previous segment's end.
+const SAME: f64 = 1e-3;
+
+/// The kind of the frame dictionary `frame` (the entry's `/0`): 0 point text, 1 box, 2 path.
+pub(crate) fn frame_kind(frame: &E) -> i64 {
+    frame.path(&["2", "0"]).and_then(E::as_i64).unwrap_or(0)
+}
+
+/// Every entry of `v` as a finite number, or `None`.
+fn numbers(v: &E) -> Option<Vec<f64>> {
+    v.as_array()?.iter().map(E::as_f64).collect()
+}
+
+fn same(a: Point, b: Point) -> bool {
+    (a.x - b.x).hypot(a.y - b.y) <= SAME
+}
+
+/// Whether the handles `a` (in) and `b` (out) of `anchor` are collinear on opposite sides.
+fn smooth(anchor: Point, a: Point, b: Point) -> bool {
+    let (ax, ay, bx, by) = (a.x - anchor.x, a.y - anchor.y, b.x - anchor.x, b.y - anchor.y);
+    let (la, lb) = (ax.hypot(ay), bx.hypot(by));
+    la > SAME && lb > SAME && (ax * by - ay * bx).abs() <= 1e-3 * la * lb && ax * bx + ay * by < 0.0
+}
+
+fn knot(in_ctrl: Point, anchor: Point, out_ctrl: Point) -> Knot {
+    Knot { anchor, in_ctrl, out_ctrl, smooth: smooth(anchor, in_ctrl, out_ctrl) }
+}
+
+/// The type path of a path frame `frame` (the entry's `/0`), in the `TySh` text space, with the
+/// type starting at its first knot. `Err` says why it can't be read (the caller keeps the box or
+/// point text EngineData describes).
+pub(crate) fn read(frame: &E) -> Result<Subpath, String> {
+    let raw = frame.path(&["1", "0"]).ok_or("the frame has no path")?;
+    let v = numbers(raw).ok_or("a path coordinate is not a number")?;
+    if v.is_empty() || v.len() % 8 != 0 {
+        return Err(format!("its path has {} coordinates, not whole curve segments", v.len()));
+    }
+    if v.len() / 8 > MAX_SEGMENTS {
+        return Err(format!("its path has more than {MAX_SEGMENTS} segments"));
+    }
+    let matrix = match frame.path(&["2", "2"]) {
+        None => Affine::IDENTITY,
+        Some(m) => {
+            let Some([a, b, c, d, e, f]) = numbers(m).and_then(|m| <[f64; 6]>::try_from(m).ok()) else {
+                return Err("its frame matrix is not six numbers".into());
+            };
+            let m = Affine { m: [a, b, c, d, e, f] };
+            let det = m.determinant();
+            if !det.is_finite() || det.abs() <= 1e-12 {
+                return Err("its frame matrix is degenerate".into());
+            }
+            m
+        }
+    };
+    let pts: Vec<Point> = v.as_chunks::<2>().0.iter().map(|&[x, y]| matrix.apply(Point::new(x, y))).collect();
+    if pts.iter().any(|p| !p.x.is_finite() || !p.y.is_finite()) {
+        return Err("its path is out of range".into());
+    }
+    let segs: Vec<[Point; 4]> = pts.as_chunks::<4>().0.to_vec();
+    if segs.windows(2).any(|w| matches!(w, [a, b] if !same(a[3], b[0]))) {
+        return Err("its path has more than one piece".into());
+    }
+    let (Some(first), Some(last)) = (segs.first(), segs.last()) else { return Err("the frame has no path".into()) };
+    let (x0, x1) = pts.iter().fold((f64::INFINITY, f64::NEG_INFINITY), |(lo, hi), p| (lo.min(p.x), hi.max(p.x)));
+    let (y0, y1) = pts.iter().fold((f64::INFINITY, f64::NEG_INFINITY), |(lo, hi), p| (lo.min(p.y), hi.max(p.y)));
+    if x1 - x0 <= SAME && y1 - y0 <= SAME {
+        return Err("its path has no length".into());
+    }
+    let closed = same(last[3], first[0]);
+    let mut knots: Vec<Knot> = Vec::with_capacity(segs.len() + 1);
+    for (i, s) in segs.iter().enumerate() {
+        let prev = match i.checked_sub(1).and_then(|j| segs.get(j)) {
+            Some(p) => p[2],
+            None if closed => last[2],
+            None => s[0],
+        };
+        knots.push(knot(prev, s[0], s[1]));
+    }
+    if closed {
+        // The type starts on the closing segment: from the last anchor.
+        knots.rotate_right(1);
+    } else {
+        knots.push(knot(last[2], last[3], last[3]));
+    }
+    Ok(Subpath { closed, knots, op: PathOp::Combine })
+}
+
+/// `path` with its knots in the opposite order (the segments run backwards).
+fn reversed(path: &Subpath) -> Subpath {
+    let mut knots: Vec<Knot> = path.knots.iter().rev().map(|k| Knot { anchor: k.anchor, in_ctrl: k.out_ctrl, out_ctrl: k.in_ctrl, smooth: k.smooth }).collect();
+    if path.closed {
+        // Keep the first knot first: k0, k(n-1), …, k1.
+        knots.rotate_right(1);
+    }
+    Subpath { closed: path.closed, knots, op: path.op }
+}
+
+fn lerp(a: Point, b: Point, t: f64) -> Point {
+    Point::new(a.x + (b.x - a.x) * t, a.y + (b.y - a.y) * t)
+}
+
+fn cubic(s: &[Point; 4], t: f64) -> Point {
+    let (a, b, c) = (lerp(s[0], s[1], t), lerp(s[1], s[2], t), lerp(s[2], s[3], t));
+    lerp(lerp(a, b, t), lerp(b, c, t), t)
+}
+
+/// Pieces each segment is measured in for [`starting_at`].
+const STEPS: usize = 64;
+
+/// `path` starting `s` px along it (the type origin moved there): an open path loses the part
+/// before `s`, a closed one starts at a new smooth knot there. Unchanged for `s` at or before the
+/// start, or (open) at or past the end.
+fn starting_at(path: &Subpath, s: f64) -> Subpath {
+    let segs = path.segments();
+    let lengths: Vec<f64> = segs
+        .iter()
+        .map(|seg| {
+            (1..=STEPS)
+                .map(|i| (cubic(seg, (i - 1) as f64 / STEPS as f64), cubic(seg, i as f64 / STEPS as f64)))
+                .map(|(a, b)| (b.x - a.x).hypot(b.y - a.y))
+                .sum()
+        })
+        .collect();
+    let total: f64 = lengths.iter().sum();
+    if !s.is_finite() || !total.is_finite() || total <= SAME {
+        return path.clone();
+    }
+    let s = if path.closed { s.rem_euclid(total) } else { s };
+    if s <= SAME || (!path.closed && s >= total - SAME) || (path.closed && s >= total - SAME) {
+        return path.clone();
+    }
+    // The segment and parameter at arc length `s` (linear within a measured piece).
+    let mut left = s;
+    let mut at = None;
+    for (i, (seg, len)) in segs.iter().zip(&lengths).enumerate() {
+        if left > *len {
+            left -= len;
+            continue;
+        }
+        let mut walked = 0.0;
+        for k in 1..=STEPS {
+            let (t0, t1) = ((k - 1) as f64 / STEPS as f64, k as f64 / STEPS as f64);
+            let (a, b) = (cubic(seg, t0), cubic(seg, t1));
+            let piece = (b.x - a.x).hypot(b.y - a.y);
+            if walked + piece >= left || k == STEPS {
+                let f = if piece > 0.0 { ((left - walked) / piece).clamp(0.0, 1.0) } else { 0.0 };
+                at = Some((i, t0 + (t1 - t0) * f, *seg));
+                break;
+            }
+            walked += piece;
+        }
+        break;
+    }
+    let Some((i, t, seg)) = at else { return path.clone() };
+    // de Casteljau: left half p0 a ab m, right half m bc c p3.
+    let (a, b, c) = (lerp(seg[0], seg[1], t), lerp(seg[1], seg[2], t), lerp(seg[2], seg[3], t));
+    let (ab, bc) = (lerp(a, b, t), lerp(b, c, t));
+    let m = lerp(ab, bc, t);
+    let n = path.knots.len();
+    if n == 0 {
+        return path.clone();
+    }
+    let next = (i + 1) % n;
+    let mut knots = Vec::with_capacity(n + 1);
+    knots.push(Knot { anchor: m, in_ctrl: if path.closed { ab } else { m }, out_ctrl: bc, smooth: path.closed });
+    let count = if path.closed { n } else { n - next };
+    for r in 0..count {
+        let j = (next + r) % n;
+        let Some(mut k) = path.knots.get(j).copied() else { continue };
+        if j == next {
+            k.in_ctrl = c;
+        }
+        if path.closed && j == i {
+            k.out_ctrl = a;
+        }
+        knots.push(k);
+    }
+    Subpath { closed: path.closed, knots, op: path.op }
+}
+
+/// The path a frame is written with for `TextShape::Path { path, start, flip }`: flipped type is
+/// the path run backwards and a moved start the path from there on (exactly how PhotoCraft lays
+/// type on a path out), so Photoshop, which starts at the path's beginning, sets the same type.
+pub(crate) fn frame_path(path: &Subpath, start: f32, flip: bool) -> Subpath {
+    let path = if flip { reversed(path) } else { path.clone() };
+    starting_at(&path, f64::from(start))
+}
+
+fn real(v: f64) -> E {
+    E::Real(v)
+}
+
+/// The segment list (`/1 /0`) Photoshop reads `path` from: on a closed path the type starts at
+/// the last anchor, so the first knot goes last.
+fn segment_list(path: &Subpath) -> Option<Vec<E>> {
+    let mut knots = path.knots.clone();
+    if path.closed && !knots.is_empty() {
+        knots.rotate_left(1);
+    }
+    let segs = Subpath { closed: path.closed, knots, op: path.op }.segments();
+    let out: Vec<E> = segs.iter().flatten().flat_map(|p| [real(p.x), real(p.y)]).collect();
+    (!out.is_empty() && segs.iter().flatten().all(|p| p.x.is_finite() && p.y.is_finite())).then_some(out)
+}
+
+/// Whether two type paths are the same within [`SAME`] (the smooth flags aside).
+fn same_path(a: &Subpath, b: &Subpath) -> bool {
+    a.closed == b.closed
+        && a.knots.len() == b.knots.len()
+        && a.knots.iter().zip(&b.knots).all(|(p, q)| same(p.anchor, q.anchor) && same(p.in_ctrl, q.in_ctrl) && same(p.out_ctrl, q.out_ctrl))
+}
+
+/// The point-text frame Photoshop writes (`<< /0 << /2 << /6 [ -1.0 -1.0 ] /11 << /4 -1 /7 false
+/// >> >> >> >>`; also what [`crate::psd`] pads the frame list with).
+pub(crate) fn point_frame() -> E {
+    let kind = E::Dict(vec![("4".into(), E::Int(-1)), ("7".into(), E::Bool(false))]);
+    let data = E::Dict(vec![("6".into(), E::Array(vec![real(-1.0), real(-1.0)])), ("11".into(), kind)]);
+    E::Dict(vec![("0".into(), E::Dict(vec![("2".into(), data)]))])
+}
+
+/// A text box's frame as Photoshop writes it (`text/paragraph-box-left.psd`): the rectangle as
+/// four straight segments from its top left, clockwise.
+fn box_frame(x: f64, y: f64, w: f64, h: f64) -> E {
+    let c = [(x, y), (x + w, y), (x + w, y + h), (x, y + h), (x, y)];
+    let pts: Vec<E> =
+        c.windows(2).flat_map(|p| p.iter().flat_map(|&(a, b)| [(a, b), (a, b)]).collect::<Vec<_>>()).flat_map(|(a, b)| [real(a), real(b)]).collect();
+    let kind = E::Dict(vec![("4".into(), E::Int(-2)), ("18".into(), real(-2.0)), ("22".into(), real(0.025))]);
+    let data = E::Dict(vec![("0".into(), E::Int(BOX_FRAME)), ("6".into(), E::Array(vec![real(-2.0), real(-2.0)])), ("11".into(), kind)]);
+    E::Dict(vec![("0".into(), E::Dict(vec![("1".into(), E::Dict(vec![("0".into(), E::Array(pts))])), ("2".into(), data)]))])
+}
+
+/// Brings the frame list entry `entry` (`<< /0 frame >>`) of a type layer up to date with its
+/// `shape`: type on a path gets a path frame for its path (left byte for byte when it already
+/// holds that path, e.g. Photoshop's own after an unedited save), and a layer no longer on a path
+/// loses its path frame (else it would reopen on the path).
+pub(crate) fn update_frame(entry: &mut E, shape: &TextShape) {
+    let frame = entry.get("0");
+    let kind = frame.map_or(0, frame_kind);
+    match shape {
+        TextShape::Path { path, start, flip } => {
+            let path = frame_path(path, *start, *flip);
+            if kind == PATH_FRAME && frame.and_then(|f| read(f).ok()).is_some_and(|p| same_path(&p, &path)) {
+                return;
+            }
+            let Some(list) = segment_list(&path) else { return };
+            // Keep the other keys of a path frame; anything else becomes one.
+            let mut data = match frame.and_then(|f| f.get("2")) {
+                Some(d @ E::Dict(_)) if kind == PATH_FRAME => d.clone(),
+                _ => E::Dict(vec![("6".into(), E::Array(vec![real(-1.0), real(-1.0)]))]),
+            };
+            data.set("0", E::Int(PATH_FRAME));
+            // The path is written in text space.
+            data.set("2", E::Array([1.0, 0.0, 0.0, 1.0, 0.0, 0.0].map(real).to_vec()));
+            let mut frame = match frame {
+                Some(f @ E::Dict(_)) if kind == PATH_FRAME => f.clone(),
+                _ => E::dict(),
+            };
+            frame.set("1", E::Dict(vec![("0".into(), E::Array(list))]));
+            frame.set("2", data);
+            *entry = E::Dict(vec![("0".into(), frame)]);
+        }
+        // Leave unreadable path frames unchanged. They were not imported as detached paths.
+        _ if kind != PATH_FRAME || frame.is_none_or(|f| read(f).is_err()) => {}
+        TextShape::Box { x, y, width, height } => *entry = box_frame(f64::from(*x), f64::from(*y), f64::from(*width), f64::from(*height)),
+        TextShape::Point => *entry = point_frame(),
+        // Area type saves as a text box over its path's bounds, as its EngineData does.
+        TextShape::Area { path } => {
+            *entry = match crate::area::path_bounds(path) {
+                Some((x0, y0, x1, y1)) => box_frame(x0, y0, x1 - x0, y1 - y0),
+                None => point_frame(),
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::engine_data::parse;
+
+    fn frame(src: &str) -> E {
+        parse(src.as_bytes()).unwrap()
+    }
+
+    /// The frame of `text/path-circle.psd` (Photoshop 2026).
+    const CIRCLE: &str = "<< /1 << /0 [ 32.0 128.0 32.0 74.98067 74.98067 32.0 128.0 32.0 128.0 32.0 181.01933 32.0 224.0 74.98067 224.0 128.0 224.0 128.0 224.0 181.01933 181.01933 224.0 128.0 224.0 128.0 224.0 74.98067 224.0 32.0 181.01933 32.0 128.0 ] >> /2 << /0 2 /2 [ 1.0 0.0 0.0 1.0 -32.0 -32.0 ] /6 [ -1.0 -1.0 ] >> >>";
+    /// The frame of `text/path-wave-open.psd` (Photoshop 2026).
+    const WAVE: &str = "<< /1 << /0 [ 16.0 100.0 46.0 40.0 120.0 40.0 160.0 80.0 160.0 80.0 200.0 120.0 274.0 100.0 304.0 60.0 ] >> /2 << /0 2 /2 [ 1.0 0.0 0.0 1.0 -16.0 -52.12246 ] /6 [ -1.0 -1.0 ] >> >>";
+
+    #[test]
+    fn photoshop_path_frames_read_into_text_space() {
+        let wave = read(&frame(WAVE)).unwrap();
+        assert!(!wave.closed);
+        assert_eq!(wave.knots.len(), 3);
+        let p = |x: f64, y: f64| Point::new(x - 16.0, y - 52.12246);
+        let k = &wave.knots;
+        assert!(same(k[0].anchor, p(16.0, 100.0)) && same(k[0].in_ctrl, p(16.0, 100.0)) && same(k[0].out_ctrl, p(46.0, 40.0)));
+        assert!(same(k[1].in_ctrl, p(120.0, 40.0)) && same(k[1].anchor, p(160.0, 80.0)) && same(k[1].out_ctrl, p(200.0, 120.0)) && k[1].smooth);
+        assert!(same(k[2].in_ctrl, p(274.0, 100.0)) && same(k[2].anchor, p(304.0, 60.0)));
+
+        let circle = read(&frame(CIRCLE)).unwrap();
+        assert!(circle.closed);
+        assert_eq!(circle.knots.len(), 4);
+        // The type starts at the bottom anchor (Photoshop's glyph 0) and runs to the left one.
+        assert!(same(circle.knots[0].anchor, Point::new(96.0, 192.0)));
+        assert!(same(circle.knots[1].anchor, Point::new(0.0, 96.0)));
+        assert!(circle.knots.iter().all(|k| k.smooth));
+    }
+
+    #[test]
+    fn written_frames_read_back() {
+        for src in [CIRCLE, WAVE] {
+            let path = read(&frame(src)).unwrap();
+            let mut entry = E::Dict(vec![("0".into(), frame(src))]);
+            let before = entry.clone();
+            update_frame(&mut entry, &TextShape::Path { path: path.clone(), start: 0.0, flip: false });
+            assert_eq!(entry, before, "an unchanged path keeps Photoshop's frame");
+            let mut moved = path.clone();
+            for k in &mut moved.knots {
+                *k = k.transform(&Affine::translate(5.0, -3.0));
+            }
+            update_frame(&mut entry, &TextShape::Path { path: moved.clone(), start: 0.0, flip: false });
+            let back = read(entry.get("0").unwrap()).unwrap();
+            assert!(same_path(&back, &moved), "{back:?}");
+            assert_eq!(entry.path(&["0", "2", "6"]), before.path(&["0", "2", "6"]), "the frame's other keys stay");
+        }
+    }
+
+    /// Flipped type and a moved start are written into the path, which lays the type out the same.
+    #[test]
+    fn flip_and_start_are_baked_into_the_frame() {
+        use crate::warp::Warp;
+        for src in [CIRCLE, WAVE] {
+            let path = read(&frame(src)).unwrap();
+            for (start, flip) in [(40.0, false), (0.0, true), (25.0, true)] {
+                let shape = TextShape::Path { path: path.clone(), start, flip };
+                let baked = TextShape::Path { path: frame_path(&path, start, flip), start: 0.0, flip: false };
+                let (a, b) = (Warp::on_path(&shape).unwrap(), Warp::on_path(&baked).unwrap());
+                for x in [0.0, 10.0, 50.0, 120.0] {
+                    for y in [-12.0, 0.0, 4.0] {
+                        let (p, q) = (a.apply(x, y), b.apply(x, y));
+                        assert!((p.0 - q.0).hypot(p.1 - q.1) < 0.5, "{src:.10} start {start} flip {flip} at ({x}, {y}): {p:?} vs {q:?}");
+                    }
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn hostile_frames_are_errors() {
+        for src in [
+            "<< /2 << /0 2 >> >>",
+            "<< /1 << /0 [ ] >> /2 << /0 2 >> >>",
+            "<< /1 << /0 [ 1.0 2.0 3.0 ] >> /2 << /0 2 >> >>",
+            "<< /1 << /0 [ 0 0 1 1 2 2 (x) 3 ] >> /2 << /0 2 >> >>",
+            "<< /1 << /0 [ 0 0 1 1 2 2 1e999 3 ] >> /2 << /0 2 >> >>",
+            "<< /1 << /0 [ 0 0 1 1 2 2 3 3 ] >> /2 << /0 2 /2 [ 0 0 0 0 0 0 ] >> >>",
+            "<< /1 << /0 [ 0 0 1 1 2 2 3 3 ] >> /2 << /0 2 /2 [ 1 0 0 ] >> >>",
+            "<< /1 << /0 [ 0 0 1 1 2 2 3 3 ] >> /2 << /0 2 /2 [ 1e300 0 0 1e300 0 0 ] >> >>",
+            "<< /1 << /0 [ 0 0 1 1 2 2 3 3 50 50 60 60 70 70 80 80 ] >> /2 << /0 2 >> >>",
+            "<< /1 << /0 [ 5 5 5 5 5 5 5 5 ] >> /2 << /0 2 >> >>",
+            "<< /1 << /0 (path) >> /2 << /0 2 >> >>",
+        ] {
+            assert!(read(&frame(src)).is_err(), "{src}");
+        }
+        let many = format!("<< /1 << /0 [ {} ] >> /2 << /0 2 >> >>", "0 0 1 1 2 2 0 0 ".repeat(MAX_SEGMENTS + 1));
+        assert!(read(&frame(&many)).is_err());
+    }
+
+    fn d(items: Vec<(&str, E)>) -> E {
+        E::Dict(items.into_iter().map(|(k, v)| (k.to_string(), v)).collect())
+    }
+
+    /// A Photoshop-shaped `Txt2` block with one point-text object for `text` (`\r` breaks, trailing
+    /// `\r`) drawn in frame 0.
+    fn photoshop_txt2(text: &str) -> Vec<u8> {
+        photoshop_txt2_in(text, point_frame())
+    }
+
+    /// [`photoshop_txt2`] with the frame list entry `frame`.
+    fn photoshop_txt2_in(text: &str, frame: E) -> Vec<u8> {
+        photoshop_txt2_of(vec![photoshop_object(text, 0)], vec![frame])
+    }
+
+    /// A Photoshop-shaped `Txt2` block holding `objects` and the frame list `frames`.
+    fn photoshop_txt2_of(objects: Vec<E>, frames: Vec<E>) -> Vec<u8> {
+        crate::engine_data::write_bare(&[
+            ("98".into(), d(vec![("0", E::Int(14))])),
+            ("0".into(), d(vec![("8", d(vec![("0", E::Array(frames))]))])),
+            ("1".into(), d(vec![("1", E::Array(objects))])),
+        ])
+    }
+
+    /// A Photoshop-shaped text object for `text` drawn in frame `at`.
+    fn photoshop_object(text: &str, at: i64) -> E {
+        let len = text.encode_utf16().count() as i64;
+        let run = || {
+            d(vec![("0", d(vec![("0", d(vec![("0", E::String(String::new())), ("6", d(vec![("0", E::Int(0)), ("1", E::Real(12.0))]))]))])), ("1", E::Int(len))])
+        };
+        let model = d(vec![("0", E::String(text.into())), ("5", d(vec![("0", E::Array(vec![run()]))])), ("6", d(vec![("0", E::Array(vec![run()]))]))]);
+        let strike = d(vec![("99", E::Name("PC".into())), ("6", E::Array(vec![d(vec![("99", E::Name("F".into())), ("10", E::Int(at))])]))]);
+        let view = d(vec![
+            ("0", E::Array(vec![d(vec![("0", E::Int(at))])])),
+            ("1", d(vec![("0", E::Array(vec![d(vec![("0", d(vec![("1", E::Int(1))])), ("1", E::Int(len))])]))])),
+            ("2", E::Array(vec![strike])),
+        ]);
+        d(vec![("0", model), ("1", view)])
+    }
+
+    fn layer(text: &str, shape: TextShape) -> photocraft_doc::TextLayer {
+        use photocraft_doc::text::{CharStyle, TextRun};
+        let mut t = photocraft_doc::TextLayer {
+            text: text.into(),
+            runs: vec![TextRun { len: text.len(), style: CharStyle { size_pt: 12.0, ..Default::default() } }],
+            shape,
+            transform: Affine::translate(32.0, 20.0),
+            ..Default::default()
+        };
+        t.sync_summary();
+        t
+    }
+
+    /// A layer read back, with what [`crate::psd::apply_txt2_path`] said.
+    type Opened = (photocraft_doc::TextLayer, Result<bool, String>);
+
+    /// Saves `layers` (object `i` each) into a file whose `Txt2` is `prev`, then reads each back:
+    /// its `TySh` and what [`crate::psd::apply_txt2_path`] makes of the saved `Txt2`.
+    fn save_and_open(layers: &[&photocraft_doc::TextLayer], prev: &[u8]) -> (Vec<u8>, Vec<Opened>) {
+        let objects: Vec<(i32, &photocraft_doc::TextLayer)> = layers.iter().enumerate().map(|(i, l)| (i as i32, *l)).collect();
+        let txt2 = crate::psd::build_txt2(&objects, Some(prev));
+        let parsed = crate::psd::parse_txt2(&txt2).unwrap();
+        let back = objects
+            .iter()
+            .map(|(i, l)| {
+                let tysh = crate::psd::set_text_index(&crate::psd::build_tysh(l, 72.0, None), *i).unwrap();
+                let mut back = crate::psd::text_layer_from_tysh(&tysh, 72.0).unwrap();
+                crate::psd::apply_txt2(&mut back, &tysh, &parsed);
+                let applied = crate::psd::apply_txt2_path(&mut back, &tysh, &parsed);
+                crate::psd::apply_txt2_frame(&mut back, &tysh, &parsed);
+                (back, applied)
+            })
+            .collect();
+        (txt2, back)
+    }
+
+    /// #7962: type on a path survives a PSD save and open, for the file's own text object and for
+    /// a layer the file had no object for; a moved start and flipped type come back laid out the
+    /// same, in the path; a second save changes nothing.
+    #[test]
+    fn path_text_round_trips_through_tysh_and_txt2() {
+        let circle = read(&frame(CIRCLE)).unwrap();
+        let wave = read(&frame(WAVE)).unwrap();
+        let a = layer("On a circle", TextShape::Path { path: circle.clone(), start: 0.0, flip: false });
+        let b = layer("Along a wave", TextShape::Path { path: wave.clone(), start: 30.0, flip: true });
+        let prev = photoshop_txt2("On a circle\r");
+        let (txt2, back) = save_and_open(&[&a, &b], &prev);
+        for ((l, applied), (want, start, flip)) in back.iter().zip([(&circle, 0.0, false), (&wave, 30.0, true)]) {
+            assert_eq!(applied, &Ok(true), "{}", l.text);
+            let TextShape::Path { path, start: s, flip: f } = &l.shape else { panic!("{}: {:?}", l.text, l.shape) };
+            assert_eq!((*s, *f), (0.0, false));
+            assert!(same_path(path, &frame_path(want, start, flip)), "{}: {path:?}", l.text);
+            assert_eq!(l.transform, Affine::translate(32.0, 20.0), "the frame's matrix is not applied twice");
+        }
+        let (again, _) = save_and_open(&[&back[0].0, &back[1].0], &txt2);
+        assert_eq!(again, txt2, "a re-save of the opened file changes nothing");
+        // Off its path, the layer opens as point text again.
+        let detached = layer("On a circle", TextShape::Point);
+        let (_, back) = save_and_open(&[&detached], &txt2);
+        assert_eq!(back[0].1, Ok(false));
+        assert_eq!(back[0].0.shape, TextShape::Point);
+    }
+
+    /// A malformed path frame leaves the layer as EngineData describes it, with the reason.
+    #[test]
+    fn a_malformed_path_frame_keeps_the_engine_data_shape() {
+        let a = layer("Hostile", TextShape::Box { x: 0.0, y: 0.0, width: 50.0, height: 20.0 });
+        let tysh = crate::psd::set_text_index(&crate::psd::build_tysh(&a, 72.0, None), 0).unwrap();
+        for bad in ["<< /1 << /0 [ 1 2 3 ] >> /2 << /0 2 >> >>", "<< /1 << /0 [ 0 0 1 1 2 2 3 3 ] >> /2 << /0 2 /2 [ 0 0 0 0 0 0 ] >> >>"] {
+            let entry = E::Dict(vec![("0".into(), frame(bad))]);
+            let txt2 = crate::psd::parse_txt2(&photoshop_txt2_in("Hostile\r", entry)).unwrap();
+            let mut l = crate::psd::text_layer_from_tysh(&tysh, 72.0).unwrap();
+            let before = l.shape.clone();
+            assert!(crate::psd::apply_txt2_path(&mut l, &tysh, &txt2).is_err(), "{bad}");
+            assert_eq!(l.shape, before);
+        }
+    }
+
+    /// A layer taken off its path doesn't keep its path frame (it would reopen on the path).
+    #[test]
+    fn a_layer_off_its_path_loses_the_path_frame() {
+        let mut entry = E::Dict(vec![("0".into(), frame(CIRCLE))]);
+        update_frame(&mut entry, &TextShape::Point);
+        assert_eq!(entry, point_frame());
+        let mut entry = E::Dict(vec![("0".into(), frame(WAVE))]);
+        update_frame(&mut entry, &TextShape::Box { x: 1.0, y: 2.0, width: 30.0, height: 40.0 });
+        assert_eq!(entry.get("0").map(frame_kind), Some(BOX_FRAME));
+        assert_eq!(
+            entry.path(&["0", "1", "0"]).and_then(numbers).unwrap()[..8],
+            [1.0, 2.0, 1.0, 2.0, 31.0, 2.0, 31.0, 2.0],
+            "Photoshop's box outline: corners as straight segments from the top left"
+        );
+        // A point or box frame is left alone.
+        let mut point = point_frame();
+        update_frame(&mut point, &TextShape::Point);
+        assert_eq!(point, point_frame());
+    }
+
+    /// A path frame the import could not read (the layer opened as EngineData's box or point
+    /// text) is saved back as it was, not replaced by a box or point frame.
+    #[test]
+    fn an_unreadable_path_frame_is_kept() {
+        let two_pieces = "<< /1 << /0 [ 0 0 1 1 2 2 3 3 50 50 60 60 70 70 80 80 ] >> /2 << /0 2 >> >>";
+        for shape in [TextShape::Point, TextShape::Box { x: 0.0, y: 0.0, width: 80.0, height: 80.0 }] {
+            let mut entry = E::Dict(vec![("0".into(), frame(two_pieces))]);
+            let before = entry.clone();
+            update_frame(&mut entry, &shape);
+            assert_eq!(entry, before, "{shape:?}");
+        }
+    }
+
+    /// The frame number the object at `index` of the saved `txt2` names, and that frame.
+    fn saved_frame(txt2: &[u8], index: usize) -> (i64, E) {
+        let t = crate::psd::parse_txt2(txt2).unwrap();
+        let object = &t.path(&["1", "1"]).and_then(E::as_array).unwrap()[index];
+        let at = object.path(&["1", "0"]).and_then(E::as_array).unwrap()[0].get("0").and_then(E::as_i64).unwrap();
+        (at, t.path(&["0", "8", "0"]).and_then(E::as_array).unwrap()[at as usize].clone())
+    }
+
+    /// An edited layer whose object the save can't refit keeps drawing in that object's own frame,
+    /// not in the frame its slot number names, which is the path layer's here.
+    #[test]
+    fn an_object_rebuilt_from_a_template_keeps_its_own_frame() {
+        let circle = read(&frame(CIRCLE)).unwrap();
+        let on_path = layer("On a circle", TextShape::Path { path: circle, start: 0.0, flip: false });
+        // Object 1's style run has a length that is no count, so it can't be refitted.
+        let mut broken = photoshop_object("Old\r", 0);
+        let run = d(vec![("0", d(vec![("0", d(vec![("0", E::String(String::new()))]))])), ("1", E::String("x".into()))]);
+        broken.get_mut("0").unwrap().set("6", d(vec![("0", E::Array(vec![run]))]));
+        let path_frame = E::Dict(vec![("0".into(), frame(CIRCLE))]);
+        let prev = photoshop_txt2_of(vec![photoshop_object("On a circle\r", 1), broken], vec![point_frame(), path_frame.clone()]);
+        let (txt2, back) = save_and_open(&[&on_path, &layer("New", TextShape::Point)], &prev);
+        assert_eq!(saved_frame(&txt2, 1).0, 0, "the rebuilt object draws in its own frame");
+        assert_eq!(saved_frame(&txt2, 0), (1, path_frame));
+        assert_eq!(back[0].1, Ok(true));
+        assert!(matches!(back[0].0.shape, TextShape::Path { .. }), "{:?}", back[0].0.shape);
+    }
+
+    /// A new layer whose slot number is the frame another object is drawn in gets a frame of its
+    /// own: neither layer takes the other's shape, on this save or the next.
+    #[test]
+    fn a_new_object_gets_a_frame_no_other_object_is_drawn_in() {
+        let circle = read(&frame(CIRCLE)).unwrap();
+        let on_path = layer("On a circle", TextShape::Path { path: circle, start: 0.0, flip: false });
+        let path_frame = E::Dict(vec![("0".into(), frame(CIRCLE))]);
+        let prev = photoshop_txt2_of(vec![photoshop_object("On a circle\r", 1)], vec![point_frame(), path_frame.clone()]);
+        let new = layer("New", TextShape::Point);
+        let (txt2, back) = save_and_open(&[&on_path, &new], &prev);
+        assert_eq!(saved_frame(&txt2, 1), (2, point_frame()), "a frame past the file's own");
+        assert_eq!(saved_frame(&txt2, 0), (1, path_frame));
+        assert_eq!(back[0].1, Ok(true));
+        assert_eq!((&back[1].1, &back[1].0.shape), (&Ok(false), &TextShape::Point));
+        // The path layer taken off its path on the next save loses its path frame.
+        let (again, _) = save_and_open(&[&layer("On a circle", TextShape::Point), &new], &txt2);
+        assert_eq!(saved_frame(&again, 0), (1, point_frame()));
+    }
+
+    /// A rebuilt object whose old frame number is past the frame list doesn't name a frame the
+    /// block lacks (Photoshop refuses such files, #7698).
+    #[test]
+    fn a_rebuilt_object_never_names_a_missing_frame() {
+        let mut broken = photoshop_object("Old\r", 70_000);
+        let run = d(vec![("0", d(vec![("0", d(vec![("0", E::String(String::new()))]))])), ("1", E::String("x".into()))]);
+        broken.get_mut("0").unwrap().set("6", d(vec![("0", E::Array(vec![run]))]));
+        let path_frame = E::Dict(vec![("0".into(), frame(CIRCLE))]);
+        let prev = photoshop_txt2_of(vec![photoshop_object("On a circle\r", 1), broken], vec![point_frame(), path_frame.clone()]);
+        let on_path = layer("On a circle", TextShape::Path { path: read(&frame(CIRCLE)).unwrap(), start: 0.0, flip: false });
+        let (txt2, _) = save_and_open(&[&on_path, &layer("New", TextShape::Point)], &prev);
+        assert_eq!(saved_frame(&txt2, 1), (2, point_frame()));
+        assert_eq!(saved_frame(&txt2, 0), (1, path_frame));
+    }
+
+    /// An object the file keeps that names a frame past the frame list doesn't grow the list (to
+    /// 65536 point frames here).
+    #[test]
+    fn a_kept_object_naming_a_far_frame_adds_no_frames() {
+        let prev = photoshop_txt2_of(vec![photoshop_object("Far\r", crate::psd::MAX_TEXT_INDEX.into())], vec![point_frame()]);
+        let out = crate::psd::parse_txt2(&crate::psd::build_txt2(&[(0, &layer("Far", TextShape::Point))], Some(&prev))).unwrap();
+        assert_eq!(out.path(&["0", "8", "0"]).and_then(E::as_array).map(<[E]>::len), Some(1));
+    }
+
+    /// A frame the file already has two objects drawn in is left as the file has it, not given
+    /// the shape of whichever layer comes last.
+    #[test]
+    fn a_frame_two_objects_name_is_kept() {
+        let circle = read(&frame(CIRCLE)).unwrap();
+        let on_path = layer("On a circle", TextShape::Path { path: circle, start: 0.0, flip: false });
+        let path_frame = E::Dict(vec![("0".into(), frame(CIRCLE))]);
+        let objects = vec![photoshop_object("On a circle\r", 1), photoshop_object("Point\r", 1)];
+        let prev = photoshop_txt2_of(objects, vec![point_frame(), path_frame.clone()]);
+        let (txt2, _) = save_and_open(&[&on_path, &layer("Point", TextShape::Point)], &prev);
+        assert_eq!(saved_frame(&txt2, 0), (1, path_frame));
+        assert_eq!(saved_frame(&txt2, 1).0, 1);
+    }
+
+    /// Area type's frame becomes a text box over its path's bounds, as its EngineData describes it.
+    #[test]
+    fn an_area_layer_gets_a_box_frame() {
+        let square =
+            photocraft_doc::vector::Path::new(vec![photocraft_doc::vector::Subpath::polygon(&[(10.0, 20.0), (50.0, 20.0), (50.0, 80.0), (10.0, 80.0)])]);
+        let mut entry = E::Dict(vec![("0".into(), frame(CIRCLE))]);
+        update_frame(&mut entry, &TextShape::Area { path: square });
+        assert_eq!(entry, box_frame(10.0, 20.0, 40.0, 60.0));
+    }
+}
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index 23ecfc3b09..c95da851e0 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -30,18 +30,22 @@ photocraft-format = { workspace = true }
 # Decoding the brand mark's PNG (`brand.rs`); already linked through photocraft-io.
 photocraft-codecs = { workspace = true }
 egui = { workspace = true }
-egui_extras = { version = "0.36", default-features = false, features = ["svg"] }
-eframe = { workspace = true, features = ["wgpu", "accesskit"] }
+egui_extras = { version = "0.37", default-features = false, features = ["svg"] }
+eframe = { workspace = true, features = ["wgpu", "accesskit", "clipboard"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 # Display order of right-to-left labels (`bidi_text.rs`); already linked through usvg.
 unicode-bidi = "0.3"
-base64 = "0.22"
+base64 = "0.23"
 # Inflating the translation catalogs, stored deflated (build.rs); already linked through photocraft-io.
 flate2 = { workspace = true }
+web-time = { workspace = true }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+# Floating panels open in their own OS windows on the desktop; the web keeps them in the page.
+craft-ui = { workspace = true, features = ["native-windows"] }
+craft-update = { workspace = true }
 rayon = { workspace = true }
 # Safe native UI-language APIs (Windows/macOS); no subprocess or web dependency.
 sys-locale = "=0.3.2"
@@ -54,7 +58,7 @@ winsafe = { version = "=0.0.29", default-features = false, features = ["kernel",
 [dev-dependencies]
 # egui's own default fonts in tests: the oracle for egui_fonts.rs, and contexts made with
 # `Context::default()` (no install_fonts) can lay out text.
-egui = { workspace = true, features = ["default_fonts"] }
+egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"] }
 # Synthetic raw files for the open-time Camera Raw dialog tests.
 photocraft-raw = { workspace = true, features = ["testgen"] }
 egui_kittest = { workspace = true, features = ["wgpu", "snapshot", "eframe"] }
@@ -70,6 +74,6 @@ tempfile = "3"
 # Deflates the translation catalogs and egui's default fonts (build.rs); already linked at run time to inflate them.
 flate2 = { workspace = true }
 # egui's default fonts, deflated by build.rs for egui_fonts.rs (the same version egui uses).
-epaint_default_fonts = "0.36"
+epaint_default_fonts = { version = "0.37", features = ["monochrome_emoji_fonts"] }
 serde_json = { workspace = true }
 toml = "1"
diff --git a/crates/ui-egui/build.rs b/crates/ui-egui/build.rs
index 900370eb69..df65585d7e 100644
--- a/crates/ui-egui/build.rs
+++ b/crates/ui-egui/build.rs
@@ -37,8 +37,11 @@ fn main() {
 fn deflate_egui_fonts() {
     use std::io::Write as _;
     let out = std::path::PathBuf::from(std::env::var_os("OUT_DIR").unwrap_or_default()).join("egui_fonts");
+    // `egui-icons` is unconditional in 0.37 (a handful of private-use symbols, 3.5 kB); the two
+    // emoji fonts come through `monochrome_emoji_fonts` in Cargo.toml.
     let fonts = [
         ("Hack-Regular", epaint_default_fonts::HACK_REGULAR),
+        ("egui-icons", epaint_default_fonts::EGUI_ICONS),
         ("NotoEmoji-Regular", epaint_default_fonts::NOTO_EMOJI_REGULAR),
         ("Ubuntu-Light", epaint_default_fonts::UBUNTU_LIGHT),
         ("emoji-icon-font", epaint_default_fonts::EMOJI_ICON),
diff --git a/crates/ui-egui/examples/color_picker_demo.rs b/crates/ui-egui/examples/color_picker_demo.rs
index 45daa45c12..f7c304a007 100644
--- a/crates/ui-egui/examples/color_picker_demo.rs
+++ b/crates/ui-egui/examples/color_picker_demo.rs
@@ -64,7 +64,7 @@ fn main() {
             if screen_picker::showing(ui.ctx()) {
                 screen_picker::show(ui.ctx());
             } else {
-                screen_picker::button(ui, egui::Id::new("demo"));
+                screen_picker::button(ui, egui::Id::unique("demo"));
             }
         },
         PhotocraftApp::new(photocraft_engine::Session::new(), services),
diff --git a/crates/ui-egui/examples/layout_bench.rs b/crates/ui-egui/examples/layout_bench.rs
index a846415423..e57035c137 100644
--- a/crates/ui-egui/examples/layout_bench.rs
+++ b/crates/ui-egui/examples/layout_bench.rs
@@ -144,6 +144,25 @@ fn point_on(h: &H, id: LayerId) -> Option<[f64; 2]> {
     None
 }
 
+/// Preserve current Smart Objects and restore only legacy pixel fallbacks in the fixture.
+fn restore_layout_smart_objects(s: &mut photocraft_engine::Session) -> Result<(), photocraft_engine::EngineError> {
+    let st = s.active().ok_or(photocraft_engine::EngineError::NoDocument)?;
+    let ids: Vec<_> = st
+        .doc
+        .walk()
+        .iter()
+        .filter(|(_, _, l)| {
+            (l.name == "Logo" || (l.name.starts_with("Product ") && !l.name.contains('—') && !l.is_group())) && !matches!(&l.content, LayerContent::Smart(_))
+        })
+        .map(|(_, _, l)| l.id.0)
+        .collect();
+    for id in ids {
+        s.execute("layer.select", json!({"layer": id}))?;
+        s.execute("layer.smartObjects.convertToSmartObject", json!({"layer": id}))?;
+    }
+    Ok(())
+}
+
 fn main() {
     reexec_with_gpu_sync();
     let args: Vec<String> = std::env::args().collect();
@@ -165,14 +184,13 @@ fn main() {
         let t = Instant::now();
         let r = photocraft_io::import("layout.psd", &psd).expect("psd import");
         println!("PSD: {:.1} MB, save {t_save:.0} ms, open {:.0} ms ({} warnings)", psd.len() as f64 / 1e6, ms(t), r.warnings.len());
-        // PSD export writes engine-made smart objects as pixels (no SoLd yet): convert them back,
-        // as a Photoshop-made file would have them.
+        // Current PSDs preserve Smart Objects. Restore only raster fallbacks from older
+        // writers, selecting each target before the command checks its enabled state.
         let mut s = photocraft_engine::Session::new();
         s.open_document(r.document, None);
-        let smart = |l: &photocraft_doc::Layer| l.name == "Logo" || (l.name.starts_with("Product ") && !l.name.contains('—') && !l.is_group());
-        let ids: Vec<u64> = s.active().map(|st| st.doc.walk().iter().filter(|(_, _, l)| smart(l)).map(|(_, _, l)| l.id.0).collect()).unwrap_or_default();
-        for id in ids {
-            s.execute("layer.smartObjects.convertToSmartObject", json!({"layer": id})).expect("convert");
+        if let Err(error) = restore_layout_smart_objects(&mut s) {
+            eprintln!("cannot prepare layout benchmark: {error}");
+            std::process::exit(1);
         }
         (*s.active().expect("doc").doc).clone()
     };
@@ -470,3 +488,38 @@ fn reexec_with_gpu_sync() {
     let status = std::process::Command::new(exe).args(std::env::args().skip(1)).env("PHOTOCRAFT_GPU_SYNC", "1").status().expect("re-exec");
     std::process::exit(status.code().unwrap_or(1));
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn restore_keeps_native_smart_objects_and_converts_legacy_pixels_once() {
+        let mut s = photocraft_engine::Session::new();
+        s.execute("file.new", json!({"width": 4, "height": 3, "background": "white"})).unwrap();
+        s.execute("layer.new.layer", json!({"name": "Logo"})).unwrap();
+        s.execute("edit.fill", json!({"contents": "color", "color": "#204060"})).unwrap();
+        s.execute("layer.smartObjects.convertToSmartObject", json!({})).unwrap();
+        let native = s.active().unwrap().active_layer.unwrap();
+        let before = s.active().unwrap().doc.layer(native).unwrap().content.clone();
+        s.execute("layer.new.layer", json!({"name": "Product 1"})).unwrap();
+        s.execute("edit.fill", json!({"contents": "color", "color": "#406020"})).unwrap();
+        s.execute("layer.new.layer", json!({"name": "Tile 1"})).unwrap();
+        let tile = s.active().unwrap().active_layer.unwrap();
+        s.execute("layer.select", json!({"layer": native.0})).unwrap();
+        let history = s.active().unwrap().history.past_len();
+        restore_layout_smart_objects(&mut s).expect("mixed current and legacy fixture prepares without re-converting a Smart Object");
+        let st = s.active().unwrap();
+        assert_eq!(st.doc.layer(native).unwrap().content, before);
+        assert!(matches!(&st.doc.layer(tile).unwrap().content, LayerContent::Raster(_)));
+        assert!(st.doc.walk().iter().any(|(_, _, l)| l.name == "Product 1" && matches!(&l.content, LayerContent::Smart(_))));
+        assert_eq!(st.history.past_len(), history + 1);
+        restore_layout_smart_objects(&mut s).unwrap();
+        assert_eq!(s.active().unwrap().history.past_len(), history + 1, "preparation is idempotent");
+    }
+
+    #[test]
+    fn restore_without_a_document_returns_an_error() {
+        assert!(matches!(restore_layout_smart_objects(&mut photocraft_engine::Session::new()), Err(photocraft_engine::EngineError::NoDocument)));
+    }
+}
diff --git a/crates/ui-egui/src/actions.rs b/crates/ui-egui/src/actions.rs
index 946a246d62..2c5e423314 100644
--- a/crates/ui-egui/src/actions.rs
+++ b/crates/ui-egui/src/actions.rs
@@ -454,9 +454,9 @@ fn insert_stop_dialog(app: &mut PhotocraftApp) -> Result<Value, String> {
 }
 
 pub fn insert_stop_body(ui: &mut egui::Ui, fields: &mut serde_json::Map<String, Value>) {
-    ui.label(tl!("Message:"));
+    let message_label = ui.label(tl!("Message:"));
     let mut message = fields.get("message").and_then(Value::as_str).unwrap_or_default().to_string();
-    ui.add(egui::TextEdit::multiline(&mut message).desired_rows(4).desired_width(320.0));
+    ui.add(egui::TextEdit::multiline(&mut message).desired_rows(4).desired_width(320.0)).labelled_by(message_label.id);
     fields.insert("message".into(), json!(message));
     ui.add_space(6.0);
     let mut allow = fields.get("allowContinue").and_then(Value::as_bool).unwrap_or(false);
@@ -760,8 +760,8 @@ fn delete_selection(app: &mut PhotocraftApp) {
 /// returns the new name to commit; Escape cancels and keeps the old name.
 fn rename_field(app: &mut PhotocraftApp, ui: &mut egui::Ui, index: usize, rect: Rect) -> Option<String> {
     let mut r = app.ui.actions.renaming.take().filter(|r| r.index == index)?;
-    let id = egui::Id::new(("action-rename-field", index));
-    let te = ui.put(rect, egui::TextEdit::singleline(&mut r.text).id(id).font(egui::FontId::proportional(12.0)));
+    let id = egui::Id::unique(("action-rename-field", index));
+    let te = ui.put(rect, egui::TextEdit::singleline(&mut r.text).id(id).font(egui::FontId::proportional(12.0))).accessible_name(tl!("Name"));
     if !r.focused {
         te.request_focus();
         // Like Photoshop, the whole name starts selected so typing replaces it.
@@ -901,7 +901,7 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 shown_set = Some(set);
                 let collapsed = app.ui.actions.collapsed_sets.iter().any(|c| c == set);
                 let (hr, hresp) = ui.allocate_exact_size(vec2(ui.available_width(), 24.0), Sense::click());
-                hresp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, !collapsed, set));
+                hresp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, !collapsed, set));
                 if hresp.hovered() {
                     ui.painter().rect_filled(hr, 0.0, t.hover.gamma_multiply(0.5));
                 }
@@ -944,7 +944,7 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             }
             let button_mode = app.ui.actions.button_mode;
             let sel = app.ui.actions.selected == Some(i) && app.ui.actions.selected_step.is_none();
-            resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, sel, name));
+            resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, sel, name));
             if button_mode {
                 ui.painter().rect_filled(rect, 3.0, button_fill(swatch, &t));
             } else if sel {
@@ -1067,7 +1067,7 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                     }
                     let label = step_label(id, params);
                     let selected = app.ui.actions.selected == Some(i) && app.ui.actions.selected_step == Some(step);
-                    response.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, selected, &label));
+                    response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected, &label));
                     if selected {
                         ui.painter().rect_filled(r, 0.0, t.row_selected);
                     } else if response.hovered() {
@@ -1082,22 +1082,22 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                     // Photoshop's check column: unchecked steps are skipped by playback, Batch and droplets.
                     let check = ui.interact(
                         Rect::from_center_size(pos2(x0 + 30.0, r.center().y), vec2(16.0, 16.0)),
-                        ui.id().with(("action-step-check", i, step)),
+                        ui.scope_id().with(("action-step-check", i, step)),
                         Sense::click(),
                     );
-                    check.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, on, format!("{}: {label}", tl!("Include in playback"))));
+                    check.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, true, on, format!("{}: {label}", tl!("Include in playback"))));
                     paint_check(ui, check.rect, on, &t);
                     // Photoshop's dialog column: playback shows the step's dialog, seeded with its
                     // recorded values, and continues when it is confirmed.
                     let with_dialog = dialogs.contains(&step);
                     let dialog = ui.interact(
                         Rect::from_center_size(pos2(x0 + 46.0, r.center().y), vec2(16.0, 16.0)),
-                        ui.id().with(("action-step-dialog", i, step)),
+                        ui.scope_id().with(("action-step-dialog", i, step)),
                         Sense::click(),
                     );
                     // A toggle button, not a check box, so the check column stays the only CheckBox role.
                     dialog.widget_info(|| {
-                        egui::WidgetInfo::selected(egui::WidgetType::Button, true, with_dialog, format!("{}: {label}", tl!("Show dialog during playback")))
+                        egui::WidgetInfo::selected(egui::Role::Button, true, with_dialog, format!("{}: {label}", tl!("Show dialog during playback")))
                     });
                     crate::icons::paint(ui, dialog.rect, "message-square", 11.0, if with_dialog { t.icon } else { t.text_faint.gamma_multiply(0.45) });
                     let dialog = dialog.on_hover_text(tl!("Show dialog during playback"));
@@ -1156,7 +1156,7 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             begin_recording(app, true);
         }
         let play = crate::icons::button(ui, "play", 24.0, false, tl!("Play selection"));
-        play.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Play selection")));
+        play.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Play selection")));
         if play.clicked() {
             play_idx = playback_selection(app);
         }
@@ -1166,14 +1166,14 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         let can_delete = app.ui.actions.selected.is_some() && (!recording_now || app.ui.actions.selected_step.is_some());
         ui.add_enabled_ui(can_delete, |ui| {
             let response = crate::icons::button(ui, "trash", 24.0, false, tl!("Delete"));
-            response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, can_delete, tl!("Delete")));
+            response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, can_delete, tl!("Delete")));
             if response.clicked() {
                 delete_selection(app);
             }
         });
         let mode_label = if app.ui.actions.button_mode { tl!("Button Mode On") } else { tl!("Button Mode") };
         let mode_button = ui.add_enabled(!recording_now, egui::Button::new(mode_label).small()).on_hover_text(tl!("Button Mode"));
-        mode_button.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, !recording_now, mode_label));
+        mode_button.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, !recording_now, mode_label));
         if mode_button.clicked() {
             app.ui.actions.button_mode = !app.ui.actions.button_mode;
         }
diff --git a/crates/ui-egui/src/adjust_dialog.rs b/crates/ui-egui/src/adjust_dialog.rs
index 1c45da190b..18e32e486a 100644
--- a/crates/ui-egui/src/adjust_dialog.rs
+++ b/crates/ui-egui/src/adjust_dialog.rs
@@ -179,7 +179,7 @@ pub(crate) fn picker_button(ui: &mut egui::Ui, selected: bool, enabled: bool, to
     let tokens = crate::theme::Tokens::get(ui.ctx());
     ui.painter().circle_filled(response.rect.right_bottom() - egui::vec2(5.5, 5.5), 3.5, color);
     ui.painter().circle_stroke(response.rect.right_bottom() - egui::vec2(5.5, 5.5), 3.5, egui::Stroke::new(1.0, tokens.field_border));
-    response.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, enabled, selected, tooltip));
+    response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, enabled, selected, tooltip));
     response
 }
 
@@ -226,7 +226,7 @@ pub fn owns(fields: &Map<String, Value>) -> bool {
 
 /// Root of the dialog editor's view state in egui memory.
 fn dialog_mem(kind: &str) -> egui::Id {
-    egui::Id::new(("adjust-dialog", kind))
+    egui::Id::unique(("adjust-dialog", kind))
 }
 
 /// Whether holding Alt turns Cancel into Reset for this adjustment dialog (every kind).
@@ -307,10 +307,14 @@ pub(crate) fn remember(app: &mut PhotocraftApp, fields: &Map<String, Value>) {
 }
 
 /// The Curves dialog's single-channel target: the Channels panel's, plus the Layers panel's mask
-/// selection — both ways of selecting a mask must give the same dropdown (#5335).
+/// selection — both ways of selecting a mask must give the same dropdown (#5335). A targeted
+/// filter mask is a gray plane too (FILE-215-3).
 fn isolated(app: &PhotocraftApp) -> Option<photocraft_engine::channel_cmds::IsolatedCurveChannel> {
-    let mask = app.layer_mask_targeted();
-    app.session.active().and_then(|st| photocraft_engine::channel_cmds::isolated_curve_channel_for(st, mask))
+    let st = app.session.active()?;
+    if app.filter_mask_targeted() {
+        return photocraft_engine::channel_cmds::filter_mask_curve_channel(st);
+    }
+    photocraft_engine::channel_cmds::isolated_curve_channel_for(st, app.layer_mask_targeted())
 }
 
 /// The colour mode the Levels/Curves dialog seeds and parses in: a mask, saved channel or
@@ -519,16 +523,26 @@ mod tests {
     /// shows Midtones, keeps Preserve Luminosity and leaves the dialog open.
     #[test]
     fn color_balance_dialog_gestures_match_photoshop() {
-        use egui_kittest::kittest::Queryable;
+        use egui_kittest::kittest::{NodeT, Queryable};
         let (mut h, id) = color_balance_dialog();
-        let label = h.query_all_by_label("Cyan  ·  Red").last().map(|n| n.rect()).expect("Cyan · Red row");
+        // The slider row's caption, not the field or slider it names.
+        let label = h
+            .query_all(egui_kittest::kittest::by().label("Cyan  ·  Red").include_labels())
+            .find(|n| n.accesskit_node().role() == egui::accesskit::Role::Label)
+            .map(|n| n.rect())
+            .expect("Cyan · Red row");
         let at = egui::pos2(label.left() + 60.0, label.bottom() + 14.0);
         let press = |pressed| egui::Event::PointerButton { pos: at, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::ALT };
         input(&mut h, egui::Modifiers::ALT, &[egui::Event::PointerMoved(at), press(true), press(false), press(true), press(false)]);
         assert_eq!(field(&h, id, "midtones"), json!([0.0, -30.0, 20.0]), "Alt+double-click zeroes the slider");
         assert_eq!(field(&h, id, "shadows"), json!([10, 0, 0]), "other tones untouched");
-        let wheel =
-            |n: f32, m| egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: egui::vec2(0.0, n), phase: egui::TouchPhase::Move, modifiers: m };
+        let wheel = |n: f32, m| egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: egui::MouseWheelUnit::Line,
+            delta: egui::vec2(0.0, n),
+            phase: egui::TouchPhase::Move,
+            modifiers: m,
+        };
         input(&mut h, egui::Modifiers::NONE, &[egui::Event::PointerMoved(at), wheel(3.0, egui::Modifiers::NONE)]);
         assert_eq!(field(&h, id, "midtones")[0], json!(3.0), "3 notches up");
         input(&mut h, egui::Modifiers::SHIFT, &[egui::Event::PointerMoved(at), wheel(2.0, egui::Modifiers::SHIFT)]);
@@ -538,7 +552,7 @@ mod tests {
         // Alt turns Cancel into Reset.
         assert!(h.query_by_label("Cancel").is_some() && h.query_by_label("Reset").is_none());
         h.state_mut().ui.dialog_mut(id).unwrap().fields.insert("highlights".into(), json!([5, 5, 5]));
-        let tone = egui::Id::new(("adjust-dialog", "colorBalance")).with("cb-tone");
+        let tone = egui::Id::unique(("adjust-dialog", "colorBalance")).with("cb-tone");
         h.ctx.data_mut(|d| d.insert_temp(tone, 2usize));
         h.event(egui::Event::ModifiersChanged(egui::Modifiers::ALT));
         h.run_steps(2);
@@ -616,13 +630,15 @@ mod tests {
                     PhotocraftApp::setup_context(&h.ctx, theme);
                     let id = open(h.state_mut(), "image.adjustments.curves").unwrap();
                     h.run_steps(4);
-                    let window = h.ctx.memory(|m| m.area_rect(egui::Id::new(("dialog", id)))).unwrap();
+                    let window = h.ctx.memory(|m| m.area_rect(egui::Id::unique(("dialog", id)))).unwrap();
                     let graph = h.ctx.data(|d| d.get_temp::<egui::Rect>(dialog_mem("curves").with("curves-graph"))).unwrap();
                     assert!(window.right() - graph.right() < 40.0, "blank right column: window {window:?}, graph {graph:?}");
                     assert!(graph.width() > 270.0, "keep the graph usable: {graph:?}");
                     assert!(window.contains_rect(graph));
                     for label in ["Channel:", "Input:", "Output:", "Preview", "OK", "Cancel"] {
-                        assert!(window.contains_rect(h.get_by_label(crate::i18n::t(label)).rect()), "{label} inside the window");
+                        // A caption and the field it names share the label; any of them is the control.
+                        let node = h.query_all_by_label(crate::i18n::t(label)).next().unwrap_or_else(|| panic!("{label} in the dialog"));
+                        assert!(window.contains_rect(node.rect()), "{label} inside the window");
                     }
                 }
             }
@@ -636,7 +652,7 @@ mod tests {
         let mut h = Harness::builder().with_size(egui::vec2(1600.0, 1100.0)).build_ui_state(|ui, app| crate::dialogs::show(app, ui.ctx()), app_with_image());
         PhotocraftApp::setup_context(&h.ctx, Default::default());
         let graph = |h: &Harness<'_, PhotocraftApp>| h.ctx.data(|d| d.get_temp::<egui::Rect>(dialog_mem("curves").with("curves-graph"))).unwrap();
-        let window = |h: &Harness<'_, PhotocraftApp>, id: u64| h.ctx.memory(|m| m.area_rect(egui::Id::new(("dialog", id)))).unwrap();
+        let window = |h: &Harness<'_, PhotocraftApp>, id: u64| h.ctx.memory(|m| m.area_rect(egui::Id::unique(("dialog", id)))).unwrap();
         let id = open(h.state_mut(), "image.adjustments.curves").unwrap();
         h.run_steps(4);
         let (opened, small) = (window(&h, id), graph(&h));
@@ -659,7 +675,9 @@ mod tests {
         assert!((big.width() - big.height()).abs() < 1.0, "still square: {big:?}");
         assert!(wide.contains_rect(big) && wide.right() - big.right() < 40.0, "no blank column: window {wide:?}, graph {big:?}");
         for label in ["Channel:", "Input:", "Output:", "Preview", "OK", "Cancel"] {
-            assert!(wide.contains_rect(h.get_by_label(crate::i18n::t(label)).rect()), "{label} inside the window");
+            for node in h.get_all_by_label(crate::i18n::t(label)) {
+                assert!(wide.contains_rect(node.rect()), "{label} label and control stay inside the window");
+            }
         }
         // Cancel, open again: the size it was left at.
         h.get_by_label("Cancel").click();
@@ -676,16 +694,16 @@ mod tests {
     fn curves_graph_never_pushes_the_dialog_off_a_short_window() {
         let mut h = Harness::builder().with_size(egui::vec2(1600.0, 700.0)).build_ui_state(|ui, app| crate::dialogs::show(app, ui.ctx()), app_with_image());
         PhotocraftApp::setup_context(&h.ctx, Default::default());
-        h.ctx.data_mut(|m| m.insert_persisted(egui::Id::new(("dialog-place", "image.adjustments.curves")).with("size"), egui::vec2(1200.0, 1200.0)));
+        h.ctx.data_mut(|m| m.insert_persisted(egui::Id::unique(("dialog-place", "image.adjustments.curves")).with("size"), egui::vec2(1200.0, 1200.0)));
         let id = open(h.state_mut(), "image.adjustments.curves").unwrap();
         h.run_steps(5);
         let graph = h.ctx.data(|d| d.get_temp::<egui::Rect>(dialog_mem("curves").with("curves-graph"))).unwrap();
-        let window = h.ctx.memory(|m| m.area_rect(egui::Id::new(("dialog", id)))).unwrap();
+        let window = h.ctx.memory(|m| m.area_rect(egui::Id::unique(("dialog", id)))).unwrap();
         assert!(graph.height() <= 700.0 - 360.0, "{graph:?}");
         assert!(window.height() <= 700.0, "{window:?}");
         assert!(window.contains_rect(h.get_by_label("OK").rect()));
         // The size the window squeezed it to is not remembered: a larger window gets 1200 again.
-        let kept = h.ctx.data_mut(|m| m.get_persisted::<egui::Vec2>(egui::Id::new(("dialog-place", "image.adjustments.curves")).with("size")));
+        let kept = h.ctx.data_mut(|m| m.get_persisted::<egui::Vec2>(egui::Id::unique(("dialog-place", "image.adjustments.curves")).with("size")));
         assert_eq!(kept, Some(egui::vec2(1200.0, 1200.0)));
         // Dragged far wider, the dialog stops where the graph stops: no blank column.
         let corner = window.max - egui::vec2(12.0, 12.0);
@@ -703,7 +721,7 @@ mod tests {
         });
         h.run_steps(5);
         let graph = h.ctx.data(|d| d.get_temp::<egui::Rect>(dialog_mem("curves").with("curves-graph"))).unwrap();
-        let window = h.ctx.memory(|m| m.area_rect(egui::Id::new(("dialog", id)))).unwrap();
+        let window = h.ctx.memory(|m| m.area_rect(egui::Id::unique(("dialog", id)))).unwrap();
         assert!(window.right() - graph.right() < 40.0, "no blank column: window {window:?}, graph {graph:?}");
     }
 
@@ -764,7 +782,7 @@ mod tests {
         fields.insert("pencil".into(), json!(true));
         fields.insert("points".into(), json!((0..256).collect::<Vec<_>>()));
         h.run_steps(4);
-        let graph = h.ctx.data(|d| d.get_temp::<egui::Rect>(egui::Id::new(("adjust-dialog", "curves")).with("curves-graph"))).unwrap();
+        let graph = h.ctx.data(|d| d.get_temp::<egui::Rect>(egui::Id::unique(("adjust-dialog", "curves")).with("curves-graph"))).unwrap();
         let at = |i: f32, o: f32| egui::pos2(graph.left() + i / 255.0 * graph.width(), graph.bottom() - o / 255.0 * graph.height());
         h.hover_at(at(64.0, 200.0));
         h.run_steps(1);
@@ -794,7 +812,7 @@ mod tests {
             let id = open(h.state_mut(), "image.adjustments.curves").unwrap();
             h.state_mut().ui.dialog_mut(id).unwrap().fields.insert("points".into(), json!([[0, 0], [128, 128], [255, 255]]));
             h.run_steps(4);
-            let graph = h.ctx.data(|d| d.get_temp::<egui::Rect>(egui::Id::new(("adjust-dialog", "curves")).with("curves-graph"))).unwrap();
+            let graph = h.ctx.data(|d| d.get_temp::<egui::Rect>(egui::Id::unique(("adjust-dialog", "curves")).with("curves-graph"))).unwrap();
             let a = egui::pos2(graph.left() + 128.0 / 255.0 * graph.width(), graph.bottom() - 128.0 / 255.0 * graph.height());
             h.hover_at(a);
             h.run_steps(1);
@@ -1210,4 +1228,28 @@ mod tests {
     fn popup_channels(h: &mut Harness<'static, PhotocraftApp>) -> Vec<String> {
         h.query_all_by_role(egui::accesskit::Role::ComboBox).filter_map(|n| n.value().map(|s| s.to_string())).collect()
     }
+
+    /// FILE-215-3: Curves on a targeted filter mask edits a gray plane, and its histogram is the
+    /// filter mask's, not the smart object's colours.
+    #[test]
+    fn curves_on_a_targeted_filter_mask_is_a_gray_plane() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.run("file.new", json!({"width": 32, "height": 32})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("edit.fill", json!({"contents": "color", "color": "#ff0000"})).unwrap();
+        app.run("layer.smartObjects.convertToSmartObject", json!({})).unwrap();
+        app.run("filter.blur.gaussianBlur", json!({"radius": 2})).unwrap();
+        let id = app.session.active().unwrap().active_layer.unwrap();
+        app.select_filter_mask_target(Some(id.0));
+        assert!(app.filter_mask_targeted());
+        let c = isolated(&app).expect("a gray target");
+        assert_eq!(c.gray, Some(photocraft_engine::channel_cmds::GraySurface::FilterMask));
+        // Its histogram counts the filter mask's levels: half black after a stroke.
+        app.run("paint.stroke", json!({"points": [[8, 0], [8, 31]], "size": 16, "hardness": 1, "color": "#000000", "target": "filterMask"})).unwrap();
+        let surface = photocraft_engine::channel_cmds::GraySurface::FilterMask;
+        let st = app.session.active().unwrap();
+        let h = tone::compute_histograms(&st.doc, HistSource::Channel { layer: id, surface }, photocraft_doc::adjust::ToneSpace::Rgb);
+        assert!(h.ch[0][0] > 0 && h.ch[0][255] > 0, "black and white levels");
+        assert_eq!(curve_mode(&app, "curves"), photocraft_doc::ColorMode::Grayscale);
+    }
 }
diff --git a/crates/ui-egui/src/adjust_editors.rs b/crates/ui-egui/src/adjust_editors.rs
index f646ddd452..43217a10f6 100644
--- a/crates/ui-egui/src/adjust_editors.rs
+++ b/crates/ui-egui/src/adjust_editors.rs
@@ -309,9 +309,9 @@ fn channel_picker_opts(ui: &mut egui::Ui, id: egui::Id, opts: &[(usize, &str)],
         let width = if opts.len() == 1 { 160.0 } else { 110.0 };
         let key = format!("{id:?}-ch");
         if translate {
-            widgets::dropdown(ui, &key, &mut ch, opts, width);
+            widgets::dropdown(ui, &key, text, &mut ch, opts, width);
         } else {
-            widgets::dropdown_literal(ui, &key, &mut ch, opts, width);
+            widgets::dropdown_literal(ui, &key, text, &mut ch, opts, width);
         }
     });
     ui.data_mut(|d| d.insert_temp(id, ch));
@@ -593,9 +593,9 @@ fn curves(ui: &mut egui::Ui, v: &mut Value, cx: &EditorCx) -> Edit {
         let i = st.gesture.selected.filter(|i| *i < pts.len() && !pencil);
         let (mut vi, mut vo) = i.map_or((0.0, 0.0), |i| (pts[i][0], pts[i][1]));
         label(ui, tl!("Input:"));
-        let ri = ui.add_enabled_ui(i.is_some(), |ui| widgets::value_field(ui, &mut vi, 0.0..=255.0, "", 52.0)).inner;
+        let ri = ui.add_enabled_ui(i.is_some(), |ui| widgets::value_field(ui, &mut vi, 0.0..=255.0, "", 52.0).accessible_name(tl!("Input:"))).inner;
         label(ui, tl!("Output:"));
-        let ro = ui.add_enabled_ui(i.is_some(), |ui| widgets::value_field(ui, &mut vo, 0.0..=255.0, "", 52.0)).inner;
+        let ro = ui.add_enabled_ui(i.is_some(), |ui| widgets::value_field(ui, &mut vo, 0.0..=255.0, "", 52.0).accessible_name(tl!("Output:"))).inner;
         if let Some(i) = i
             && (ri.changed() || ro.changed())
             && curve_edit::move_to(&mut pts, i, [vi, vo])
@@ -768,11 +768,11 @@ fn levels(ui: &mut egui::Ui, v: &mut Value, cx: &EditorCx) -> Edit {
         let fw = ((w - 16.0) / 3.0).min(70.0);
         let (mut nb, mut ng, mut nw) = (l[0], l[1], l[2]);
         let gap = ((w - 3.0 * fw) / 2.0 - 12.0).max(0.0);
-        let r0 = widgets::value_field(ui, &mut nb, 0.0..=253.0, "", fw);
+        let r0 = widgets::value_field(ui, &mut nb, 0.0..=253.0, "", fw).accessible_name(tl!("Black"));
         ui.add_space(gap);
-        let r1 = widgets::value_field(ui, &mut ng, 0.01..=9.99, "", fw);
+        let r1 = widgets::value_field(ui, &mut ng, 0.01..=9.99, "", fw).accessible_name(tl!("Gamma"));
         ui.add_space(gap);
-        let r2 = widgets::value_field(ui, &mut nw, 2.0..=255.0, "", fw);
+        let r2 = widgets::value_field(ui, &mut nw, 2.0..=255.0, "", fw).accessible_name(tl!("White"));
         if r0.changed() {
             l[0] = nb.round().min(l[2] - 2.0);
         }
@@ -822,9 +822,9 @@ fn levels(ui: &mut egui::Ui, v: &mut Value, cx: &EditorCx) -> Edit {
     ui.horizontal(|ui| {
         let fw = ((w - 16.0) / 3.0).min(70.0);
         let (mut a, mut c) = (l[3], l[4]);
-        let ra = widgets::value_field(ui, &mut a, 0.0..=255.0, "", fw);
+        let ra = widgets::value_field(ui, &mut a, 0.0..=255.0, "", fw).accessible_name(tl!("Black"));
         ui.add_space((w - 2.0 * fw - 16.0).max(0.0));
-        let rc = widgets::value_field(ui, &mut c, 0.0..=255.0, "", fw);
+        let rc = widgets::value_field(ui, &mut c, 0.0..=255.0, "", fw).accessible_name(tl!("White"));
         if ra.changed() {
             l[3] = a.round();
         }
@@ -930,7 +930,7 @@ fn hue_saturation(ui: &mut egui::Ui, v: &mut Value, cx: &EditorCx) -> Edit {
     }
     ui.horizontal(|ui| {
         let opts: Vec<(usize, &str)> = std::iter::once((0, tl!("Master"))).chain(RANGE_LABELS.iter().enumerate().map(|(i, l)| (i + 1, *l))).collect();
-        ui.add_enabled_ui(!colorize, |ui| widgets::dropdown(ui, &format!("{range_id:?}"), &mut range, &opts, 120.0));
+        ui.add_enabled_ui(!colorize, |ui| widgets::dropdown(ui, &format!("{range_id:?}"), tl!("Range"), &mut range, &opts, 120.0));
     });
     ui.data_mut(|d| d.insert_temp(range_id, range));
     let mut e = Edit::default();
@@ -1000,8 +1000,10 @@ fn hue_saturation(ui: &mut egui::Ui, v: &mut Value, cx: &EditorCx) -> Edit {
     }
     // Spectrum bars: input hues above, adjusted below; the selected range's sliders between.
     ui.add_space(6.0);
-    let w = ui.available_width().min(300.0);
+    // As wide as the sliders above, whatever the panel's width (#9242).
+    let w = ui.available_width();
     let (bars, bresp) = ui.allocate_exact_size(vec2(w, 40.0), Sense::click_and_drag());
+    ui.data_mut(|d| d.insert_temp(cx.mem.with("hs-bars"), bars));
     let top = Rect::from_min_size(bars.min, vec2(w, 10.0));
     let bottom = Rect::from_min_size(pos2(bars.left(), bars.bottom() - 10.0), vec2(w, 10.0));
     let p = ui.painter_at(bars.expand(4.0));
@@ -1189,7 +1191,7 @@ fn photo_filter(ui: &mut egui::Ui, v: &mut Value, cx: &EditorCx) -> Edit {
         if preset.is_none() {
             opts.insert(0, ("custom".into(), "Custom"));
         }
-        let changed = ui.add_enabled_ui(!use_color, |ui| widgets::dropdown(ui, &format!("{mode_id:?}-filter"), &mut sel, &opts, 170.0)).inner;
+        let changed = ui.add_enabled_ui(!use_color, |ui| widgets::dropdown(ui, &format!("{mode_id:?}-filter"), tl!("Filter:"), &mut sel, &opts, 170.0)).inner;
         if changed && let Some(f) = PHOTO_FILTERS.iter().find(|f| f.0 == sel) {
             c = f.2.map(|x| f32::from(x) / 255.0);
             v["color"] = json!(adjust_params::hex(c));
@@ -1230,7 +1232,7 @@ fn channel_mixer(ui: &mut egui::Ui, v: &mut Value, cx: &EditorCx) -> Edit {
     }
     ui.horizontal(|ui| {
         label(ui, tl!("Output Channel:"));
-        widgets::dropdown(ui, &format!("{out_id:?}"), &mut out, outs, 110.0);
+        widgets::dropdown(ui, &format!("{out_id:?}"), tl!("Output Channel:"), &mut out, outs, 110.0);
     });
     ui.data_mut(|d| d.insert_temp(out_id, out));
     let key = if mono { "gray" } else { ["red", "green", "blue"][out] };
@@ -1339,7 +1341,7 @@ fn gradient_map_strip(ui: &mut egui::Ui, stops: &mut Vec<Stop>, cx: &EditorCx, s
     let mut edit = Edit::default();
     let w = ui.available_width().min(300.0);
     let (outer, resp) = ui.allocate_exact_size(vec2(w, 44.0), Sense::click_and_drag());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), tl!("Gradient stops")));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tl!("Gradient stops")));
     let bar = Rect::from_min_max(outer.min + vec2(8.0, 2.0), pos2(outer.right() - 8.0, outer.top() + 26.0));
     let x_of = |loc: f32| bar.left() + loc * bar.width();
     let loc_of = |x: f32| ((x - bar.left()) / bar.width().max(1.0)).clamp(0.0, 1.0);
@@ -1458,6 +1460,7 @@ fn gradient_map(ui: &mut egui::Ui, v: &mut Value, cx: &EditorCx) -> Edit {
                 }
             });
         press.after(&combo.response);
+        let _ = combo.response.accessible_name(tl!("Preset:"));
         if let Some(p) = picked {
             stops = p;
             selected = 0;
@@ -1486,7 +1489,7 @@ fn gradient_map(ui: &mut egui::Ui, v: &mut Value, cx: &EditorCx) -> Edit {
         ui.horizontal(|ui| {
             label(ui, tl!("Location:"));
             let mut loc = s.0 * 100.0;
-            let rl = widgets::value_field(ui, &mut loc, 0.0..=100.0, "%", 70.0);
+            let rl = widgets::value_field(ui, &mut loc, 0.0..=100.0, "%", 70.0).accessible_name(tl!("Location:"));
             if rl.changed() {
                 location = Some(loc / 100.0);
                 changed = true;
@@ -1551,7 +1554,7 @@ pub fn swatches(app: &PhotocraftApp) -> [[f32; 3]; 2] {
 
 /// Root of an adjustment layer's Properties editor view state in egui memory.
 pub fn layer_mem(id: LayerId) -> egui::Id {
-    egui::Id::new(("adjust-layer", id.0))
+    egui::Id::unique(("adjust-layer", id.0))
 }
 
 /// Kinds whose Properties edits follow Photoshop's history and Reset (measured for Color Balance,
diff --git a/crates/ui-egui/src/adjust_editors_tests.rs b/crates/ui-egui/src/adjust_editors_tests.rs
index 7f669186bb..2bbff7d596 100644
--- a/crates/ui-egui/src/adjust_editors_tests.rs
+++ b/crates/ui-egui/src/adjust_editors_tests.rs
@@ -5,7 +5,7 @@
 
 use egui::{Pos2, Rect, vec2};
 use egui_kittest::Harness;
-use egui_kittest::kittest::Queryable;
+use egui_kittest::kittest::{NodeT, Queryable};
 use photocraft_doc::{Adjustment, LayerContent, LayerId};
 use serde_json::json;
 
@@ -88,12 +88,17 @@ fn click(h: &mut Harness<'_, PhotocraftApp>, at: Pos2) {
 }
 
 fn label_rect(h: &Harness<'_, PhotocraftApp>, text: &str) -> Option<Rect> {
-    // The last match: the Properties header repeats the kind's name above its controls.
-    h.query_all_by_label(text).last().map(|n| n.rect())
+    // The last caption: the Properties header repeats the kind's name above its controls.
+    // `get_by_label` hides a caption that names a control, so ask for the label node itself;
+    // a checkbox paints its caption as the control, so fall back to the last matching widget.
+    h.query_all(egui_kittest::kittest::by().label(text).include_labels())
+        .rfind(|n| n.accesskit_node().role() == egui::accesskit::Role::Label)
+        .map(|n| n.rect())
+        .or_else(|| h.query_all_by_label(text).last().map(|n| n.rect()))
 }
 
 fn curves_graph(h: &Harness<'_, PhotocraftApp>, id: LayerId) -> Rect {
-    h.ctx.data(|d| d.get_temp::<Rect>(egui::Id::new(("adjust-layer", id.0)).with("curves-graph"))).expect("curves graph drawn")
+    h.ctx.data(|d| d.get_temp::<Rect>(egui::Id::unique(("adjust-layer", id.0)).with("curves-graph"))).expect("curves graph drawn")
 }
 
 /// Issue #12: every adjustment kind, on a new document at 8/16/32 bits and in RGB, Grayscale,
@@ -182,6 +187,7 @@ fn color_lookup_picker_cycles_luts_with_the_mouse_wheel() {
     assert!(h.state().live_adjust.is_some(), "arrow navigation selects a preview LUT");
     for _ in 0..3 {
         h.event(egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
             unit: egui::MouseWheelUnit::Line,
             delta: vec2(0.0, -1.0),
             phase: egui::TouchPhase::Move,
@@ -327,7 +333,13 @@ fn wheel_at(h: &mut Harness<'_, PhotocraftApp>, at: Pos2, notches: f32, mods: eg
     h.event(egui::Event::ModifiersChanged(mods));
     h.hover_at(at);
     h.run_steps(1);
-    h.event(egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: vec2(0.0, notches), phase: egui::TouchPhase::Move, modifiers: mods });
+    h.event(egui::Event::MouseWheel {
+        source: egui::MouseWheelSource::Unknown,
+        unit: egui::MouseWheelUnit::Line,
+        delta: vec2(0.0, notches),
+        phase: egui::TouchPhase::Move,
+        modifiers: mods,
+    });
     h.run_steps(1);
     h.event(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
     h.run_steps(3);
@@ -580,7 +592,7 @@ fn gradient_map_stop_controls_fit_a_narrow_properties_panel_in_every_theme() {
                         return;
                     }
                     let cx = EditorCx {
-                        mem: egui::Id::new("map-layout"),
+                        mem: egui::Id::unique("map-layout"),
                         hist: None,
                         gray: false,
                         swatches: [[0.0; 3], [1.0; 3]],
@@ -789,7 +801,7 @@ fn editor_harness(kind: &'static str, params: serde_json::Value) -> Harness<'sta
     let mut h = Harness::builder().with_size(vec2(300.0, 400.0)).build_ui_state(
         move |ui, values: &mut serde_json::Value| {
             let cx = EditorCx {
-                mem: egui::Id::new("precision"),
+                mem: egui::Id::unique("precision"),
                 hist: None,
                 gray: false,
                 swatches: [[0.0; 3], [1.0; 3]],
@@ -807,6 +819,37 @@ fn editor_harness(kind: &'static str, params: serde_json::Value) -> Harness<'sta
     h
 }
 
+/// #9242: the Hue/Saturation spectrum bars stretch with the panel, like the sliders above them.
+#[test]
+fn hue_saturation_bars_fill_the_panel_width() {
+    use crate::adjust_editors::{EditorCx, editor};
+    for width in [300.0, 600.0] {
+        let mut h = Harness::builder().with_size(vec2(width, 500.0)).build_ui_state(
+            |ui, values: &mut serde_json::Value| {
+                let cx = EditorCx {
+                    mem: egui::Id::unique("hs"),
+                    hist: None,
+                    gray: false,
+                    swatches: [[0.0; 3], [1.0; 3]],
+                    gradients: Vec::new(),
+                    dialog: false,
+                    dynamic_color_sliders: true,
+                    isolated_curve: None,
+                };
+                let avail = ui.available_width();
+                editor(ui, "hueSaturation", values, &cx);
+                ui.data_mut(|d| d.insert_temp(egui::Id::unique("hs-avail"), avail));
+            },
+            json!({}),
+        );
+        PhotocraftApp::setup_context(&h.ctx, Default::default());
+        h.run_steps(4);
+        let bars = h.ctx.data(|d| d.get_temp::<Rect>(egui::Id::unique("hs").with("hs-bars"))).expect("bars drawn");
+        let avail = h.ctx.data(|d| d.get_temp::<f32>(egui::Id::unique("hs-avail"))).unwrap();
+        assert!((bars.width() - avail).abs() < 0.5, "{width}: bars {} of {avail}", bars.width());
+    }
+}
+
 /// Types `text` into the `index`th number field and commits it with Enter.
 fn type_into_field(h: &mut Harness<'static, serde_json::Value>, index: usize, text: &str) {
     h.query_all_by_role(egui::accesskit::Role::SpinButton).nth(index).unwrap().click();
diff --git a/crates/ui-egui/src/adjust_ui.rs b/crates/ui-egui/src/adjust_ui.rs
index 927197144b..ae6722e574 100644
--- a/crates/ui-egui/src/adjust_ui.rs
+++ b/crates/ui-egui/src/adjust_ui.rs
@@ -35,12 +35,12 @@ pub fn selective_color_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, id: La
         Some((l, v)) if *l == id && v.get("reds").is_some() => v.clone(),
         _ => committed,
     };
-    let key = egui::Id::new(("selc-range", id.0));
+    let key = egui::Id::unique(("selc-range", id.0));
     let mut range: usize = ui.data(|d| d.get_temp(key)).unwrap_or(0);
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(tl!("Colors")).color(t.text_dim));
         let opts: Vec<(usize, &str)> = RANGE_LABELS.iter().copied().enumerate().collect();
-        if widgets::dropdown(ui, &format!("selc-colors-{}", id.0), &mut range, &opts, 150.0) {
+        if widgets::dropdown(ui, &format!("selc-colors-{}", id.0), tl!("Color"), &mut range, &opts, 150.0) {
             ui.data_mut(|d| d.insert_temp(key, range));
         }
     });
@@ -113,7 +113,7 @@ struct FolderScan {
 fn folder_luts(app: &PhotocraftApp, ctx: &egui::Context) -> FolderLuts {
     let folder = app.session.prefs().file_handling.lut_folder.clone();
     let now = ctx.input(|input| input.time);
-    let key = egui::Id::new("color-lookup-folder");
+    let key = egui::Id::unique("color-lookup-folder");
     let mut scan = ctx.data(|data| data.get_temp::<FolderScan>(key)).unwrap_or_default();
     if let Some(done) = scan.pending.as_ref().and_then(|p| p.lock().unwrap_or_else(PoisonError::into_inner).take()) {
         scan.luts = done;
@@ -197,7 +197,7 @@ pub fn color_lookup_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, id: Layer
     let mut sel = current.clone();
     let mut params: Option<Value> = None;
     let mut browse = false;
-    let cycle_key = egui::Id::new(("color-lookup-cycle", id.0));
+    let cycle_key = egui::Id::unique(("color-lookup-cycle", id.0));
     let cycle_input = ui.input(|input| {
         input.raw.events.iter().any(|event| {
             matches!(event, egui::Event::MouseWheel { .. })
@@ -207,7 +207,7 @@ pub fn color_lookup_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, id: Layer
     let mut cycling_preview = false;
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(tl!("3D LUT File")).color(t.text_dim));
-        let (chosen, _) = widgets::dropdown_wheel_hovered(ui, &format!("clrl-{}", id.0), &mut sel, &opts, 170.0);
+        let (chosen, _) = widgets::dropdown_wheel_hovered(ui, &format!("clrl-{}", id.0), tl!("Color"), &mut sel, &opts, 170.0);
         if !chosen.is_empty() {
             if cycle_input {
                 // ponytail: wheel previews cover the built-ins only; a folder LUT would be re-read
diff --git a/crates/ui-egui/src/alt_click_tests.rs b/crates/ui-egui/src/alt_click_tests.rs
index 5e0e9d683b..2bbc1a673e 100644
--- a/crates/ui-egui/src/alt_click_tests.rs
+++ b/crates/ui-egui/src/alt_click_tests.rs
@@ -111,6 +111,87 @@ fn alt_click_with_the_brush_samples_the_foreground() {
     assert_eq!(h.state().session.tools.foreground, [0.0, 1.0, 0.0, 1.0], "⌥-click sampled green");
 }
 
+/// Alt-click sampling respects the canvas view transform without changing document pixels.
+#[test]
+fn mixer_alt_click_samples_the_tip_through_zoomed_rotated_canvas_input() {
+    for (zoom, rotation) in [(0.5, 0.0), (1.0, 0.0), (2.0, 30.0)] {
+        let mut app = two_colours();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run(
+            "tools.setBrush",
+            json!({"brush":{"size":24,"roundness":0.4,"hardness":1.0,"pressureSize":false,"mixer":{"wet":0.0,"mix":0.0,"sampleAllLayers":true}}}),
+        )
+        .unwrap();
+        let mut h = harness(app);
+        h.state_mut().ui.tool = Tool::MixerBrush;
+        h.state_mut().ui.views[0].zoom = zoom;
+        h.state_mut().ui.views[0].rotation = rotation;
+        h.run_steps(2);
+        let before = h.state().session.active().unwrap().doc.clone();
+        let steps = h.state().session.active().unwrap().history.past_len();
+        click(&mut h, 100.0, 50.0, Modifiers::ALT);
+        let state = &h.state().session.tools.mixer;
+        let load = state.spatial.as_ref().expect("Alt loads a spatial brush tip");
+        assert!(load.iter().any(|c| c[0] > 0.9 && c[1] < 0.1 && c[3] > 0.9));
+        assert!(load.iter().any(|c| c[1] > 0.9 && c[0] < 0.1 && c[3] > 0.9));
+        assert!(std::sync::Arc::ptr_eq(&before, &h.state().session.active().unwrap().doc));
+        assert_eq!(h.state().session.active().unwrap().history.past_len(), steps);
+        click(&mut h, 40.0, 50.0, Modifiers::NONE);
+        let st = h.state().session.active().unwrap();
+        let surface = st.doc.layer(st.active_layer.unwrap()).unwrap().surface().unwrap();
+        assert!(surface.rgba(34, 50)[0] > 0.9 && surface.rgba(46, 50)[1] > 0.9, "loaded halves follow document coordinates at {zoom}x/{rotation}°");
+        assert_eq!(st.history.past_len(), steps + 1);
+        assert!(crate::alt_grab::alt_click_tool(Tool::MixerBrush, Modifiers::ALT));
+        assert!(!crate::alt_grab::alt_click_tool(Tool::MixerBrush, Modifiers::ALT | Modifiers::CTRL));
+    }
+}
+
+/// Native pointer release commits the shown mixer result before restoring a spring-loaded tool.
+#[test]
+fn mixer_raw_drag_commits_live_pixels_before_a_spring_tool_returns() {
+    for spring in [false, true] {
+        let mut app = two_colours();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("tools.setColors", json!({"foreground":"#0000ff"})).unwrap();
+        app.run(
+            "tools.setBrush",
+            json!({"brush":{"size":24,"pressureSize":false,"mixer":{"wet":1.0,"mix":0.5,"sampleAllLayers":true},"smoothing":{"amount":0.0}}}),
+        )
+        .unwrap();
+        let mut h = harness(app);
+        h.state_mut().ui.tool = Tool::MixerBrush;
+        let before = h.state().session.active().unwrap().doc.clone();
+        let steps = h.state().session.active().unwrap().history.past_len();
+        let start = screen(&h, 40.0, 50.0);
+        h.event(egui::Event::PointerMoved(start));
+        h.run_steps(1);
+        button(&mut h, start, true, Modifiers::NONE);
+        if spring {
+            // A temporary Mixer Brush's key was released while its mouse drag is held.
+            h.state_mut().ui.spring =
+                Some(crate::spring_tools::Spring { previous: Tool::Zoom, tool: Tool::MixerBrush, keys: vec![], since: 0.0, used: true, released: true });
+        }
+        let end = screen(&h, 80.0, 50.0);
+        h.event(egui::Event::PointerMoved(end));
+        h.run_steps(2);
+        assert_eq!(h.state().ui.tool, Tool::MixerBrush);
+        let shown = crate::canvas::display_doc(h.state_mut(), 0).0;
+        let id = h.state().session.active().unwrap().active_layer.unwrap();
+        let paint = shown.layer(id).unwrap().surface().unwrap();
+        let mixed = paint.rgba(60, 50);
+        assert!(mixed[0] > 0.0 && mixed[2] > 0.0 && mixed[3] > 0.0, "real red/blue mixing while held: {mixed:?}");
+        assert!(std::sync::Arc::ptr_eq(&before, &h.state().session.active().unwrap().doc));
+        button(&mut h, end, false, Modifiers::NONE);
+        h.run_steps(2);
+        let st = h.state().session.active().unwrap();
+        assert_eq!(st.doc.layer(id).unwrap().surface().unwrap(), paint);
+        assert_eq!(st.history.past_len(), steps + 1);
+        assert_eq!(h.state().ui.tool, if spring { Tool::Zoom } else { Tool::MixerBrush });
+        h.state_mut().run("edit.undo", json!({})).unwrap();
+        assert_eq!(*h.state().session.active().unwrap().doc, *before);
+    }
+}
+
 #[test]
 fn alt_click_sets_the_clone_source_and_a_drag_paints_it() {
     let mut h = harness(two_colours());
diff --git a/crates/ui-egui/src/alt_grab.rs b/crates/ui-egui/src/alt_grab.rs
index fc0f3f1c8e..17dbec5cca 100644
--- a/crates/ui-egui/src/alt_grab.rs
+++ b/crates/ui-egui/src/alt_grab.rs
@@ -29,7 +29,7 @@ struct Watch {
 
 /// Tools whose ⌥-click does something: the ⌥ Eyedropper, the clone source point and Zoom Out.
 pub(crate) fn alt_click_tool(tool: Tool, mods: egui::Modifiers) -> bool {
-    crate::canvas::alt_samples(tool, mods) || (mods.alt && !mods.ctrl && matches!(tool, Tool::CloneStamp | Tool::Healing | Tool::Zoom))
+    crate::canvas::alt_samples(tool, mods) || (mods.alt && !mods.ctrl && matches!(tool, Tool::MixerBrush | Tool::CloneStamp | Tool::Healing | Tool::Zoom))
 }
 
 /// The status-bar message for an ⌥-click the desktop took.
diff --git a/crates/ui-egui/src/analysis_ui.rs b/crates/ui-egui/src/analysis_ui.rs
index d62de17348..f3c1594b7b 100644
--- a/crates/ui-egui/src/analysis_ui.rs
+++ b/crates/ui-egui/src/analysis_ui.rs
@@ -530,7 +530,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
             if !m.count_groups.is_empty() {
                 let mut gi = m.active_count_group.min(m.count_groups.len() - 1);
                 let opts: Vec<(usize, &str)> = m.count_groups.iter().enumerate().map(|(i, g)| (i, g.name.as_str())).collect();
-                if crate::widgets::dropdown(ui, "count-group", &mut gi, &opts, 140.0) {
+                if crate::widgets::dropdown(ui, "count-group", tl!("Group"), &mut gi, &opts, 140.0) {
                     let _ = app.run("count.setGroup", json!({"group": gi, "active": true}));
                 }
                 let g = &m.count_groups[gi];
@@ -563,9 +563,9 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
                 crate::widgets::vline(ui, 22.0);
                 let (mut ms, mut ls) = (g.marker_size as f32, g.label_size as f32);
                 ui.label(RichText::new(tl!("Marker Size")).color(t.text_dim).size(11.0));
-                let a = crate::widgets::value_field(ui, &mut ms, 1.0..=10.0, "", 40.0).changed();
+                let a = crate::widgets::value_field(ui, &mut ms, 1.0..=10.0, "", 40.0).accessible_name(tl!("Marker Size")).changed();
                 ui.label(RichText::new(tl!("Label Size")).color(t.text_dim).size(11.0));
-                let b = crate::widgets::value_field(ui, &mut ls, 8.0..=72.0, "", 44.0).changed();
+                let b = crate::widgets::value_field(ui, &mut ls, 8.0..=72.0, "", 44.0).accessible_name(tl!("Label Size")).changed();
                 if a || b {
                     let _ = app.run("count.setGroup", count_size_params(ms, ls));
                 }
@@ -574,8 +574,8 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
         }
         Tool::Note => {
             let t = Tokens::get(ui.ctx());
-            ui.label(RichText::new(tl!("Author:")).color(t.text_dim).size(11.0));
-            ui.add(egui::TextEdit::singleline(&mut app.ui.analysis.note_author).desired_width(120.0));
+            let author_label = ui.label(RichText::new(tl!("Author:")).color(t.text_dim).size(11.0));
+            ui.add(egui::TextEdit::singleline(&mut app.ui.analysis.note_author).desired_width(120.0)).labelled_by(author_label.id);
             ui.label(RichText::new(tl!("Color:")).color(t.text_dim).size(11.0));
             let rgb = app.ui.analysis.note_color;
             if crate::widgets::color_swatch_button(ui, color32(rgb), tl!("Color")).clicked() {
@@ -653,7 +653,7 @@ pub(crate) fn panel_window(app: &PhotocraftApp, ctx: &egui::Context, id: &str, t
     let t = Tokens::get(ctx);
     let canvas = app.last_canvas_rect;
     egui::Window::new(title)
-        .id(egui::Id::new(id))
+        .id(egui::Id::unique(id))
         .title_bar(false)
         .resizable(false)
         .movable(!app.session.prefs().workspace_locked)
@@ -789,7 +789,7 @@ fn notes_panel(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 let note = &notes[i];
                 ui.label(RichText::new(if note.author.is_empty() { tl!("No author").to_string() } else { note.author.clone() }).color(t.text_dim).size(11.0));
                 let mut text = note.text.clone();
-                if ui.add(egui::TextEdit::multiline(&mut text).desired_rows(6).desired_width(f32::INFINITY)).changed() {
+                if ui.add(egui::TextEdit::multiline(&mut text).desired_rows(6).desired_width(f32::INFINITY)).accessible_name(tl!("Notes")).changed() {
                     edit = Some(json!({"index": i, "text": text, "coalesce": format!("note-{i}")}));
                 }
             }
@@ -837,7 +837,7 @@ fn num_field(ui: &mut egui::Ui, f: &mut Map<String, Value>, key: &str, label: &s
     ui.horizontal(|ui| {
         ui.add_sized(vec2(110.0, 18.0), egui::Label::new(RichText::new(tl!(&label)).color(t.text_dim).size(11.0)));
         let mut v = f.get(key).and_then(Value::as_f64).unwrap_or(0.0) as f32;
-        if crate::widgets::value_field(ui, &mut v, range, suffix, 80.0).changed() {
+        if crate::widgets::value_field(ui, &mut v, range, suffix, 80.0).accessible_name(tl!(label)).changed() {
             f.insert(key.into(), json!(v));
         }
     });
@@ -849,7 +849,7 @@ fn choice(ui: &mut egui::Ui, f: &mut Map<String, Value>, key: &str, label: &str,
         ui.add_sized(vec2(110.0, 18.0), egui::Label::new(RichText::new(tl!(&label)).color(t.text_dim).size(11.0)));
         let mut cur = f.get(key).and_then(Value::as_str).unwrap_or(opts[0].0).to_string();
         let list: Vec<(String, &str)> = opts.iter().map(|(k, l)| (k.to_string(), *l)).collect();
-        if crate::widgets::dropdown(ui, &format!("an-{key}"), &mut cur, &list, 120.0) {
+        if crate::widgets::dropdown(ui, &format!("an-{key}"), tl!(label), &mut cur, &list, 120.0) {
             f.insert(key.into(), json!(cur));
         }
     });
@@ -887,7 +887,7 @@ fn dialog(app: &mut PhotocraftApp, ctx: &egui::Context) {
     };
     let mut result: Option<bool> = None;
     egui::Window::new(title)
-        .id(egui::Id::new("analysis-dialog"))
+        .id(egui::Id::unique("analysis-dialog"))
         .collapsible(false)
         .resizable(false)
         .anchor(Align2::CENTER_CENTER, vec2(0.0, 0.0))
@@ -904,9 +904,10 @@ fn dialog(app: &mut PhotocraftApp, ctx: &egui::Context) {
                         num_field(ui, &mut f, "pixelLength", tl!("Pixel Length:"), 0.001..=1e7, "");
                         num_field(ui, &mut f, "logicalLength", tl!("Logical Length:"), 0.0001..=1e7, "");
                         ui.horizontal(|ui| {
-                            ui.add_sized(vec2(110.0, 18.0), egui::Label::new(RichText::new(tl!("Logical Units:")).color(t.text_dim).size(11.0)));
+                            let units_label =
+                                ui.add_sized(vec2(110.0, 18.0), egui::Label::new(RichText::new(tl!("Logical Units:")).color(t.text_dim).size(11.0)));
                             let mut u = f.get("units").and_then(Value::as_str).unwrap_or("pixels").to_string();
-                            if ui.add(egui::TextEdit::singleline(&mut u).desired_width(80.0)).changed() {
+                            if ui.add(egui::TextEdit::singleline(&mut u).desired_width(80.0)).labelled_by(units_label.id).changed() {
                                 f.insert("units".into(), json!(u));
                             }
                         });
diff --git a/crates/ui-egui/src/apply_color.rs b/crates/ui-egui/src/apply_color.rs
index 9c4e3d7f7b..28d76113a4 100644
--- a/crates/ui-egui/src/apply_color.rs
+++ b/crates/ui-egui/src/apply_color.rs
@@ -9,6 +9,10 @@
 //! * any other tool (the Move tool, the brushes, the pixel selection tools…): nothing, only the
 //!   foreground.
 //!
+//! A click on a swatch is broader, as in Photoshop: whatever the tool, it recolours every selected
+//! type layer and the fill of every selected shape layer (#9238; Photoshop 2025 measured with the
+//! Move and Brush tools), while the Color panel keeps to the rules above.
+//!
 //! One pick is one history step for all the layers it recolours; a drag in the Color panel's field
 //! or sliders is one step too.
 
@@ -59,7 +63,7 @@ pub fn gesture(ctx: &Context) -> Option<String> {
 }
 
 fn focus_key() -> Id {
-    Id::new("apply-color-focus")
+    Id::unique("apply-color-focus")
 }
 
 /// Counts the changes of keyboard focus, so two values typed into one field, each after
@@ -79,14 +83,25 @@ pub fn track_focus(ctx: &Context) {
 /// Picks of one `gesture` (a Color panel drag or typed value, see [`gesture`]) share one history
 /// step; `None` (a swatch, the Color Picker, a click) is a step of its own.
 pub fn foreground_changed(app: &mut PhotocraftApp, gesture: Option<String>) {
+    recolour(app, gesture, false);
+}
+
+/// A swatch just set the foreground: recolour the selected characters while editing type, else
+/// every selected type layer and shape fill, whatever the tool (see the module docs).
+pub fn swatch_picked(app: &mut PhotocraftApp) {
+    recolour(app, None, true);
+}
+
+fn recolour(app: &mut PhotocraftApp, gesture: Option<String>, any_tool: bool) {
     // Editing type: the selected characters, in the editing session's step; nothing else.
     if app.ui.text_edit.is_some() {
         crate::type_tool::foreground_changed(app);
         return;
     }
     let tool = app.ui.tool;
-    // What the tool in hand recolours: type layers or shape layers.
+    // What the tool in hand recolours: type layers or shape layers (a swatch: both).
     let (do_texts, do_shapes) = match tool {
+        _ if any_tool => (true, true),
         t if t.is_type() && !t.is_type_mask() => (true, false),
         t if recolours_shapes(t) => (false, true),
         _ => return,
diff --git a/crates/ui-egui/src/apply_color_tests.rs b/crates/ui-egui/src/apply_color_tests.rs
index b07d731775..4a37fa6498 100644
--- a/crates/ui-egui/src/apply_color_tests.rs
+++ b/crates/ui-egui/src/apply_color_tests.rs
@@ -147,3 +147,29 @@ fn a_swatch_and_the_color_picker_go_through_it() {
     assert_eq!(app.session.tools.foreground, [0.0, 0.0, 1.0, 1.0]);
     assert!(shapes.iter().all(|id| same(&app, *id)), "the picker recoloured the shapes");
 }
+
+/// #9238: a swatch recolours the selected type layers and shape fills whatever the tool, as in
+/// Photoshop (measured with the Move and Brush tools); the Color panel with the same tools only
+/// sets the foreground (`other_tools_only_change_the_foreground`).
+#[test]
+fn a_swatch_recolours_selected_type_and_shapes_with_any_tool() {
+    for tool in [Tool::Move, Tool::Brush, Tool::RectMarquee, Tool::Type, Tool::Rectangle] {
+        let (mut app, texts, shapes) = app(tool);
+        let n = steps(&app);
+        let names = app.run("swatches.list", json!({})).unwrap();
+        let (name, hex) = names["groups"]
+            .as_array()
+            .into_iter()
+            .flatten()
+            .flat_map(|g| g["swatches"].as_array().cloned().unwrap_or_default())
+            .find(|w| w["hex"].as_str().is_some_and(|h| h != "#000000"))
+            .and_then(|w| Some((w["name"].as_str()?.to_string(), w["hex"].as_str()?.to_string())))
+            .expect("a default swatch");
+        crate::swatches_ui::use_swatch(&mut app, &name, false);
+        let f = app.session.tools.foreground;
+        let same = |c: [f32; 3]| (0..3).all(|i| (c[i] - f[i]).abs() < 2e-3);
+        assert!(texts.iter().all(|id| same(text_rgb(&app, *id))), "{tool:?}: the swatch {hex} recoloured the type layers");
+        assert!(shapes.iter().all(|id| fill_rgb(&app, *id).is_some_and(same)), "{tool:?}: and the shape fills");
+        assert_eq!(steps(&app), n + 1, "{tool:?}: one history step");
+    }
+}
diff --git a/crates/ui-egui/src/artboard_tool.rs b/crates/ui-egui/src/artboard_tool.rs
index 7f8ee838c6..81dd67bd02 100644
--- a/crates/ui-egui/src/artboard_tool.rs
+++ b/crates/ui-egui/src/artboard_tool.rs
@@ -304,14 +304,14 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
         let mut preset = preset.unwrap_or_default();
         let mut opts: Vec<(String, &str)> = vec![(String::new(), tl!("Custom"))];
         opts.extend(photocraft_engine::artboard_cmds::PRESETS.iter().map(|(n, _, _)| (n.to_string(), *n)));
-        if crate::widgets::dropdown(ui, "artboard-tool-preset", &mut preset, &opts, 150.0) && !preset.is_empty() {
+        if crate::widgets::dropdown(ui, "artboard-tool-preset", tl!("Preset"), &mut preset, &opts, 150.0) && !preset.is_empty() {
             edit = Some(json!({"layer": id.0, "preset": preset}));
         }
         let (mut w, mut h) = ((r[2] - r[0]) as f32, (r[3] - r[1]) as f32);
         ui.label(egui::RichText::new(tl!("W")).color(t.text_dim));
-        let cw = crate::widgets::value_field(ui, &mut w, 1.0..=300_000.0, "px", 64.0).changed();
+        let cw = crate::widgets::value_field(ui, &mut w, 1.0..=300_000.0, "px", 64.0).accessible_name(tl!("Width")).changed();
         ui.label(egui::RichText::new(tl!("H")).color(t.text_dim));
-        let ch = crate::widgets::value_field(ui, &mut h, 1.0..=300_000.0, "px", 64.0).changed();
+        let ch = crate::widgets::value_field(ui, &mut h, 1.0..=300_000.0, "px", 64.0).accessible_name(tl!("Height")).changed();
         if cw || ch {
             edit = Some(json!({"layer": id.0, "width": w.round(), "height": h.round(), "coalesce": format!("artboard-tool-wh-{}", id.0)}));
         }
diff --git a/crates/ui-egui/src/artboard_ui.rs b/crates/ui-egui/src/artboard_ui.rs
index 408b398303..3af0e2ac3a 100644
--- a/crates/ui-egui/src/artboard_ui.rs
+++ b/crates/ui-egui/src/artboard_ui.rs
@@ -141,27 +141,29 @@ pub fn properties(app: &mut PhotocraftApp, ui: &mut egui::Ui, layer: &Layer) {
     opts.extend(photocraft_engine::artboard_cmds::PRESETS.iter().map(|(n, _, _)| (n.to_string(), *n)));
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(tl!("Size")).color(t.text_dim).size(12.0));
-        if crate::widgets::dropdown(ui, &key("preset"), &mut preset, &opts, 150.0) && !preset.is_empty() {
+        if crate::widgets::dropdown(ui, &key("preset"), tl!("Preset"), &mut preset, &opts, 150.0) && !preset.is_empty() {
             edit = Some(json!({"layer": layer.id.0, "preset": preset}));
         }
     });
-    let num = |ui: &mut egui::Ui, label: &str, v: &mut f32, range: std::ops::RangeInclusive<f32>| -> bool {
+    // The visible label and the accessible name differ for X and Y ("X" alone does not say
+    // position), so the name comes from the call site.
+    let num = |ui: &mut egui::Ui, label: &str, name: &str, v: &mut f32, range: std::ops::RangeInclusive<f32>| -> bool {
         ui.label(egui::RichText::new(tl!(&label)).color(t.text_dim).size(12.0));
-        crate::widgets::value_field(ui, v, range, "px", 64.0).changed()
+        crate::widgets::value_field(ui, v, range, "px", 64.0).accessible_name(tl!(name)).changed()
     };
     let r = a.rect;
     ui.horizontal(|ui| {
         let (mut w, mut h) = (r.width() as f32, r.height() as f32);
-        let cw = num(ui, "W", &mut w, 1.0..=300_000.0);
-        let ch = num(ui, "H", &mut h, 1.0..=300_000.0);
+        let cw = num(ui, "W", "Width", &mut w, 1.0..=300_000.0);
+        let ch = num(ui, "H", "Height", &mut h, 1.0..=300_000.0);
         if cw || ch {
             edit = Some(json!({"layer": layer.id.0, "width": w.round(), "height": h.round(), "coalesce": key("wh")}));
         }
     });
     ui.horizontal(|ui| {
         let (mut x, mut y) = (r.x0 as f32, r.y0 as f32);
-        let cx = num(ui, "X", &mut x, -300_000.0..=300_000.0);
-        let cy = num(ui, "Y", &mut y, -300_000.0..=300_000.0);
+        let cx = num(ui, "X", "X", &mut x, -300_000.0..=300_000.0);
+        let cy = num(ui, "Y", "Y", &mut y, -300_000.0..=300_000.0);
         if cx || cy {
             edit = Some(json!({"layer": layer.id.0, "x": x.round(), "y": y.round(), "coalesce": key("xy")}));
         }
@@ -178,7 +180,7 @@ pub fn properties(app: &mut PhotocraftApp, ui: &mut egui::Ui, layer: &Layer) {
             ("transparent".to_string(), tl!("Transparent")),
             ("custom".to_string(), tl!("Other…")),
         ];
-        if crate::widgets::dropdown(ui, &key("bg"), &mut bg, &opts, 120.0) {
+        if crate::widgets::dropdown(ui, &key("bg"), tl!("Background"), &mut bg, &opts, 120.0) {
             let mut params = json!({"layer": layer.id.0, "background": bg});
             if bg == "custom" {
                 let hex = match a.background {
diff --git a/crates/ui-egui/src/background_redraw.rs b/crates/ui-egui/src/background_redraw.rs
index 31fdb649a7..53ab20f73f 100644
--- a/crates/ui-egui/src/background_redraw.rs
+++ b/crates/ui-egui/src/background_redraw.rs
@@ -63,6 +63,7 @@ pub(crate) struct Redraw {
     /// The state the blocks are drawn from, and what the texels depend on besides it.
     doc: Arc<Document>,
     display: u64,
+    text_gamma: u32,
     format: eframe::wgpu::TextureFormat,
     /// Uploaded blocks of `doc` kept for [`Kept`] (empty once over `cap`), and their bytes.
     collected: Vec<Option<Vec<u8>>>,
@@ -72,6 +73,16 @@ pub(crate) struct Redraw {
 }
 
 impl Redraw {
+    /// The text gamma changed while it runs (even if back since): its blocks may mix both, so
+    /// none of them are kept. Checked every frame for every redraw, shown or not ([`retain`]); a
+    /// change and back between two frames (one batch of agent commands) isn't seen.
+    fn forget_if_gamma_changed(&mut self, gamma: u32) {
+        if self.text_gamma != gamma {
+            self.collected = Vec::new();
+            self.collected_bytes = 0;
+        }
+    }
+
     /// Share of the document drawn, 0..=1.
     pub fn fraction(&self) -> f32 {
         if self.blocks.is_empty() { 1.0 } else { 1.0 - self.left as f32 / self.blocks.len() as f32 }
@@ -91,6 +102,7 @@ pub(crate) struct Kept {
     doc: Weak<Document>,
     id: DocId,
     display: u64,
+    text_gamma: u32,
     format: eframe::wgpu::TextureFormat,
     blocks: Vec<Rect>,
     texels: Vec<Vec<u8>>,
@@ -101,9 +113,11 @@ impl Kept {
     /// Whether these are the texels a redraw of `doc` would draw. The key is the whole document
     /// (layers and their pixels, visibility, opacity, blending, masks, adjustments and everything
     /// else it holds), so a stale composite can't come back; Arc-shared tiles compare without
-    /// reading their pixels.
-    fn matches(&self, doc: &Arc<Document>, display: u64, format: eframe::wgpu::TextureFormat, blocks: &[Rect]) -> bool {
+    /// reading their pixels. Besides the document, the display transform and the text gamma
+    /// ([`text_gamma`]) decide the texels.
+    fn matches(&self, doc: &Arc<Document>, display: u64, text_gamma: u32, format: eframe::wgpu::TextureFormat, blocks: &[Rect]) -> bool {
         self.display == display
+            && self.text_gamma == text_gamma
             && self.format == format
             && self.blocks == blocks
             && self.doc.upgrade().is_some_and(|kept| Arc::ptr_eq(&kept, doc) || *kept == **doc)
@@ -114,12 +128,14 @@ impl Kept {
 #[derive(Default)]
 pub(crate) struct KeptComposites {
     entries: VecDeque<Kept>,
+    /// The entries' documents and their revisions, and Memory Usage, when the cap was last taken.
+    capped: (Vec<(DocId, u64)>, u64),
 }
 
 impl KeptComposites {
     /// The kept redraw of exactly this state, now the newest.
-    fn find(&mut self, doc: &Arc<Document>, display: u64, format: eframe::wgpu::TextureFormat, blocks: &[Rect]) -> Option<&Kept> {
-        let i = self.entries.iter().position(|k| k.matches(doc, display, format, blocks))?;
+    fn find(&mut self, doc: &Arc<Document>, display: u64, text_gamma: u32, format: eframe::wgpu::TextureFormat, blocks: &[Rect]) -> Option<&Kept> {
+        let i = self.entries.iter().position(|k| k.matches(doc, display, text_gamma, format, blocks))?;
         let k = self.entries.remove(i)?;
         self.entries.push_front(k);
         self.entries.front()
@@ -128,7 +144,9 @@ impl KeptComposites {
     /// Keep `k`, the redraw of `doc` (in place of an entry of the same state), within `cap` bytes
     /// in all.
     fn store(&mut self, k: Kept, doc: &Arc<Document>, cap: u64) {
-        self.entries.retain(|e| !e.matches(doc, k.display, k.format, &k.blocks));
+        // Another list: [`retain`] takes the cap over all its documents again.
+        self.capped = Default::default();
+        self.entries.retain(|e| !e.matches(doc, k.display, k.text_gamma, k.format, &k.blocks));
         self.entries.push_front(k);
         self.trim(cap);
     }
@@ -151,6 +169,13 @@ impl KeptComposites {
     }
 }
 
+/// Color Settings › "Blend Text Colors Using Gamma": type layers composite with it, but it is an
+/// application setting, not part of the document. Read from the session's settings, which the
+/// engine keeps in step with the process-wide value compose reads (`psblend::set_text_gamma`).
+fn text_gamma(app: &PhotocraftApp) -> u32 {
+    app.session.color.settings.blend_text_gamma.to_bits()
+}
+
 /// Bytes kept composites of document `doc` may hold: what Memory Usage leaves beside its pixels
 /// and History. It shrinks as the document grows, which drops them under memory pressure.
 fn keep_cap(app: &PhotocraftApp, doc: DocId) -> u64 {
@@ -208,13 +233,14 @@ pub(crate) fn start(
 ) {
     let all = blocks(doc.bounds());
     let display_key = display.as_deref().map_or(0, |d| d.texture_key);
+    let gamma = text_gamma(app);
     // Taken again when a running redraw continues: the edit (or Memory Usage) may have changed it.
     let cap = keep_cap(app, doc.id);
     app.kept.trim(cap);
     let (mut pending, since, fallback, mut keep) = match app.redraws.remove(&doc.id) {
         Some(mut old) if old.blocks == all => {
             // Blocks drawn from another state aren't part of this one's composite.
-            let same = old.display == display_key && (Arc::ptr_eq(&old.doc, &doc) || *old.doc == *doc);
+            let same = old.display == display_key && old.text_gamma == gamma && (Arc::ptr_eq(&old.doc, &doc) || *old.doc == *doc);
             let (collected, bytes) =
                 if same && old.collected_bytes <= cap { (std::mem::take(&mut old.collected), old.collected_bytes) } else { (vec![None; all.len()], 0) };
             (std::mem::take(&mut old.pending), (old.started_ms, old.drawn), fallback.or_else(|| old.fallback.take()), (collected, bytes, cap))
@@ -229,7 +255,7 @@ pub(crate) fn start(
     }
     let Some(format) = gpu.prepare_texture(doc.id.0, &doc) else { return };
     // This exact state was drawn a moment ago: upload its blocks rather than composite them.
-    if let Some(k) = app.kept.find(&doc, display_key, format, &all) {
+    if let Some(k) = app.kept.find(&doc, display_key, gamma, format, &all) {
         let t0 = crate::gpu_canvas::now_ms();
         let mut px = 0u64;
         for (i, p) in pending.iter_mut().enumerate() {
@@ -246,7 +272,7 @@ pub(crate) fn start(
         }
         keep = (vec![None; all.len()], 0, keep.2);
     }
-    spawn(app, ctx, Spawn { doc, display, display_key, format, visible, blocks: all, pending, since, fallback, keep });
+    spawn(app, ctx, Spawn { doc, display, display_key, text_gamma: gamma, format, visible, blocks: all, pending, since, fallback, keep });
 }
 
 /// After an edit drew its own damage: continue document `doc.id`'s redraw, if one is running, on
@@ -261,7 +287,9 @@ pub(crate) fn restart(app: &mut PhotocraftApp, ctx: &egui::Context, gpu: &GpuCan
 /// lands, the redraw is recorded like the synchronous refresh it replaces (and explained once if
 /// it was slow).
 pub(crate) fn poll(app: &mut PhotocraftApp, gpu: &GpuCanvas, doc: DocId) {
+    let gamma = text_gamma(app);
     let Some(r) = app.redraws.get_mut(&doc) else { return };
+    r.forget_if_gamma_changed(gamma);
     loop {
         match r.rx.try_recv() {
             Ok(p) => {
@@ -288,6 +316,7 @@ pub(crate) fn poll(app: &mut PhotocraftApp, gpu: &GpuCanvas, doc: DocId) {
             doc: Arc::downgrade(&r.doc),
             id: r.doc.id,
             display: r.display,
+            text_gamma: r.text_gamma,
             format: r.format,
             blocks: r.blocks.clone(),
             texels,
@@ -335,6 +364,26 @@ pub(crate) fn retain(app: &mut PhotocraftApp) {
     let docs = app.session.documents();
     app.redraws.retain(|id, _| docs.iter().any(|st| st.doc.id == *id));
     app.kept.retain(|id| docs.iter().any(|st| st.doc.id == id));
+    let gamma = text_gamma(app);
+    for r in app.redraws.values_mut() {
+        r.forget_if_gamma_changed(gamma);
+    }
+    // Not only when the next redraw starts: states History dropped (purged or trimmed) go at once,
+    // and the cap is taken again when a kept document (its pixels and History) or Memory Usage
+    // changed.
+    app.kept.entries.retain(|k| k.doc.strong_count() > 0);
+    if app.kept.entries.is_empty() {
+        return;
+    }
+    let docs = app.session.documents();
+    let mut ids: Vec<(DocId, u64)> = app.kept.entries.iter().filter_map(|k| docs.iter().find(|st| st.doc.id == k.id).map(|st| (k.id, st.revision))).collect();
+    ids.dedup();
+    let capped = (ids, app.session.prefs().performance.history_budget_bytes() as u64);
+    if capped != app.kept.capped {
+        let cap = capped.0.iter().map(|&(id, _)| keep_cap(app, id)).min().unwrap_or(0);
+        app.kept.capped = capped;
+        app.kept.trim(cap);
+    }
 }
 
 /// What [`spawn`] starts a redraw with.
@@ -342,6 +391,7 @@ struct Spawn {
     doc: Arc<Document>,
     display: Option<Arc<CanvasDisplay>>,
     display_key: u64,
+    text_gamma: u32,
     format: eframe::wgpu::TextureFormat,
     visible: Rect,
     blocks: Vec<Rect>,
@@ -354,8 +404,19 @@ struct Spawn {
 }
 
 fn spawn(app: &mut PhotocraftApp, ctx: &egui::Context, s: Spawn) {
-    let Spawn { doc, display, display_key, format, visible, blocks, pending, since: (started_ms, drawn), fallback, keep: (collected, collected_bytes, cap) } =
-        s;
+    let Spawn {
+        doc,
+        display,
+        display_key,
+        text_gamma,
+        format,
+        visible,
+        blocks,
+        pending,
+        since: (started_ms, drawn),
+        fallback,
+        keep: (collected, collected_bytes, cap),
+    } = s;
     let id = doc.id;
     let kept_doc = doc.clone();
     let todo = order(&blocks, (0..blocks.len()).filter(|&i| pending[i]), visible);
@@ -375,10 +436,56 @@ fn spawn(app: &mut PhotocraftApp, ctx: &egui::Context, s: Spawn) {
     }
     app.redraws.insert(
         id,
-        Redraw { blocks, pending, left, drawn, rx, stop, started_ms, fallback, doc: kept_doc, display: display_key, format, collected, collected_bytes, cap },
+        Redraw {
+            blocks,
+            pending,
+            left,
+            drawn,
+            rx,
+            stop,
+            started_ms,
+            fallback,
+            doc: kept_doc,
+            display: display_key,
+            text_gamma,
+            format,
+            collected,
+            collected_bytes,
+            cap,
+        },
     );
 }
 
+/// A test can hold the worker after a batch: a real worker's speed is not reproducible, and the
+/// edit-during-a-redraw test needs the redraw to be certainly still running.
+#[cfg(test)]
+pub(crate) mod test_hold {
+    use std::sync::atomic::{AtomicBool, Ordering};
+
+    static HELD: AtomicBool = AtomicBool::new(false);
+
+    /// Holds every redraw worker after its next batch until this guard drops.
+    pub(crate) struct Hold;
+
+    pub(crate) fn hold() -> Hold {
+        HELD.store(true, Ordering::SeqCst);
+        Hold
+    }
+
+    impl Drop for Hold {
+        fn drop(&mut self) {
+            HELD.store(false, Ordering::SeqCst);
+        }
+    }
+
+    /// Called by the worker between batches while a test holds it.
+    pub(crate) fn wait() {
+        while HELD.load(Ordering::SeqCst) {
+            std::thread::sleep(std::time::Duration::from_millis(2));
+        }
+    }
+}
+
 /// The worker: composite `todo`'s blocks of `doc` in batches and hand each over, until done or
 /// stopped.
 #[allow(clippy::too_many_arguments)]
@@ -410,6 +517,8 @@ fn draw(
             }
             ctx.request_repaint();
         }
+        #[cfg(test)]
+        test_hold::wait();
     }
 }
 
diff --git a/crates/ui-egui/src/background_redraw_tests.rs b/crates/ui-egui/src/background_redraw_tests.rs
index 0d8d465d5e..08152b82e8 100644
--- a/crates/ui-egui/src/background_redraw_tests.rs
+++ b/crates/ui-egui/src/background_redraw_tests.rs
@@ -39,6 +39,7 @@ fn kept(doc: &Arc<Document>, bytes: usize) -> Kept {
         doc: Arc::downgrade(doc),
         id: doc.id,
         display: 7,
+        text_gamma: 1,
         format: eframe::wgpu::TextureFormat::Rgba8Unorm,
         bytes: (bytes * all.len()) as u64,
         blocks: all,
@@ -65,8 +66,8 @@ fn kept_composites_come_back_only_for_the_exact_state_and_stay_bounded() {
     let mut cache = KeptComposites::default();
     cache.store(kept(&a, 4), &a, u64::MAX);
     // The same state hits, also as an equal document that isn't the same Arc (a restore after a solo).
-    assert!(cache.find(&a, 7, Rgba8Unorm, &all).is_some());
-    assert!(cache.find(&Arc::new((*a).clone()), 7, Rgba8Unorm, &all).is_some());
+    assert!(cache.find(&a, 7, 1, Rgba8Unorm, &all).is_some());
+    assert!(cache.find(&Arc::new((*a).clone()), 7, 1, Rgba8Unorm, &all).is_some());
     // Any change to what the composite depends on misses.
     let hidden = changed(&|d| d.layers[0].visible = false);
     let faded = changed(&|d| d.layers[0].opacity = 0.5);
@@ -77,18 +78,23 @@ fn kept_composites_come_back_only_for_the_exact_state_and_stay_bounded() {
         }
     });
     for (what, d) in [("visibility", &hidden), ("opacity", &faded), ("blend mode", &multiplied), ("pixels", &painted)] {
-        assert!(cache.find(d, 7, Rgba8Unorm, &all).is_none(), "{what} changed");
+        assert!(cache.find(d, 7, 1, Rgba8Unorm, &all).is_none(), "{what} changed");
     }
-    assert!(cache.find(&a, 8, Rgba8Unorm, &all).is_none(), "another display transform");
-    assert!(cache.find(&a, 7, Rgba16Float, &all).is_none(), "another texture format");
-    assert!(cache.find(&a, 7, Rgba8Unorm, &all[1..]).is_none(), "other blocks");
+    assert!(cache.find(&a, 8, 1, Rgba8Unorm, &all).is_none(), "another display transform");
+    assert!(cache.find(&a, 7, 2, Rgba8Unorm, &all).is_none(), "another text gamma");
+    assert!(cache.find(&a, 7, 1, Rgba16Float, &all).is_none(), "another texture format");
+    assert!(cache.find(&a, 7, 1, Rgba8Unorm, &all[1..]).is_none(), "other blocks");
     // At most KEEP entries, the least recently used going first.
     cache.store(kept(&hidden, 4), &hidden, u64::MAX);
-    assert!(cache.find(&a, 7, Rgba8Unorm, &all).is_some());
+    assert!(cache.find(&a, 7, 1, Rgba8Unorm, &all).is_some());
     cache.store(kept(&faded, 4), &faded, u64::MAX);
     assert_eq!(cache.entries.len(), KEEP);
-    assert!(cache.find(&hidden, 7, Rgba8Unorm, &all).is_none(), "the least recently used went");
-    assert!(cache.find(&a, 7, Rgba8Unorm, &all).is_some() && cache.find(&faded, 7, Rgba8Unorm, &all).is_some());
+    assert!(cache.find(&hidden, 7, 1, Rgba8Unorm, &all).is_none(), "the least recently used went");
+    assert!(cache.find(&a, 7, 1, Rgba8Unorm, &all).is_some() && cache.find(&faded, 7, 1, Rgba8Unorm, &all).is_some());
+    // A stored entry makes the next frame take the cap again, over every kept document.
+    cache.capped = (vec![(a.id, 1)], 1);
+    cache.store(kept(&faded, 4), &faded, u64::MAX);
+    assert_eq!(cache.capped, Default::default());
     // Storing a state again replaces its entry.
     cache.store(kept(&faded, 4), &faded, u64::MAX);
     assert_eq!(cache.entries.len(), 2);
@@ -109,7 +115,7 @@ fn kept_composites_come_back_only_for_the_exact_state_and_stay_bounded() {
     cache.store(kept(&gone, 4), &gone, u64::MAX);
     let equal = Arc::new((*gone).clone());
     drop(gone);
-    assert!(cache.find(&equal, 7, Rgba8Unorm, &all).is_none(), "no strong reference to the drawn state");
+    assert!(cache.find(&equal, 7, 1, Rgba8Unorm, &all).is_none(), "no strong reference to the drawn state");
     cache.trim(u64::MAX);
     assert!(cache.entries.is_empty());
 }
@@ -204,7 +210,10 @@ fn a_full_cpu_refresh_draws_in_the_background_with_the_synchronous_pixels() {
 fn an_edit_during_a_redraw_is_not_overwritten_by_blocks_drawn_before_it() {
     let _gpu = photocraft_testkit::gpu_lock();
     let Some(mut g) = gpu_app() else { return };
-    // 4×3 blocks: the worker can't hand them all over before the next frame.
+    // Hold the worker after its first batch: how fast it composites is not reproducible (a fast
+    // machine finished all 4×3 blocks before the edit's frame on FreeBSD), and the test needs the
+    // redraw to still be running when the edit lands. The hold is released before `settle`.
+    let hold = test_hold::hold();
     let doc = cpu_only_document(g.harness.state_mut(), 4096, 3072);
     g.harness.step();
     assert!(g.harness.state().redraws.contains_key(&doc));
@@ -218,6 +227,7 @@ fn an_edit_during_a_redraw_is_not_overwritten_by_blocks_drawn_before_it() {
     g.harness.step();
     assert_eq!(g.harness.state().perf.last_refresh, "rect", "the fill's damage was drawn synchronously");
     assert!(g.harness.state().redraws.contains_key(&doc), "the redraw goes on");
+    drop(hold);
     settle(&mut g);
     assert_matches_synchronous(&mut g, doc);
 }
@@ -281,6 +291,175 @@ fn a_redraw_finishing_after_memory_usage_drops_keeps_nothing_over_it() {
     assert!(g.harness.state().kept.entries.is_empty(), "a composite was kept over the current cap");
 }
 
+/// Color Settings › "Blend Text Colors Using Gamma" isn't part of the document, but type layers
+/// composite with it: a state drawn before it changed is composited again, not uploaded from
+/// blocks drawn with the old gamma. Only the session's setting changes here, not the process-wide
+/// gamma compose reads, so tests compositing type layers at the same time aren't affected.
+#[test]
+fn a_state_drawn_before_the_text_gamma_changed_is_composited_again() {
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    let doc = cpu_only_document(g.harness.state_mut(), 2600, 1700);
+    let layer = g.harness.state().session.active().and_then(|st| st.active_layer).expect("layer");
+    settle(&mut g);
+    g.harness.state_mut().run("layer.setProps", json!({"layer": layer.0, "visible": false})).expect("hide");
+    settle(&mut g);
+    g.harness.state_mut().session.color.settings.blend_text_gamma = 1.0;
+    g.harness.state_mut().run("layer.setProps", json!({"layer": layer.0, "visible": true})).expect("show");
+    g.harness.step();
+    assert!(g.harness.state().redraws.contains_key(&doc), "served from blocks of the old gamma: {}", g.harness.state().perf.last_refresh);
+    settle(&mut g);
+    assert_eq!(g.harness.state().perf.last_refresh, "background");
+    assert_matches_synchronous(&mut g, doc);
+}
+
+/// The text gamma changing while a redraw runs: its blocks were drawn with both, so it isn't kept.
+#[test]
+fn a_redraw_across_a_text_gamma_change_is_not_kept() {
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    let doc = cpu_only_document(g.harness.state_mut(), 4096, 3072);
+    g.harness.step();
+    assert!(g.harness.state().redraws.contains_key(&doc));
+    g.harness.state_mut().session.color.settings.blend_text_gamma = 1.0;
+    settle(&mut g);
+    assert!(g.harness.state().kept.entries.is_empty(), "a composite of two gammas was kept");
+}
+
+/// Changed and changed back while a redraw runs: blocks drawn in between still mix both.
+#[test]
+fn a_redraw_across_a_text_gamma_change_and_back_is_not_kept() {
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    let doc = cpu_only_document(g.harness.state_mut(), 4096, 3072);
+    let gamma = g.harness.state().session.color.settings.blend_text_gamma;
+    g.harness.step();
+    g.harness.state_mut().session.color.settings.blend_text_gamma = 1.0;
+    g.harness.step();
+    g.harness.state_mut().session.color.settings.blend_text_gamma = gamma;
+    assert!(g.harness.state().redraws.contains_key(&doc), "the redraw finished before the change back");
+    settle(&mut g);
+    assert!(g.harness.state().kept.entries.is_empty(), "a composite of two gammas was kept");
+}
+
+/// The same while another document is shown: its redraw goes on without being polled, so the
+/// change is seen every frame, not only when it shows again.
+#[test]
+fn a_hidden_documents_redraw_across_a_text_gamma_change_and_back_is_not_kept() {
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    let doc = cpu_only_document(g.harness.state_mut(), 4096, 3072);
+    let gamma = g.harness.state().session.color.settings.blend_text_gamma;
+    g.harness.step();
+    g.harness.state_mut().run("file.new", json!({"width": 64, "height": 64})).expect("another document");
+    g.harness.step();
+    g.harness.state_mut().session.color.settings.blend_text_gamma = 1.0;
+    g.harness.step();
+    g.harness.state_mut().session.color.settings.blend_text_gamma = gamma;
+    g.harness.step();
+    assert!(g.harness.state().redraws.contains_key(&doc), "the hidden document's redraw stopped");
+    let i = g.harness.state().session.documents().iter().position(|st| st.doc.id == doc).expect("document");
+    g.harness.state_mut().session.set_active(i);
+    settle(&mut g);
+    assert!(g.harness.state().kept.entries.iter().all(|k| k.id != doc), "a composite of two gammas was kept");
+}
+
+/// Memory Usage lowered with no redraw running: the kept composites go at the next frame, not
+/// only when the next redraw starts.
+#[test]
+fn kept_composites_go_when_memory_usage_drops_between_redraws() {
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    cpu_only_document(g.harness.state_mut(), 2600, 1700);
+    settle(&mut g);
+    assert!(!g.harness.state().kept.entries.is_empty(), "the finished redraw is kept");
+    g.harness.state_mut().session.edit_prefs(|p| p.performance.memory_usage_mb = 1);
+    g.harness.step();
+    assert!(g.harness.state().redraws.is_empty());
+    assert!(g.harness.state().kept.entries.is_empty(), "kept over the current cap");
+}
+
+/// An edit too small for a background redraw that grows the document past what Memory Usage
+/// leaves: the kept composite goes at the next frame. The test holds the kept state itself, so
+/// only the cap can drop it, not History letting go of the state.
+#[test]
+fn kept_composites_go_when_a_small_edit_grows_the_document_past_the_cap() {
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    cpu_only_document(g.harness.state_mut(), 2600, 1700);
+    settle(&mut g);
+    let app = g.harness.state_mut();
+    let st = app.session.active().expect("document");
+    let held = st.doc.clone();
+    let (used, kept) = (st.memory_bytes() as u64, app.kept.bytes());
+    assert!(kept > 0, "the finished redraw is kept");
+    // Room for the kept composite and 2-3 MB more.
+    let mb = (used + kept).div_ceil(1 << 20) + 2;
+    app.session.edit_prefs(|p| p.performance.memory_usage_mb = mb as _);
+    g.harness.step();
+    assert_eq!(g.harness.state().kept.entries.len(), 1, "still within the cap");
+    // 2 MP of new pixels (8 MB): under the size that redraws in the background.
+    for (cmd, p) in
+        [("layer.new.layer", json!({})), ("select.rect", json!({"x": 0, "y": 0, "width": 2000, "height": 1000})), ("edit.fill", json!({"color": "#cc2244"}))]
+    {
+        g.harness.state_mut().run(cmd, p).expect(cmd);
+        g.harness.step();
+        assert!(g.harness.state().redraws.is_empty(), "{cmd} redrew in the background");
+    }
+    assert!(g.harness.state().kept.entries.is_empty(), "kept over the cap after the edit");
+    drop(held);
+}
+
+/// The same for an older kept composite of another document: every kept document's edits count,
+/// not only the newest one's.
+#[test]
+fn an_older_kept_composite_goes_when_its_document_grows_past_the_cap() {
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    let a = cpu_only_document(g.harness.state_mut(), 2600, 1700);
+    settle(&mut g);
+    let b = cpu_only_document(g.harness.state_mut(), 2600, 1700);
+    settle(&mut g);
+    let app = g.harness.state_mut();
+    let held: Vec<_> = app.session.documents().iter().map(|st| st.doc.clone()).collect();
+    assert_eq!(app.kept.entries.iter().map(|k| k.id).collect::<Vec<_>>(), [b, a], "both kept, the second newest");
+    let used = app.session.documents().iter().map(|st| st.memory_bytes() as u64).max().unwrap_or(0);
+    let mb = (used + app.kept.bytes()).div_ceil(1 << 20) + 2;
+    app.session.edit_prefs(|p| p.performance.memory_usage_mb = mb as _);
+    let i = app.session.documents().iter().position(|st| st.doc.id == a).expect("document");
+    app.session.set_active(i);
+    g.harness.step();
+    assert_eq!(g.harness.state().kept.entries.len(), 2, "still within the cap");
+    for (cmd, p) in
+        [("layer.new.layer", json!({})), ("select.rect", json!({"x": 0, "y": 0, "width": 2000, "height": 1000})), ("edit.fill", json!({"color": "#cc2244"}))]
+    {
+        g.harness.state_mut().run(cmd, p).expect(cmd);
+        g.harness.step();
+        assert!(g.harness.state().redraws.is_empty(), "{cmd} redrew in the background");
+    }
+    assert!(g.harness.state().kept.entries.len() < 2, "kept over the cap after the older document grew");
+    drop(held);
+}
+
+/// A kept state History no longer holds goes at the next frame: its texels aren't held until
+/// some later redraw.
+#[test]
+fn a_kept_state_history_purged_goes_at_the_next_frame() {
+    let _gpu = photocraft_testkit::gpu_lock();
+    let Some(mut g) = gpu_app() else { return };
+    cpu_only_document(g.harness.state_mut(), 2600, 1700);
+    let layer = g.harness.state().session.active().and_then(|st| st.active_layer).expect("layer");
+    settle(&mut g);
+    // Hidden, the document is drawn on the GPU: the kept state is the one before, in History.
+    g.harness.state_mut().run("layer.setProps", json!({"layer": layer.0, "visible": false})).expect("hide");
+    settle(&mut g);
+    assert_eq!(g.harness.state().kept.entries.len(), 1, "the state before hiding is kept");
+    g.harness.state_mut().run("edit.purge.histories", json!({})).expect("purge");
+    g.harness.step();
+    assert!(g.harness.state().redraws.is_empty());
+    assert!(g.harness.state().kept.entries.is_empty(), "the purged state's composite is still held");
+}
+
 #[test]
 fn closing_the_document_stops_its_redraw() {
     let _gpu = photocraft_testkit::gpu_lock();
diff --git a/crates/ui-egui/src/bitmap_dialog.rs b/crates/ui-egui/src/bitmap_dialog.rs
index 04ef5b1d79..d7ff658176 100644
--- a/crates/ui-egui/src/bitmap_dialog.rs
+++ b/crates/ui-egui/src/bitmap_dialog.rs
@@ -70,17 +70,19 @@ fn label(ui: &mut egui::Ui, text: &str) {
 
 /// A value stored in per-inch units, edited in per-inch or per-centimeter ones: `field` holds the
 /// per-inch value, `unit` the view's unit (`per_cm` when its value is per centimeter).
-fn per_unit_row(ui: &mut egui::Ui, f: &mut Map<String, Value>, field: &str, range: (f32, f32), default: f32, unit: &str, units: [(&str, &str); 2]) {
+// The explicit accessible name accompanies the existing numeric-field parameters.
+#[expect(clippy::too_many_arguments)]
+fn per_unit_row(ui: &mut egui::Ui, f: &mut Map<String, Value>, field: &str, name: &str, range: (f32, f32), default: f32, unit: &str, units: [(&str, &str); 2]) {
     let per_inch = num(f, field, default);
     let mut cur = text(f, unit, units[0].0);
     let per_cm = cur == units[1].0;
     let k = if per_cm { CM } else { 1.0 };
     let mut shown = per_inch / k;
-    if crate::widgets::value_field(ui, &mut shown, range.0 / k..=range.1 / k, "", 70.0).changed() {
+    if crate::widgets::value_field(ui, &mut shown, range.0 / k..=range.1 / k, "", 70.0).accessible_name(name).changed() {
         f.insert(field.into(), json!(((shown * k).clamp(range.0, range.1) * 1000.0).round() / 1000.0));
     }
     let opts: Vec<(String, &str)> = units.iter().map(|(id, l)| (id.to_string(), *l)).collect();
-    if crate::widgets::dropdown(ui, &format!("bitmap-{unit}"), &mut cur, &opts, 150.0) {
+    if crate::widgets::dropdown(ui, &format!("bitmap-{unit}"), tl!("Units"), &mut cur, &opts, 150.0) {
         f.insert(unit.into(), json!(cur));
     }
 }
@@ -102,7 +104,7 @@ pub(crate) fn body(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, V
     ui.horizontal(|ui| {
         label(ui, tl!("Output:"));
         let input = num(f, "__inputResolution", 72.0);
-        per_unit_row(ui, f, "resolution", RESOLUTION, input, "__resUnit", res_units);
+        per_unit_row(ui, f, "resolution", tl!("Resolution"), RESOLUTION, input, "__resUnit", res_units);
     });
 
     ui.add_space(4.0);
@@ -112,7 +114,7 @@ pub(crate) fn body(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, V
     ui.horizontal(|ui| {
         label(ui, tl!("Use:"));
         let opts: Vec<(String, &str)> = METHODS.iter().map(|(id, l)| (id.to_string(), tl!(l))).collect();
-        if crate::widgets::dropdown(ui, "bitmap-method", &mut method, &opts, 190.0) {
+        if crate::widgets::dropdown(ui, "bitmap-method", tl!("Method"), &mut method, &opts, 190.0) {
             f.insert("method".into(), json!(method));
         }
     });
@@ -135,12 +137,12 @@ pub(crate) fn body(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, V
         crate::widgets::hairline(ui);
         ui.horizontal(|ui| {
             label(ui, tl!("Frequency:"));
-            per_unit_row(ui, f, "frequency", FREQUENCY, 53.0, "__freqUnit", [("lpi", tl!("Lines/Inch")), ("lpcm", tl!("Lines/Centimeter"))]);
+            per_unit_row(ui, f, "frequency", tl!("Frequency"), FREQUENCY, 53.0, "__freqUnit", [("lpi", tl!("Lines/Inch")), ("lpcm", tl!("Lines/Centimeter"))]);
         });
         ui.horizontal(|ui| {
             label(ui, tl!("Angle:"));
             let mut angle = num(f, "angle", 45.0);
-            if crate::widgets::value_field(ui, &mut angle, -180.0..=180.0, "°", 70.0).changed() {
+            if crate::widgets::value_field(ui, &mut angle, -180.0..=180.0, "°", 70.0).accessible_name(tl!("Angle:")).changed() {
                 f.insert("angle".into(), json!((angle.clamp(-180.0, 180.0) * 10.0).round() / 10.0));
             }
         });
@@ -148,7 +150,7 @@ pub(crate) fn body(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, V
             label(ui, tl!("Shape:"));
             let mut shape = text(f, "shape", "round");
             let opts: Vec<(String, &str)> = SHAPES.iter().map(|(id, l)| (id.to_string(), tl!(l))).collect();
-            if crate::widgets::dropdown(ui, "bitmap-shape", &mut shape, &opts, 150.0) {
+            if crate::widgets::dropdown(ui, "bitmap-shape", tl!("Shape"), &mut shape, &opts, 150.0) {
                 f.insert("shape".into(), json!(shape));
             }
         });
diff --git a/crates/ui-egui/src/blend_dropdown_wheel_tests.rs b/crates/ui-egui/src/blend_dropdown_wheel_tests.rs
index c6b9186f86..f3f69cdd45 100644
--- a/crates/ui-egui/src/blend_dropdown_wheel_tests.rs
+++ b/crates/ui-egui/src/blend_dropdown_wheel_tests.rs
@@ -48,6 +48,7 @@ fn wheel(h: &mut Harness<'_, PhotocraftApp>, at: Pos2, lines: f32) {
     h.hover_at(at);
     h.run_steps(1);
     h.event(egui::Event::MouseWheel {
+        source: egui::MouseWheelSource::Unknown,
         unit: egui::MouseWheelUnit::Line,
         delta: vec2(0.0, lines),
         phase: egui::TouchPhase::Move,
diff --git a/crates/ui-egui/src/blend_keys.rs b/crates/ui-egui/src/blend_keys.rs
index d68bc79a11..f954cbd3c4 100644
--- a/crates/ui-egui/src/blend_keys.rs
+++ b/crates/ui-egui/src/blend_keys.rs
@@ -1,8 +1,10 @@
-//! ⇧+ and ⇧− step through the blend modes, as in Photoshop (#3102): the Brush's or Pencil's mode
-//! while one of them is active, the Gradient's with the Gradient tool, and otherwise (Move, the
-//! selection tools…) the active layer's. The list wraps at either end. Each press is one call of
-//! an engine command (`tools.setBrush`, `layer.setProps`), so it records and undoes like a pick
-//! from the dropdown.
+//! Blend mode keys, as in Photoshop. ⇧+ and ⇧− step through the modes (#3102), and ⇧⌥ plus a
+//! letter picks one (⇧⌥M Multiply, ⇧⌥S Screen…). With a painting tool that has a Mode of its own
+//! (`tool_modes`: Brush, Pencil, Paint Bucket, Gradient, the stamps, History Brush, Healing) they
+//! set that tool's mode within its menu and never the layer's. With a tool that has no blend mode
+//! (Move, the selection tools, the Erasers…) they set every selected layer's mode.
+//! The step list wraps at either end. Each press is one call of an engine command
+//! (`tools.setBrush`, `layer.setProps` with every target layer), so it is one undo step.
 
 use egui::{Event, Key};
 use photocraft_color::BlendMode;
@@ -13,7 +15,7 @@ use crate::state::Tool;
 
 /// The mode `step` places after (or before, when negative) `current` in `modes`, wrapping around.
 /// A mode that isn't listed steps from the top of the list.
-pub fn stepped(modes: &[BlendMode], current: BlendMode, step: i32) -> Option<BlendMode> {
+pub fn stepped<T: Copy + PartialEq>(modes: &[T], current: T, step: i32) -> Option<T> {
     let n = i32::try_from(modes.len()).ok().filter(|n| *n > 0)?;
     let at = modes.iter().position(|m| *m == current).and_then(|i| i32::try_from(i).ok());
     let next = match at {
@@ -24,52 +26,225 @@ pub fn stepped(modes: &[BlendMode], current: BlendMode, step: i32) -> Option<Ble
     modes.get(usize::try_from(next).ok()?).copied()
 }
 
+/// What a blend mode key asks for.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub enum Pick {
+    Mode(BlendMode),
+    /// Painting tools only: paint transparency.
+    Clear,
+    /// Painting tools only: paint behind the layer's pixels. Not implemented yet, so ⇧⌥Q is taken
+    /// (it must not reach another binding) and does nothing.
+    Behind,
+}
+
+/// Photoshop's ⇧⌥ letter for each mode. Darker Color, Lighter Color, Subtract and Divide have none.
+pub fn letter_pick(key: Key) -> Option<Pick> {
+    use BlendMode as B;
+    Some(Pick::Mode(match key {
+        Key::N => B::Normal,
+        Key::I => B::Dissolve,
+        Key::Q => return Some(Pick::Behind),
+        Key::R => return Some(Pick::Clear),
+        Key::P => B::PassThrough,
+        Key::K => B::Darken,
+        Key::M => B::Multiply,
+        Key::B => B::ColorBurn,
+        Key::A => B::LinearBurn,
+        Key::G => B::Lighten,
+        Key::S => B::Screen,
+        Key::D => B::ColorDodge,
+        Key::W => B::LinearDodge,
+        Key::O => B::Overlay,
+        Key::F => B::SoftLight,
+        Key::H => B::HardLight,
+        Key::V => B::VividLight,
+        Key::J => B::LinearLight,
+        Key::Z => B::PinLight,
+        Key::L => B::HardMix,
+        Key::E => B::Difference,
+        Key::X => B::Exclusion,
+        Key::U => B::Hue,
+        Key::T => B::Saturation,
+        Key::C => B::Color,
+        Key::Y => B::Luminosity,
+        _ => return None,
+    }))
+}
+
+/// One key's request: a step through the list, or a mode picked by letter.
+enum Press {
+    Step(i32),
+    Pick(Pick),
+}
+
 /// Consumes this frame's ⇧+ / ⇧− presses (⇧= on a US layout is `+`; on a German one
-/// `layout_keys::apply` has already turned ⇧+ and ⇧- into `+` and `-`) and applies them.
+/// `layout_keys::apply` has already turned ⇧+ and ⇧- into `+` and `-`) and ⇧⌥ letters, and
+/// applies them. Runs before the tool letters, which would otherwise take ⇧⌥M as M.
 pub fn handle(app: &mut PhotocraftApp, ctx: &egui::Context) {
-    let steps: Vec<i32> = ctx.input_mut(|i| {
+    let presses: Vec<Press> = ctx.input_mut(|i| {
         let mut out = Vec::new();
         i.events.retain(|e| match e {
-            Event::Key { key, pressed: true, modifiers, .. } if modifiers.shift && !modifiers.command && !modifiers.ctrl && !modifiers.alt => {
-                let step = match key {
-                    Key::Plus | Key::Equals => 1,
-                    Key::Minus => -1,
-                    _ => return true,
-                };
-                out.push(step);
+            Event::Key { key, physical_key, pressed: true, modifiers, .. } if modifiers.shift && !modifiers.command && !modifiers.ctrl => {
+                if modifiers.alt {
+                    // The layout's letter (⇧⌥Z on a German keyboard is Pin Light), else the
+                    // physical one: on a Mac ⌥ turns the letter into another character (⇧⌥M
+                    // types Â) that may arrive as some other key.
+                    match letter_pick(*key).or_else(|| physical_key.and_then(letter_pick)) {
+                        Some(p) => out.push(Press::Pick(p)),
+                        None => return true,
+                    }
+                } else {
+                    match key {
+                        Key::Plus | Key::Equals => out.push(Press::Step(1)),
+                        Key::Minus => out.push(Press::Step(-1)),
+                        _ => return true,
+                    }
+                }
                 false
             }
             _ => true,
         });
         out
     });
-    for step in steps {
-        press(app, step);
+    for p in presses {
+        match p {
+            Press::Step(step) => press(app, step),
+            Press::Pick(pick) => pick_mode(app, pick),
+        }
     }
 }
 
-/// One ⇧+ (`step` 1) or ⇧− (`step` -1) press.
-pub fn press(app: &mut PhotocraftApp, step: i32) {
+/// Photoshop's Healing Brush modes, less Replace (not implemented yet).
+pub const HEALING_MODES: [BlendMode; 7] =
+    [BlendMode::Normal, BlendMode::Multiply, BlendMode::Screen, BlendMode::Darken, BlendMode::Lighten, BlendMode::Color, BlendMode::Luminosity];
+
+/// The mode a brush-based tool paints with: its brush's, or Normal for a Healing Brush whose brush
+/// holds a mode its short menu lacks (the Brush's Overlay remembered from before it had a menu, a
+/// preset with tool settings, `tools.setBrush`). The stroke, the dropdown and the keys share it.
+pub fn brush_tool_mode(tool: Tool, mode: BlendMode) -> BlendMode {
+    if tool == Tool::Healing && !HEALING_MODES.contains(&mode) { BlendMode::Normal } else { mode }
+}
+
+/// A painting tool's options-bar Mode menu in order, `None` being Clear (after Dissolve, on the
+/// tools Photoshop offers it on). `None` for a tool without a blend mode control.
+pub fn tool_modes(tool: Tool) -> Option<Vec<Option<BlendMode>>> {
+    let layer = || BlendMode::LAYER_MODES.iter().copied().map(Some).collect::<Vec<_>>();
+    Some(match tool {
+        Tool::Brush | Tool::Pencil | Tool::PaintBucket => {
+            let mut modes = layer();
+            let at = modes.iter().position(|m| *m == Some(BlendMode::Dissolve)).map_or(modes.len(), |i| i + 1);
+            modes.insert(at, None);
+            modes
+        }
+        Tool::Gradient | Tool::CloneStamp | Tool::PatternStamp | Tool::HistoryBrush => layer(),
+        Tool::Healing => HEALING_MODES.iter().copied().map(Some).collect(),
+        _ => return None,
+    })
+}
+
+/// Where the active tool's blend mode keys go.
+enum Target {
+    /// The tool's own Mode, one of these.
+    Tool(Vec<Option<BlendMode>>),
+    /// A painting tool with a blend mode in Photoshop but no Mode control here yet: the keys do
+    /// nothing, and never reach the layer.
+    Nothing,
+    Layers,
+}
+
+fn target(tool: Tool) -> Target {
+    if let Some(modes) = tool_modes(tool) {
+        return Target::Tool(modes);
+    }
+    match tool {
+        Tool::SpotHealing | Tool::ColorReplacement | Tool::Blur | Tool::Sharpen | Tool::Smudge | Tool::ArtHistoryBrush => Target::Nothing,
+        // Photoshop's ⇧⌥S/M/H pick the Dodge and Burn Range and ⇧⌥D/S the Sponge's mode: never
+        // the layer's.
+        Tool::Dodge | Tool::Burn | Tool::Sponge => Target::Nothing,
+        // No blend mode of their own (the Erasers, the Mixer Brush…): the layer's, as in Photoshop.
+        _ => Target::Layers,
+    }
+}
+
+/// The active tool's mode, `None` being Clear. A brush-based tool's lives in its own brush.
+pub fn tool_mode(app: &mut PhotocraftApp) -> Option<BlendMode> {
+    let o = &app.ui.tool_options;
     match app.ui.tool {
-        Tool::Brush | Tool::Pencil => {
-            let current = app.session.tools.brush.mode;
-            if let Some(mode) = stepped(&BlendMode::LAYER_MODES, current, step)
-                && let Ok(mode) = serde_json::to_value(mode)
-            {
-                let _ = app.run("tools.setBrush", json!({ "brush": { "mode": mode } }));
-            }
-        }
-        Tool::Gradient => {
-            let before = app.ui.tool_options.clone();
-            if let Some(mode) = stepped(&BlendMode::LAYER_MODES, before.gradient_blend_mode, step) {
-                app.ui.tool_options.gradient_blend_mode = mode;
-                // Live mode: a selected gradient fill layer follows, as with the dropdown.
-                crate::gradient_ui::options_changed(app, &before);
-            }
-        }
-        // Their blend mode isn't the brush's (the Eraser has none): leave them alone.
-        t if t.is_brushlike() || t == Tool::MagicEraser || t == Tool::PaintBucket => {}
+        Tool::Brush if o.brush_clear => None,
+        Tool::Pencil if o.pencil_clear => None,
+        Tool::PaintBucket if o.bucket_clear => None,
+        Tool::PaintBucket => Some(o.bucket_blend_mode),
+        Tool::Gradient => Some(o.gradient_blend_mode),
         _ => {
+            crate::paint_mouse::sync_tool_brush(app);
+            Some(brush_tool_mode(app.ui.tool, app.session.tools.brush.mode))
+        }
+    }
+}
+
+/// Sets the active tool's mode; `None` is Clear.
+fn set_tool_mode(app: &mut PhotocraftApp, mode: Option<BlendMode>) {
+    match app.ui.tool {
+        Tool::Gradient => {
+            if let Some(m) = mode {
+                set_gradient_mode(app, m);
+            }
+            return;
+        }
+        Tool::PaintBucket => {
+            app.ui.tool_options.bucket_clear = mode.is_none();
+            if let Some(m) = mode {
+                app.ui.tool_options.bucket_blend_mode = m;
+            }
+            return;
+        }
+        Tool::Brush => app.ui.tool_options.brush_clear = mode.is_none(),
+        Tool::Pencil => app.ui.tool_options.pencil_clear = mode.is_none(),
+        _ => {}
+    }
+    crate::paint_mouse::sync_tool_brush(app);
+    if let Some(m) = mode
+        && let Ok(m) = serde_json::to_value(m)
+    {
+        let _ = app.run("tools.setBrush", json!({ "brush": { "mode": m } }));
+    }
+}
+
+fn set_gradient_mode(app: &mut PhotocraftApp, mode: BlendMode) {
+    let before = app.ui.tool_options.clone();
+    app.ui.tool_options.gradient_blend_mode = mode;
+    // Live mode: a selected gradient fill layer follows, as with the dropdown.
+    crate::gradient_ui::options_changed(app, &before);
+}
+
+/// Sets `mode` on every selected layer that can take it, in one undo step: the locked Background
+/// has no blend mode, and only groups pass through.
+fn set_layers_mode(app: &mut PhotocraftApp, mode: BlendMode) {
+    let Some(st) = app.session.active() else { return };
+    let ids: Vec<u64> = st
+        .selected_layers()
+        .into_iter()
+        .filter_map(|id| st.doc.layer(id))
+        .filter(|l| !crate::doc_props_ui::is_background(&st.doc, l) && (mode != BlendMode::PassThrough || l.is_group()) && l.blend != mode)
+        .map(|l| l.id.0)
+        .collect();
+    if !ids.is_empty() {
+        let _ = app.run("layer.setProps", json!({ "layers": ids, "blend": mode.label() }));
+    }
+}
+
+/// One ⇧+ (`step` 1) or ⇧− (`step` -1) press. Selected layers all take the mode after the active
+/// layer's.
+pub fn press(app: &mut PhotocraftApp, step: i32) {
+    match target(app.ui.tool) {
+        Target::Tool(modes) => {
+            let current = tool_mode(app);
+            if let Some(mode) = stepped(&modes, current, step) {
+                set_tool_mode(app, mode);
+            }
+        }
+        Target::Nothing => {}
+        Target::Layers => {
             let Some(st) = app.session.active() else { return };
             let Some(layer) = st.active_layer.and_then(|id| st.doc.layer(id)) else { return };
             // The locked Background has no blend mode.
@@ -78,13 +253,31 @@ pub fn press(app: &mut PhotocraftApp, step: i32) {
             }
             let modes: Vec<BlendMode> = std::iter::once(BlendMode::PassThrough).filter(|_| layer.is_group()).chain(BlendMode::LAYER_MODES).collect();
             if let Some(mode) = stepped(&modes, layer.blend, step) {
-                let id = layer.id.0;
-                let _ = app.run("layer.setProps", json!({ "layer": id, "blend": mode.label() }));
+                set_layers_mode(app, mode);
             }
         }
     }
 }
 
+/// One ⇧⌥ letter press. A mode the target's menu doesn't have (Clear or Behind for layers, Pass
+/// Through for a painting tool, Overlay for the Healing Brush) does nothing.
+pub fn pick_mode(app: &mut PhotocraftApp, pick: Pick) {
+    let want = match pick {
+        Pick::Mode(m) => Some(m),
+        Pick::Clear => None,
+        Pick::Behind => return,
+    };
+    match target(app.ui.tool) {
+        Target::Tool(modes) if modes.contains(&want) => set_tool_mode(app, want),
+        Target::Layers => {
+            if let Some(m) = want {
+                set_layers_mode(app, m);
+            }
+        }
+        _ => {}
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -180,4 +373,343 @@ mod tests {
         let mut none = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
         press(&mut none, 1);
     }
+
+    /// Feeds one ⇧⌥ press of `key`, reported by the platform as `physical` too.
+    fn alt_shift(app: &mut PhotocraftApp, ctx: &egui::Context, key: Key, physical: Key) {
+        let m = egui::Modifiers::SHIFT | egui::Modifiers::ALT;
+        let raw = egui::RawInput {
+            events: vec![egui::Event::ModifiersChanged(m), egui::Event::Key { key, physical_key: Some(physical), pressed: true, repeat: false, modifiers: m }],
+            ..Default::default()
+        };
+        ctx.begin_pass(raw);
+        crate::shortcuts::handle(app, ctx);
+        ctx.end_pass().textures_delta.clear();
+    }
+
+    fn blend_of(app: &PhotocraftApp, i: usize) -> BlendMode {
+        app.session.active().unwrap().doc.layers[i].blend
+    }
+
+    /// Photoshop's letters: 26 keys, each a different mode, and the four modes without one.
+    #[test]
+    fn every_letter_picks_its_own_mode() {
+        let keys: Vec<Key> = "NIQRPKMBAGSDWOFHVJZLEXUTCY".chars().filter_map(|c| Key::from_name(&c.to_string())).collect();
+        assert_eq!(keys.len(), 26);
+        let picks: Vec<Pick> = keys.iter().filter_map(|k| letter_pick(*k)).collect();
+        assert_eq!(picks.len(), keys.len());
+        for (i, p) in picks.iter().enumerate() {
+            assert!(!picks[..i].contains(p), "{p:?} has two letters");
+        }
+        assert_eq!(letter_pick(Key::M), Some(Pick::Mode(BlendMode::Multiply)));
+        assert_eq!(letter_pick(Key::W), Some(Pick::Mode(BlendMode::LinearDodge)));
+        assert_eq!(letter_pick(Key::Y), Some(Pick::Mode(BlendMode::Luminosity)));
+        for m in [BlendMode::DarkerColor, BlendMode::LighterColor, BlendMode::Subtract, BlendMode::Divide] {
+            assert!(!picks.contains(&Pick::Mode(m)), "{m:?} has no letter in Photoshop");
+        }
+        for k in [Key::Num1, Key::Space] {
+            assert_eq!(letter_pick(k), None);
+        }
+    }
+
+    /// With the Move tool ⇧⌥M makes the active layer Multiply in one undo step, and doesn't switch
+    /// to the Marquee tool's M. Clear and Behind are painting modes: a layer ignores them.
+    #[test]
+    fn alt_shift_letter_sets_the_layer_mode_and_keeps_the_tool() {
+        let ctx = egui::Context::default();
+        let mut a = app(Tool::Move);
+        let undo = a.session.active().unwrap().history.past_len();
+        alt_shift(&mut a, &ctx, Key::M, Key::M);
+        assert_eq!(layer_blend(&a), BlendMode::Multiply);
+        assert_eq!(a.ui.tool, Tool::Move, "not the Marquee tool");
+        assert_eq!(a.session.active().unwrap().history.past_len(), undo + 1);
+        alt_shift(&mut a, &ctx, Key::R, Key::R);
+        alt_shift(&mut a, &ctx, Key::Q, Key::Q);
+        alt_shift(&mut a, &ctx, Key::P, Key::P);
+        assert_eq!(layer_blend(&a), BlendMode::Multiply, "no Clear, Behind or Pass Through on a layer");
+        assert_eq!(a.ui.tool, Tool::Move);
+        // ⇧⌥ letters that are tool keys pick modes too.
+        alt_shift(&mut a, &ctx, Key::S, Key::S);
+        assert_eq!(layer_blend(&a), BlendMode::Screen);
+        assert_eq!(a.ui.tool, Tool::Move);
+    }
+
+    /// A Mac's ⌥ turns the letter into another character; egui then reports the physical key.
+    /// A German layout's Z (physical Y) is still Pin Light: the typed letter wins.
+    #[test]
+    fn the_typed_letter_wins_and_the_physical_key_is_the_fallback() {
+        let ctx = egui::Context::default();
+        let mut a = app(Tool::Move);
+        alt_shift(&mut a, &ctx, Key::Backtick, Key::O);
+        assert_eq!(layer_blend(&a), BlendMode::Overlay);
+        alt_shift(&mut a, &ctx, Key::Z, Key::Y);
+        assert_eq!(layer_blend(&a), BlendMode::PinLight);
+    }
+
+    /// Every selected layer takes the mode, all in one undo step; the Background keeps Normal.
+    /// ⇧+ steps them all to the mode after the active layer's.
+    #[test]
+    fn mode_keys_set_every_selected_layer_in_one_undo_step() {
+        let ctx = egui::Context::default();
+        let mut a = app(Tool::Move);
+        let ids: Vec<u64> = a.session.active().unwrap().doc.layers.iter().map(|l| l.id.0).collect();
+        a.run("layer.new.layer", json!({})).unwrap();
+        for id in &ids {
+            a.run("layer.select", json!({"layer": id, "mode": "add"})).unwrap();
+        }
+        assert_eq!(a.session.active().unwrap().selected_layers().len(), 3);
+        let undo = a.session.active().unwrap().history.past_len();
+        alt_shift(&mut a, &ctx, Key::S, Key::S);
+        assert_eq!([blend_of(&a, 0), blend_of(&a, 1), blend_of(&a, 2)], [BlendMode::Normal, BlendMode::Screen, BlendMode::Screen]);
+        assert_eq!(a.session.active().unwrap().history.past_len(), undo + 1, "one undo step for both layers");
+        key(&mut a, &ctx, Key::Plus, egui::Modifiers::SHIFT);
+        assert_eq!([blend_of(&a, 1), blend_of(&a, 2)], [BlendMode::ColorDodge, BlendMode::ColorDodge]);
+        assert_eq!(a.session.active().unwrap().history.past_len(), undo + 2);
+        a.session.undo();
+        assert_eq!([blend_of(&a, 1), blend_of(&a, 2)], [BlendMode::Screen, BlendMode::Screen]);
+    }
+
+    /// ⇧⌥P is Pass Through, for groups only.
+    #[test]
+    fn pass_through_is_for_groups() {
+        let ctx = egui::Context::default();
+        let mut a = app(Tool::Move);
+        a.run("layer.new.group", json!({})).unwrap();
+        alt_shift(&mut a, &ctx, Key::N, Key::N);
+        assert_eq!(layer_blend(&a), BlendMode::Normal);
+        alt_shift(&mut a, &ctx, Key::P, Key::P);
+        assert_eq!(layer_blend(&a), BlendMode::PassThrough);
+    }
+
+    /// With the Brush the letters set the brush's mode, Clear included, and never the layer's;
+    /// ⇧+ from Dissolve reaches Clear, as in the dropdown. The Pencil keeps its own Clear.
+    #[test]
+    fn with_a_painting_tool_the_letters_set_only_its_mode() {
+        let ctx = egui::Context::default();
+        let mut a = app(Tool::Brush);
+        alt_shift(&mut a, &ctx, Key::M, Key::M);
+        assert_eq!(a.session.tools.brush.mode, BlendMode::Multiply);
+        assert_eq!(layer_blend(&a), BlendMode::Normal, "the layer is untouched");
+        assert_eq!(a.ui.tool, Tool::Brush);
+        alt_shift(&mut a, &ctx, Key::R, Key::R);
+        assert!(a.ui.tool_options.brush_clear);
+        alt_shift(&mut a, &ctx, Key::P, Key::P);
+        assert!(a.ui.tool_options.brush_clear, "no Pass Through for a brush");
+        alt_shift(&mut a, &ctx, Key::I, Key::I);
+        assert!(!a.ui.tool_options.brush_clear);
+        assert_eq!(a.session.tools.brush.mode, BlendMode::Dissolve);
+        key(&mut a, &ctx, Key::Plus, egui::Modifiers::SHIFT);
+        assert!(a.ui.tool_options.brush_clear, "Clear follows Dissolve");
+        key(&mut a, &ctx, Key::Plus, egui::Modifiers::SHIFT);
+        assert!(!a.ui.tool_options.brush_clear);
+        assert_eq!(a.session.tools.brush.mode, BlendMode::Darken);
+        assert!(!a.ui.tool_options.pencil_clear);
+        a.ui.tool = Tool::Pencil;
+        alt_shift(&mut a, &ctx, Key::R, Key::R);
+        assert!(a.ui.tool_options.pencil_clear);
+        assert_eq!(layer_blend(&a), BlendMode::Normal);
+    }
+
+    /// The Gradient takes the letters; Smudge, which has a blend mode in Photoshop but no Mode
+    /// control here yet, ignores them rather than changing the layer.
+    #[test]
+    fn gradient_takes_the_letters_and_smudge_ignores_them() {
+        let ctx = egui::Context::default();
+        let mut a = app(Tool::Gradient);
+        alt_shift(&mut a, &ctx, Key::O, Key::O);
+        assert_eq!(a.ui.tool_options.gradient_blend_mode, BlendMode::Overlay);
+        alt_shift(&mut a, &ctx, Key::R, Key::R);
+        assert_eq!(a.ui.tool_options.gradient_blend_mode, BlendMode::Overlay, "no Clear for the Gradient");
+        a.ui.tool = Tool::Smudge;
+        alt_shift(&mut a, &ctx, Key::M, Key::M);
+        assert_eq!(layer_blend(&a), BlendMode::Normal);
+        assert_eq!(a.ui.tool, Tool::Smudge);
+        let mut none = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+        pick_mode(&mut none, Pick::Mode(BlendMode::Multiply));
+    }
+
+    /// With a Free Transform box open, ⇧⌥ letters and the number keys still go where the tool
+    /// sends them: the Brush's mode and opacity with the Brush, the layer's with the Move tool.
+    /// They never pick a tool, so the box stays open, and Enter keeps both the transform and the
+    /// layer's new mode. Puppet Warp keeps them to itself: its preview is a snapshot taken when it
+    /// started, so a change made meanwhile wouldn't show, and Esc wouldn't take it back.
+    #[test]
+    fn keys_follow_the_tool_while_a_transform_is_open_and_a_warp_keeps_them() {
+        let ctx = egui::Context::default();
+        let mut a = app(Tool::Brush);
+        a.run("select.rect", json!({"x": 4, "y": 4, "width": 12, "height": 12})).unwrap();
+        a.run("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        a.run("select.deselect", json!({})).unwrap();
+        a.sync_views();
+        crate::transform_tool::begin(&mut a, &ctx).unwrap();
+        crate::transform_tool::nudge(&mut a, 3.0, 0.0);
+        let shift_alt = egui::Modifiers::SHIFT | egui::Modifiers::ALT;
+        let opacity = |a: &PhotocraftApp| {
+            let st = a.session.active().unwrap();
+            st.doc.layer(st.active_layer.unwrap()).unwrap().opacity
+        };
+        // The Brush: its own mode and opacity.
+        key(&mut a, &ctx, Key::M, shift_alt);
+        assert_eq!(a.session.tools.brush.mode, BlendMode::Multiply);
+        key(&mut a, &ctx, Key::Num5, egui::Modifiers::NONE);
+        assert!((a.session.tools.brush.opacity - 0.5).abs() < 1e-6);
+        assert_eq!((layer_blend(&a), opacity(&a)), (BlendMode::Normal, 1.0), "the layer is left alone");
+        assert!(a.ui.transform.is_some(), "the box stays open");
+        assert_eq!(a.ui.tool, Tool::Brush, "no tool letter");
+        // The Move tool: the layer's.
+        a.ui.tool = Tool::Move;
+        a.opacity_keys = None;
+        key(&mut a, &ctx, Key::E, shift_alt);
+        key(&mut a, &ctx, Key::Num7, egui::Modifiers::NONE);
+        assert_eq!(layer_blend(&a), BlendMode::Difference);
+        assert!((opacity(&a) - 0.7).abs() < 1e-6, "{}", opacity(&a));
+        assert!(a.ui.transform.is_some());
+        key(&mut a, &ctx, Key::Enter, egui::Modifiers::NONE);
+        assert!(a.ui.transform.is_none());
+        let st = a.session.active().unwrap();
+        let l = st.doc.layer(st.active_layer.unwrap()).unwrap();
+        assert_eq!(l.blend, BlendMode::Difference, "the commit keeps it");
+        assert_eq!(l.surface().unwrap().content_bounds().x0, 7, "and the move");
+        let l_opacity = l.opacity;
+        // Puppet Warp: nothing reaches the layer, the Brush or the History.
+        crate::distort_ui::menu(&mut a, &ctx, "edit.puppetWarp", &json!({})).unwrap().unwrap();
+        assert!(a.distort.puppet.is_some());
+        let undo = a.session.active().unwrap().history.past_len();
+        a.opacity_keys = None;
+        key(&mut a, &ctx, Key::S, shift_alt);
+        key(&mut a, &ctx, Key::Plus, egui::Modifiers::SHIFT);
+        key(&mut a, &ctx, Key::Num3, egui::Modifiers::NONE);
+        a.ui.tool = Tool::Brush;
+        key(&mut a, &ctx, Key::H, shift_alt);
+        key(&mut a, &ctx, Key::Num9, egui::Modifiers::NONE);
+        assert_eq!((layer_blend(&a), opacity(&a)), (BlendMode::Difference, l_opacity), "the layer under the warp is left alone");
+        assert_eq!(a.session.tools.brush.mode, BlendMode::Multiply);
+        assert!((a.session.tools.brush.opacity - 0.5).abs() < 1e-6);
+        assert_eq!(a.session.active().unwrap().history.past_len(), undo, "no History step behind the warp");
+        assert!(a.distort.puppet.is_some(), "the warp stays open");
+        // Perspective Warp too.
+        key(&mut a, &ctx, Key::Escape, egui::Modifiers::NONE);
+        assert!(a.distort.puppet.is_none());
+        a.ui.tool = Tool::Move;
+        crate::distort_ui::menu(&mut a, &ctx, "edit.perspectiveWarp", &json!({})).unwrap().unwrap();
+        assert!(a.distort.perspective.is_some());
+        key(&mut a, &ctx, Key::S, shift_alt);
+        key(&mut a, &ctx, Key::Num3, egui::Modifiers::NONE);
+        assert_eq!((layer_blend(&a), opacity(&a)), (BlendMode::Difference, l_opacity));
+        assert_eq!(a.session.active().unwrap().history.past_len(), undo);
+        assert!(a.distort.perspective.is_some());
+    }
+
+    /// The stamps and the History Brush keep their mode in their own brush: the keys set it there,
+    /// never the layer's, and another tool's brush keeps its own.
+    #[test]
+    fn clone_stamp_pattern_stamp_and_history_brush_take_the_keys_into_their_own_brush() {
+        let ctx = egui::Context::default();
+        let mut a = app(Tool::Brush);
+        alt_shift(&mut a, &ctx, Key::M, Key::M);
+        for (tool, key, mode) in
+            [(Tool::CloneStamp, Key::S, BlendMode::Screen), (Tool::PatternStamp, Key::O, BlendMode::Overlay), (Tool::HistoryBrush, Key::K, BlendMode::Darken)]
+        {
+            a.ui.tool = tool;
+            assert_eq!(tool_mode(&mut a), Some(BlendMode::Normal), "{tool:?} starts in Normal");
+            alt_shift(&mut a, &ctx, key, key);
+            assert_eq!(tool_mode(&mut a), Some(mode), "{tool:?}");
+            alt_shift(&mut a, &ctx, Key::R, Key::R);
+            assert_eq!(tool_mode(&mut a), Some(mode), "{tool:?} has no Clear");
+            key_press(&mut a, &ctx, 1);
+            assert_ne!(tool_mode(&mut a), Some(mode), "{tool:?} steps");
+            assert_eq!(layer_blend(&a), BlendMode::Normal, "{tool:?} leaves the layer alone");
+        }
+        a.ui.tool = Tool::Brush;
+        assert_eq!(tool_mode(&mut a), Some(BlendMode::Multiply), "the Brush keeps its own mode");
+    }
+
+    fn key_press(a: &mut PhotocraftApp, ctx: &egui::Context, step: i32) {
+        key(a, ctx, if step > 0 { Key::Plus } else { Key::Minus }, egui::Modifiers::SHIFT);
+    }
+
+    /// The Healing Brush's menu is short: letters outside it do nothing, and ⇧+ steps within it.
+    #[test]
+    fn healing_brush_takes_only_its_own_modes() {
+        let ctx = egui::Context::default();
+        let mut a = app(Tool::Healing);
+        alt_shift(&mut a, &ctx, Key::O, Key::O);
+        assert_eq!(tool_mode(&mut a), Some(BlendMode::Normal), "Overlay isn't a Healing mode");
+        alt_shift(&mut a, &ctx, Key::Y, Key::Y);
+        assert_eq!(tool_mode(&mut a), Some(BlendMode::Luminosity));
+        key_press(&mut a, &ctx, 1);
+        assert_eq!(tool_mode(&mut a), Some(BlendMode::Normal), "wraps within the Healing list");
+        key_press(&mut a, &ctx, 1);
+        assert_eq!(tool_mode(&mut a), Some(BlendMode::Multiply));
+        assert_eq!(layer_blend(&a), BlendMode::Normal);
+    }
+
+    /// A Healing Brush whose brush holds Overlay (outside its menu) counts as Normal for the keys,
+    /// as for its stroke: ⇧+ steps on to Multiply.
+    #[test]
+    fn healing_brush_with_a_mode_outside_its_menu_steps_from_normal() {
+        let ctx = egui::Context::default();
+        let mut a = app(Tool::Healing);
+        crate::paint_mouse::sync_tool_brush(&mut a);
+        a.session.tools.brush.mode = BlendMode::Overlay;
+        assert_eq!(tool_mode(&mut a), Some(BlendMode::Normal));
+        key_press(&mut a, &ctx, 1);
+        assert_eq!(tool_mode(&mut a), Some(BlendMode::Multiply));
+    }
+
+    /// The Paint Bucket has its own Mode, Clear included.
+    #[test]
+    fn paint_bucket_takes_the_keys_with_clear() {
+        let ctx = egui::Context::default();
+        let mut a = app(Tool::PaintBucket);
+        alt_shift(&mut a, &ctx, Key::M, Key::M);
+        assert_eq!(a.ui.tool_options.bucket_blend_mode, BlendMode::Multiply);
+        alt_shift(&mut a, &ctx, Key::R, Key::R);
+        assert!(a.ui.tool_options.bucket_clear);
+        key_press(&mut a, &ctx, 1);
+        assert!(!a.ui.tool_options.bucket_clear);
+        assert_eq!(a.ui.tool_options.bucket_blend_mode, BlendMode::Darken, "Clear is followed by Darken");
+        assert_eq!(layer_blend(&a), BlendMode::Normal);
+    }
+
+    /// Tools without a blend mode of their own (the Erasers, the Mixer Brush) pass the keys to the
+    /// selected layers, as Photoshop does.
+    #[test]
+    fn tools_without_a_blend_mode_set_the_layer() {
+        let ctx = egui::Context::default();
+        for (tool, key, mode) in
+            [(Tool::Eraser, Key::M, BlendMode::Multiply), (Tool::MagicEraser, Key::S, BlendMode::Screen), (Tool::MixerBrush, Key::E, BlendMode::Difference)]
+        {
+            let mut a = app(tool);
+            alt_shift(&mut a, &ctx, key, key);
+            assert_eq!(layer_blend(&a), mode, "{tool:?}");
+            assert_eq!(a.ui.tool, tool);
+        }
+    }
+
+    /// Dodge, Burn and Sponge use ⇧⌥S/M/H and ⇧⌥D/S for their own Range and mode in Photoshop, so
+    /// neither the letters nor ⇧+ change the layer's blend mode.
+    #[test]
+    fn dodge_burn_and_sponge_leave_the_layer_alone() {
+        let ctx = egui::Context::default();
+        for tool in [Tool::Dodge, Tool::Burn, Tool::Sponge] {
+            let mut a = app(tool);
+            for k in [Key::S, Key::M, Key::H, Key::D] {
+                alt_shift(&mut a, &ctx, k, k);
+            }
+            key_press(&mut a, &ctx, 1);
+            assert_eq!(layer_blend(&a), BlendMode::Normal, "{tool:?}");
+            assert_eq!(a.ui.tool, tool);
+        }
+    }
+
+    #[test]
+    fn art_history_brush_leaves_the_layer_alone() {
+        // Photoshop's Art History Brush has a Mode of its own; ours has no Mode control yet.
+        let ctx = egui::Context::default();
+        let mut a = app(Tool::ArtHistoryBrush);
+        alt_shift(&mut a, &ctx, Key::M, Key::M);
+        key_press(&mut a, &ctx, 1);
+        assert_eq!(layer_blend(&a), BlendMode::Normal);
+        assert_eq!(a.ui.tool, Tool::ArtHistoryBrush);
+    }
 }
diff --git a/crates/ui-egui/src/brand.rs b/crates/ui-egui/src/brand.rs
index a601e95c3e..01cf827d35 100644
--- a/crates/ui-egui/src/brand.rs
+++ b/crates/ui-egui/src/brand.rs
@@ -22,7 +22,7 @@ fn decode() -> egui::ColorImage {
 
 /// The icon texture, uploaded on first use and kept in the context.
 fn texture(ctx: &Context) -> TextureHandle {
-    let id = Id::new("photocraft-brand-mark");
+    let id = Id::unique("photocraft-brand-mark");
     if let Some(tex) = ctx.data(|d| d.get_temp::<TextureHandle>(id)) {
         return tex;
     }
@@ -34,7 +34,7 @@ fn texture(ctx: &Context) -> TextureHandle {
 
 /// Where the mark was painted this frame (tests and screenshots).
 fn rect_id() -> Id {
-    Id::new("photocraft-brand-mark-rect")
+    Id::unique("photocraft-brand-mark-rect")
 }
 
 /// Paint the mark into `r` (square).
diff --git a/crates/ui-egui/src/browse_field_tests.rs b/crates/ui-egui/src/browse_field_tests.rs
index 2aa3ef44f5..09debf418b 100644
--- a/crates/ui-egui/src/browse_field_tests.rs
+++ b/crates/ui-egui/src/browse_field_tests.rs
@@ -63,3 +63,21 @@ fn install_plugin_path_is_chosen_with_browse() {
     }
     assert_eq!(field(&h, "path"), Some(json!("/tmp/blur.wasm")));
 }
+
+/// #9357: Image Processor's source and destination folders are chosen with Browse…, as
+/// Photoshop's Select Folder… buttons choose them, instead of being typed.
+#[test]
+fn image_processor_folders_are_chosen_with_browse() {
+    let (mut h, asked) = harness(vec![Some(FileDialogAnswer::FolderTo("/tmp/shoot".into())), Some(FileDialogAnswer::FolderTo("/tmp/web".into()))]);
+    let ctx = h.ctx.clone();
+    crate::menus::invoke(h.state_mut(), &ctx, "file.scripts.imageProcessor", json!({})).unwrap();
+    h.run_steps(4);
+    assert_eq!(h.query_all_by_label("Browse…").count(), 2, "one Browse… for the source and one for the destination");
+    h.query_all_by_label("Browse…").next().unwrap().click();
+    h.run_steps(4);
+    assert_eq!(field(&h, "input"), Some(json!("/tmp/shoot")));
+    h.query_all_by_label("Browse…").nth(1).unwrap().click();
+    h.run_steps(4);
+    assert_eq!(field(&h, "output"), Some(json!("/tmp/web")));
+    assert!(matches!(asked.borrow().as_slice(), [FileDialogRequest::Folder { .. }, FileDialogRequest::Folder { .. }]));
+}
diff --git a/crates/ui-egui/src/brush_cursor.rs b/crates/ui-egui/src/brush_cursor.rs
index 22a489ba9a..6bc71a78f7 100644
--- a/crates/ui-egui/src/brush_cursor.rs
+++ b/crates/ui-egui/src/brush_cursor.rs
@@ -123,7 +123,7 @@ pub(crate) fn rings(ctx: &egui::Context, brush: &BrushSettings, full: bool) -> O
     if matches!(brush.tip, TipShape::Round) && brush.angle == 0.0 && brush.roundness >= 1.0 {
         return None;
     }
-    let id = egui::Id::new("photocraft-tip-outline");
+    let id = egui::Id::unique("photocraft-tip-outline");
     if let Some(c) = ctx.data(|d| d.get_temp::<Cached>(id))
         && c.key.matches(brush, full)
     {
diff --git a/crates/ui-egui/src/brush_panel.rs b/crates/ui-egui/src/brush_panel.rs
index 649a50eb46..4b46204266 100644
--- a/crates/ui-egui/src/brush_panel.rs
+++ b/crates/ui-egui/src/brush_panel.rs
@@ -192,7 +192,7 @@ fn gesture(ctx: &egui::Context) -> u64 {
     let frame = ctx.cumulative_pass_nr();
     let pressed = ctx.input(|i| i.pointer.any_pressed());
     ctx.data_mut(|d| {
-        let g = d.get_temp_mut_or_default::<(u64, u64)>(egui::Id::new(GESTURE));
+        let g = d.get_temp_mut_or_default::<(u64, u64)>(egui::Id::unique(GESTURE));
         if pressed && g.1 != frame {
             g.0 += 1;
             g.1 = frame;
@@ -207,7 +207,7 @@ fn gesture(ctx: &egui::Context) -> u64 {
 pub fn commit_gesture(app: &mut PhotocraftApp, ctx: &egui::Context, before: &BrushSettings, after: &BrushSettings) {
     let g = gesture(ctx);
     if send(app, before, after, Some(format!("brush-ui:{g}"))) && !ctx.input(|i| i.pointer.any_down()) {
-        ctx.data_mut(|d| d.get_temp_mut_or_default::<(u64, u64)>(egui::Id::new(GESTURE)).0 += 1);
+        ctx.data_mut(|d| d.get_temp_mut_or_default::<(u64, u64)>(egui::Id::unique(GESTURE)).0 += 1);
     }
 }
 
@@ -274,9 +274,9 @@ fn section_list(app: &mut PhotocraftApp, ui: &mut egui::Ui, b: &mut BrushSetting
             // Named for accessibility and for tests and agents that look sections up by name.
             if toggle_only {
                 let checked = section_flag(b, i).is_some_and(|flag| *flag);
-                resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, checked, tl!(*name)));
+                resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, true, checked, tl!(*name)));
             } else {
-                resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, sel, tl!(*name)));
+                resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, sel, tl!(*name)));
             }
             if sel {
                 ui.painter().rect_filled(r, t.radius_sm, t.accent_soft);
@@ -289,9 +289,9 @@ fn section_list(app: &mut PhotocraftApp, ui: &mut egui::Ui, b: &mut BrushSetting
                 // A checkbox-only row is one accessible checkbox across its whole width. A
                 // controls section keeps its separate enable box and selectable label.
                 let box_resp = (!toggle_only).then(|| {
-                    let resp = ui.interact(br, ui.id().with(("brush-sec-box", i)), Sense::click());
+                    let resp = ui.interact(br, ui.scope_id().with(("brush-sec-box", i)), Sense::click());
                     resp.widget_info(|| {
-                        egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, *flag, crate::i18n::fmt(tl!("Enable {name}"), &[("name", tl!(*name))]))
+                        egui::WidgetInfo::selected(egui::Role::CheckBox, true, *flag, crate::i18n::fmt(tl!("Enable {name}"), &[("name", tl!(*name))]))
                     });
                     resp
                 });
@@ -323,8 +323,8 @@ fn section_list(app: &mut PhotocraftApp, ui: &mut egui::Ui, b: &mut BrushSetting
             let mut lock_clicked = false;
             if let Some(lock) = section_lock(b, i) {
                 let lr = egui::Rect::from_center_size(egui::pos2(r.right() - 11.0, r.center().y), vec2(18.0, 18.0));
-                let lresp = ui.interact(lr, ui.id().with(("brush-sec-lock", i)), Sense::click());
-                lresp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, ui.is_enabled(), *lock, format!("{}: {}", tl!("Lock"), tl!(*name))));
+                let lresp = ui.interact(lr, ui.scope_id().with(("brush-sec-lock", i)), Sense::click());
+                lresp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, ui.is_enabled(), *lock, format!("{}: {}", tl!("Lock"), tl!(*name))));
                 // Like Photoshop: lock icons stay visible on every lockable section row.
                 let tint = if *lock { t.text } else { t.text_faint };
                 icons::paint(ui, lr, if *lock { "lock" } else { "lock-open" }, 12.0, tint);
@@ -402,7 +402,7 @@ fn settings_tab(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             let current = app.session.tools.current_preset.clone().filter(|n| app.session.tools.presets.iter().any(|p| p.name.eq_ignore_ascii_case(n)));
             let update =
                 ui.add_enabled_ui(current.is_some(), |ui| icons::button(ui, "check", 24.0, false, tl!("Update the current brush with these settings"))).inner;
-            update.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, current.is_some(), "Update the current brush with these settings"));
+            update.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, current.is_some(), "Update the current brush with these settings"));
             if update.clicked() {
                 run_or_status(app, "brush.presets.update", json!({ "brush": serde_json::to_value(&b).unwrap_or(Value::Null) }));
             }
@@ -511,7 +511,7 @@ pub fn window(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let canvas = app.last_canvas_rect;
     let mut open = true;
     egui::Window::new(tl!("Brush Settings"))
-        .id(egui::Id::new("brush-settings"))
+        .id(egui::Id::unique("brush-settings"))
         .title_bar(false)
         .resizable(false)
         .frame(frame)
diff --git a/crates/ui-egui/src/brush_panel_tests.rs b/crates/ui-egui/src/brush_panel_tests.rs
index 1ea52bdb72..e0e15cb4f5 100644
--- a/crates/ui-egui/src/brush_panel_tests.rs
+++ b/crates/ui-egui/src/brush_panel_tests.rs
@@ -1,5 +1,6 @@
 use egui::vec2;
 use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
 use photocraft_engine::paint::{Control, GrayTile, MaskMode, Pattern, PatternStyle, TipShape};
 
 use super::*;
@@ -12,6 +13,14 @@ fn last_journal(app: &PhotocraftApp) -> Option<(String, Value)> {
     app.session.journal.last().cloned()
 }
 
+/// The visible options caption, not the numeric field it names.
+fn caption_rect(h: &Harness<'_, PhotocraftApp>, text: &str) -> egui::Rect {
+    h.query_all(egui_kittest::kittest::by().label(text).include_labels())
+        .find(|n| n.accesskit_node().role() == egui::accesskit::Role::Label)
+        .unwrap_or_else(|| panic!("the `{text}` caption"))
+        .rect()
+}
+
 #[test]
 fn sections_with_boxes_have_flags() {
     let mut b = BrushSettings::default();
@@ -420,11 +429,10 @@ fn options_bar_harness(tool: crate::state::Tool) -> Harness<'static, PhotocraftA
 
 #[test]
 fn clone_stamp_opacity_and_flow_are_journaled_per_gesture() {
-    use egui_kittest::kittest::Queryable;
     let mut h = options_bar_harness(crate::state::Tool::CloneStamp);
     for (label, field) in [("Opacity", "opacity"), ("Flow", "flow")] {
         let n = h.state().session.journal.len();
-        let rect = h.get_by_label(label).rect();
+        let rect = caption_rect(&h, label);
         let start = egui::pos2(rect.right() + 40.0, rect.center().y);
         h.hover_at(start);
         h.run();
@@ -464,7 +472,7 @@ fn options_bar_edits_are_one_set_brush_per_gesture() {
     h.run_steps(3);
     assert_eq!(h.state().session.journal.len(), n, "showing the bar issues nothing");
     // Drag the Opacity field left: many frames, one journal entry.
-    let label = h.get_by_label("Opacity").rect();
+    let label = caption_rect(&h, "Opacity");
     let start = egui::pos2(label.right() + 40.0, label.center().y);
     h.hover_at(start);
     h.run();
@@ -753,8 +761,9 @@ fn transfer_mixer_edits_use_the_brush_command_and_survive_real_tool_swaps() {
     a.ui.tool = Tool::MixerBrush;
     crate::paint_mouse::sync_tool_brush(a);
     h.run_steps(2);
-    h.hover_at(h.get_by_label("Opacity Jitter").rect().center());
+    h.hover_at(caption_rect(&h, "Opacity Jitter").center());
     h.event(egui::Event::MouseWheel {
+        source: egui::MouseWheelSource::Unknown,
         unit: egui::MouseWheelUnit::Point,
         delta: vec2(0.0, -250.0),
         phase: egui::TouchPhase::Move,
@@ -1003,12 +1012,11 @@ fn checkbox_only_rows_are_accessible_checkboxes_and_accept_space() {
 
 #[test]
 fn editing_the_options_bar_amount_reenables_smoothing() {
-    use egui_kittest::kittest::Queryable;
     let mut h = options_bar_harness(crate::state::Tool::Brush);
     h.state_mut().run("tools.setBrush", json!({"brush": {"smoothing": {"enabled": false, "amount": 0.4}}})).unwrap();
     h.run_steps(3);
     let n = h.state().session.journal.len();
-    let label = h.get_by_label("Smoothing").rect();
+    let label = caption_rect(&h, "Smoothing");
     let at = egui::pos2(label.right() + 25.0, label.center().y);
     h.hover_at(at);
     h.run_steps(2);
diff --git a/crates/ui-egui/src/brush_picker.rs b/crates/ui-egui/src/brush_picker.rs
index 9bef83a647..e417dc5a77 100644
--- a/crates/ui-egui/src/brush_picker.rs
+++ b/crates/ui-egui/src/brush_picker.rs
@@ -76,7 +76,7 @@ impl Pick {
 }
 
 pub(crate) fn picker_id() -> egui::Id {
-    egui::Id::new("canvas-brush-picker")
+    egui::Id::unique("canvas-brush-picker")
 }
 
 /// All opening paths protect the same frame, including the control channel and options bar.
@@ -88,7 +88,7 @@ pub(crate) fn open(ui: &mut crate::state::UiState, ctx: &egui::Context, at: [f32
 /// The options-bar brush chip that shows and hides the picker. A press on it isn't an outside
 /// press that closes the picker: the chip's click toggles it.
 pub fn chip_id() -> egui::Id {
-    egui::Id::new("brush-preset-chip")
+    egui::Id::unique("brush-preset-chip")
 }
 
 /// Is screen point `p` on the options-bar brush chip?
@@ -197,7 +197,7 @@ pub fn settings_toggle(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
 
 /// An icon button's accessible name (icon buttons have only a tooltip).
 pub(crate) fn named(resp: egui::Response, label: &str) -> egui::Response {
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!(label)));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(label)));
     resp
 }
 
@@ -234,7 +234,7 @@ pub fn body(
             ui.label(RichText::new(tl!("Size")).color(t.text_dim));
             ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                 let mut size = b.size;
-                if widgets::value_field(ui, &mut size, 1.0..=MAX_BRUSH_SIZE, "px", 72.0).changed() {
+                if widgets::value_field(ui, &mut size, 1.0..=MAX_BRUSH_SIZE, "px", 72.0).accessible_name(tl!("Size")).changed() {
                     b.size = size.round().clamp(1.0, MAX_BRUSH_SIZE);
                 }
             });
@@ -260,7 +260,7 @@ pub fn body(
     ui.horizontal(|ui| {
         icons::paint(ui, egui::Rect::from_min_size(ui.cursor().min + vec2(0.0, 3.0), vec2(16.0, 16.0)), "search", 14.0, t.text_faint);
         ui.add_space(20.0);
-        widgets::text_field(ui, ui.id().with("brush-picker-search"), &mut st.filter, tl!("Search Brushes"), (size.x - 118.0).max(60.0), false);
+        widgets::text_field(ui, ui.scope_id().with("brush-picker-search"), &mut st.filter, tl!("Search Brushes"), (size.x - 118.0).max(60.0), false);
         ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
             gear_menu(ui, current, presets, st, &mut picks);
             let new_tip = "Create new brush preset from the current settings";
@@ -330,7 +330,7 @@ pub fn clamp_size(size: [f32; 2], screen: egui::Vec2) -> egui::Vec2 {
 pub fn resize_grip(ui: &mut egui::Ui, frame: egui::Rect, content: egui::Vec2) -> Option<egui::Vec2> {
     let t = Tokens::get(ui.ctx());
     let grip = egui::Rect::from_min_size(frame.right_bottom() - vec2(16.0, 16.0), vec2(16.0, 16.0));
-    let resp = ui.interact(grip, ui.id().with("brush-picker-resize"), egui::Sense::drag());
+    let resp = ui.interact(grip, ui.scope_id().with("brush-picker-resize"), egui::Sense::drag());
     dismiss_popup(&resp);
     let corner = grip.right_bottom() - vec2(3.0, 3.0);
     for i in 0..3 {
diff --git a/crates/ui-egui/src/brush_preset_dialog.rs b/crates/ui-egui/src/brush_preset_dialog.rs
index 129b9adf28..46bf07522e 100644
--- a/crates/ui-egui/src/brush_preset_dialog.rs
+++ b/crates/ui-egui/src/brush_preset_dialog.rs
@@ -96,8 +96,8 @@ pub fn body(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Value>,
             ui.horizontal(|ui| {
                 ui.label(tl!("Name:"));
                 let mut text = f.get("name").and_then(Value::as_str).unwrap_or("").to_string();
-                let id = ui.id().with("new-brush-preset-name");
-                let r = widgets::text_field(ui, id, &mut text, "", 220.0, false);
+                let id = ui.scope_id().with("new-brush-preset-name");
+                let r = widgets::text_field(ui, id, &mut text, "", 220.0, false).accessible_name(tl!("Name:"));
                 // Photoshop opens on the name, all of it selected, so typing replaces it.
                 let once = id.with("focused");
                 if !ui.ctx().data(|d| d.get_temp::<bool>(once).unwrap_or(false)) {
diff --git a/crates/ui-egui/src/brush_preview.rs b/crates/ui-egui/src/brush_preview.rs
index ec6b36c07b..f77975d45c 100644
--- a/crates/ui-egui/src/brush_preview.rs
+++ b/crates/ui-egui/src/brush_preview.rs
@@ -220,7 +220,7 @@ fn upload(ctx: &egui::Context, name: &str, w: u32, h: u32, rgba: &[u8]) -> egui:
 }
 
 fn cache_id() -> egui::Id {
-    egui::Id::new("brush-preview-cache")
+    egui::Id::unique("brush-preview-cache")
 }
 
 /// Run `f` on the context's preview cache. The cache is taken out of egui's memory while `f` runs,
diff --git a/crates/ui-egui/src/brush_resize.rs b/crates/ui-egui/src/brush_resize.rs
index 7d41aaa1ba..5ff7beb9c9 100644
--- a/crates/ui-egui/src/brush_resize.rs
+++ b/crates/ui-egui/src/brush_resize.rs
@@ -308,7 +308,7 @@ mod tests {
         assert!(h.state().brush_resize.is_some());
         assert!(h.state().session.tools.brush.size > size0, "dragging right grew the brush");
         assert!(h.state().session.tools.brush.hardness > 0.2, "dragging down hardened it");
-        assert!(h.ctx.memory(|m| m.area_rect(egui::Id::new("brush-resize-readout"))).is_some(), "the readout shows mid-drag");
+        assert!(h.ctx.memory(|m| m.area_rect(egui::Id::unique("brush-resize-readout"))).is_some(), "the readout shows mid-drag");
         assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::None, "the pointer hides");
         press(&mut h, c + vec2(60.0, 48.0), false);
         h.event(egui::Event::ModifiersChanged(Modifiers::NONE));
@@ -370,7 +370,7 @@ mod tests {
             assert!(r.secondary);
             assert!(h.state().session.tools.brush.size > size0, "right grows the brush");
             assert!(h.state().session.tools.brush.hardness > 0.2, "down hardens it");
-            assert!(h.ctx.memory(|m| m.area_rect(egui::Id::new("brush-resize-readout"))).is_some(), "the readout shows");
+            assert!(h.ctx.memory(|m| m.area_rect(egui::Id::unique("brush-resize-readout"))).is_some(), "the readout shows");
             assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::None);
             button(&mut h, end, PointerButton::Secondary, false, Modifiers::ALT);
             h.event(egui::Event::ModifiersChanged(Modifiers::NONE));
@@ -384,6 +384,27 @@ mod tests {
         }
     }
 
+    /// Alt-right dragging changes tip size without loading paint or touching document history.
+    #[test]
+    fn mixer_alt_right_drag_resizes_without_sampling_or_painting() {
+        let mut a = app(Tool::MixerBrush);
+        let before = a.session.tools.mixer.clone();
+        a.sync_views();
+        let mut h = canvas(a);
+        let (undo0, size0) = (history(h.state()), h.state().session.tools.brush.size);
+        let end = alt_right_drag(&mut h, vec2(10.0, 8.0));
+        assert!(h.state().brush_resize.is_some_and(|resize| resize.secondary));
+        assert!(h.state().session.tools.brush.size > size0);
+        button(&mut h, end, PointerButton::Secondary, false, Modifiers::ALT);
+        h.event(egui::Event::ModifiersChanged(Modifiers::NONE));
+        h.run_steps(2);
+        let a = h.state();
+        assert!(a.brush_resize.is_none() && !a.brush_resize_armed);
+        assert_eq!(a.session.tools.mixer, before);
+        assert_eq!(history(a), undo0);
+        assert!(!a.session.journal.iter().any(|(id, _)| id == "brush.mixer.sample" || id == "paint.mixerBrush"));
+    }
+
     #[test]
     fn plain_right_click_still_opens_the_picker() {
         let mut a = app(Tool::Brush);
diff --git a/crates/ui-egui/src/brush_sections.rs b/crates/ui-egui/src/brush_sections.rs
index ca1556c680..d75a4daad1 100644
--- a/crates/ui-egui/src/brush_sections.rs
+++ b/crates/ui-egui/src/brush_sections.rs
@@ -76,7 +76,7 @@ pub(crate) fn takes_curve(control: Control, angle: bool) -> bool {
 
 /// egui memory key of the open/closed state of a dynamic's curve editor.
 pub(crate) fn curve_open_id(id: &str) -> egui::Id {
-    egui::Id::new(("brush-curve-open", id))
+    egui::Id::unique(("brush-curve-open", id))
 }
 
 /// `Control: [Off ▾] [25] [~]`: the controller pop-up, Fade's step count and the button that
@@ -88,10 +88,10 @@ fn control_row(ui: &mut egui::Ui, id: &str, d: &mut Dynamic, angle: bool) {
     ui.horizontal(|ui| {
         dim(ui, tl!("Control:"));
         let n = if angle || matches!(d.control, Control::InitialDirection | Control::Direction) { 8 } else { 6 };
-        widgets::dropdown(ui, id, &mut d.control, &CONTROLS[..n], 130.0);
+        widgets::dropdown(ui, id, tl!("Control:"), &mut d.control, &CONTROLS[..n], 130.0);
         if d.control == Control::Fade {
             let mut steps = d.fade_steps as f32;
-            if widgets::value_field(ui, &mut steps, 1.0..=9999.0, "", 56.0).on_hover_text(tl!("Fade steps")).changed() {
+            if widgets::value_field(ui, &mut steps, 1.0..=9999.0, "", 56.0).accessible_name(tl!("Fade steps")).on_hover_text(tl!("Fade steps")).changed() {
                 d.fade_steps = steps.round().clamp(1.0, 9999.0) as u32;
             }
         }
@@ -101,7 +101,7 @@ fn control_row(ui: &mut egui::Ui, id: &str, d: &mut Dynamic, angle: bool) {
     });
     if open && takes_curve(d.control, angle) {
         let mut points = d.curve.points();
-        if crate::pressure_curve_ui::edit_points(ui, egui::Id::new(("brush-curve-rect", id)), &mut points) {
+        if crate::pressure_curve_ui::edit_points(ui, egui::Id::unique(("brush-curve-rect", id)), &mut points) {
             d.curve = paint::ResponseCurve::new(&points);
         }
     }
@@ -132,7 +132,7 @@ fn size_row(ui: &mut egui::Ui, label: &str, size: &mut f32, max: f32, restore: O
         ui.label(RichText::new(tl!(label)).color(t.text_dim));
         ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
             let mut s = *size;
-            if widgets::value_field(ui, &mut s, 1.0..=max, "px", 74.0).changed() {
+            if widgets::value_field(ui, &mut s, 1.0..=max, "px", 74.0).accessible_name(tl!(label)).changed() {
                 *size = s.round().clamp(1.0, max);
             }
             if let Some(orig) = restore
@@ -332,7 +332,7 @@ fn tip_shape(ui: &mut egui::Ui, b: &mut BrushSettings, presets: &[BrushPreset],
             ui.horizontal(|ui| {
                 ui.allocate_ui_with_layout(vec2(72.0, 24.0), egui::Layout::left_to_right(egui::Align::Center), |ui| dim(ui, tl!("Angle:")));
                 let mut a = b.angle;
-                if widgets::value_field(ui, &mut a, -180.0..=180.0, "°", 70.0).changed() {
+                if widgets::value_field(ui, &mut a, -180.0..=180.0, "°", 70.0).accessible_name(tl!("Angle:")).changed() {
                     b.angle = a.round().clamp(-180.0, 180.0);
                 }
             });
@@ -340,7 +340,7 @@ fn tip_shape(ui: &mut egui::Ui, b: &mut BrushSettings, presets: &[BrushPreset],
             ui.horizontal(|ui| {
                 ui.allocate_ui_with_layout(vec2(72.0, 24.0), egui::Layout::left_to_right(egui::Align::Center), |ui| dim(ui, tl!("Roundness:")));
                 let mut r = (b.roundness * 100.0).round();
-                if widgets::value_field(ui, &mut r, 1.0..=100.0, "%", 70.0).changed() {
+                if widgets::value_field(ui, &mut r, 1.0..=100.0, "%", 70.0).accessible_name(tl!("Roundness:")).changed() {
                     b.roundness = (r.round() / 100.0).clamp(0.01, 1.0);
                 }
             });
@@ -454,7 +454,7 @@ fn texture(ui: &mut egui::Ui, b: &mut BrushSettings) {
             if style.is_none() {
                 opts.push((None, tl!("Custom")));
             }
-            if widgets::dropdown(ui, "brush-pattern", &mut style, &opts, 110.0)
+            if widgets::dropdown(ui, "brush-pattern", tl!("Pattern"), &mut style, &opts, 110.0)
                 && let Some(s) = style
             {
                 let size = match &tx.pattern {
@@ -488,7 +488,7 @@ fn texture(ui: &mut egui::Ui, b: &mut BrushSettings) {
     ui.add_space(4.0);
     ui.horizontal(|ui| {
         dim(ui, tl!("Mode:"));
-        widgets::dropdown(ui, "brush-texture-mode", &mut tx.mode, &MASK_MODES, 130.0);
+        widgets::dropdown(ui, "brush-texture-mode", tl!("Mode"), &mut tx.mode, &MASK_MODES, 130.0);
     });
     ui.add_space(4.0);
     pct(ui, tl!("Depth"), &mut tx.depth, 1.0);
@@ -504,7 +504,7 @@ fn dual_brush(ui: &mut egui::Ui, b: &mut BrushSettings, presets: &[BrushPreset])
     let d = &mut b.dual_brush;
     ui.horizontal(|ui| {
         dim(ui, tl!("Mode:"));
-        widgets::dropdown(ui, "brush-dual-mode", &mut d.mode, &MASK_MODES, 120.0);
+        widgets::dropdown(ui, "brush-dual-mode", tl!("Mode"), &mut d.mode, &MASK_MODES, 120.0);
         ui.add_space(8.0);
         widgets::checkbox(ui, &mut d.flip, tl!("Flip"));
     });
@@ -651,6 +651,14 @@ mod tests {
         kittest::{NodeT, Queryable},
     };
 
+    /// The slider row's visible caption, not the field or slider it names.
+    fn caption_rect<T>(h: &Harness<'_, T>, text: &str) -> egui::Rect {
+        h.query_all(egui_kittest::kittest::by().label(text).include_labels())
+            .find(|n| n.accesskit_node().role() == Role::Label)
+            .unwrap_or_else(|| panic!("the `{text}` caption"))
+            .rect()
+    }
+
     fn minimum_brush() -> BrushSettings {
         let mut b = BrushSettings::default();
         b.shape_dynamics.size.minimum = 0.2;
@@ -696,8 +704,8 @@ mod tests {
             let y = h.get_by_role_and_label(Role::CheckBox, "Override Tilt Y");
             assert_eq!(x.accesskit_node().toggled(), Some(Toggled::True));
             assert_eq!(y.accesskit_node().toggled(), Some(Toggled::False));
-            assert!(h.get_by_label("Tilt X").rect().bottom() < x.rect().top() && x.rect().bottom() < h.get_by_label("Tilt Y").rect().top());
-            assert!(h.get_by_label("Tilt Y").rect().bottom() < y.rect().top() && y.rect().bottom() < h.get_by_label("Rotation").rect().top());
+            assert!(caption_rect(&h, "Tilt X").bottom() < x.rect().top() && x.rect().bottom() < caption_rect(&h, "Tilt Y").top());
+            assert!(caption_rect(&h, "Tilt Y").bottom() < y.rect().top() && y.rect().bottom() < caption_rect(&h, "Rotation").top());
             assert_eq!(h.state(), &b, "drawing preserves pose degrees and flags");
             y.focus();
             h.run_steps(1);
@@ -722,7 +730,7 @@ mod tests {
             let mut h = section_harness(5, b.clone());
             crate::PhotocraftApp::setup_context(&h.ctx, kind);
             h.run_steps(3);
-            let label = h.get_by_label("Hue Jitter").rect();
+            let label = caption_rect(&h, "Hue Jitter");
             let t = Tokens::get(&h.ctx);
             assert!(
                 h.output().shapes.iter().any(|c| matches!(&c.shape, egui::Shape::Rect(r)
@@ -825,7 +833,7 @@ mod tests {
             assert_eq!(h.state().brush, before, "inactive field {value} ignores keyboard and pointer input");
         }
         for label in ["Wetness Jitter", "Mix Jitter"] {
-            let row = h.get_by_label(label).rect();
+            let row = caption_rect(&h, label);
             let from = pos2(row.left() + 120.0, row.bottom() + 16.0);
             h.hover_at(from);
             h.drag_at(from);
@@ -838,7 +846,7 @@ mod tests {
         }
         h.state_mut().tool = Tool::MixerBrush;
         h.run_steps(2);
-        let row = h.get_by_label("Wetness Jitter").rect();
+        let row = caption_rect(&h, "Wetness Jitter");
         let from = pos2(row.left() + 120.0, row.bottom() + 16.0);
         h.hover_at(from);
         h.drag_at(from);
@@ -932,7 +940,7 @@ mod tests {
         // The slider below the number and its scrubby label are disabled too.
         let track = pos2(300.0, center.y + 24.0);
         drag(&mut h, track, track);
-        let label = h.get_by_label("Minimum Diameter").rect().center();
+        let label = caption_rect(&h, "Minimum Diameter").center();
         drag(&mut h, label, label + vec2(60.0, 0.0));
         assert_eq!(h.state(), &before, "disabled interactions never rewrite brush settings");
 
diff --git a/crates/ui-egui/src/brushes_tab.rs b/crates/ui-egui/src/brushes_tab.rs
index 78f74811a9..050d810603 100644
--- a/crates/ui-egui/src/brushes_tab.rs
+++ b/crates/ui-egui/src/brushes_tab.rs
@@ -353,7 +353,7 @@ fn list_row(ui: &mut egui::Ui, p: &BrushPreset, current: bool, presets: &[BrushP
     let (full, resp) = ui.allocate_exact_size(vec2(ui.available_width(), list_row_height(scale)), Sense::click_and_drag());
     // Rows inside nested folders are indented; the whole width stays the drop target.
     let r = egui::Rect::from_min_max(full.min + vec2(indent.min(full.width() / 2.0), 0.0), full.max);
-    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, current, &p.name));
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, current, &p.name));
     if !ui.is_rect_visible(r) {
         return;
     }
@@ -407,7 +407,7 @@ pub(crate) fn grid_columns(width: f32, cell: f32, indent: f32, gap: f32) -> (f32
 fn grid_cell(ui: &mut egui::Ui, p: &BrushPreset, current: bool, presets: &[BrushPreset], cell: f32, acts: &mut Vec<Action>) {
     let t = Tokens::get(ui.ctx());
     let (r, resp) = ui.allocate_exact_size(vec2(cell, cell + 6.0), Sense::click_and_drag());
-    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, current, &p.name));
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, current, &p.name));
     if !ui.is_rect_visible(r) {
         return;
     }
@@ -555,7 +555,7 @@ fn preset_card(
         0.0
     };
     let (full, resp) = ui.allocate_exact_size(vec2(width, pad_y * 2.0 + top_h + name_h), Sense::click_and_drag());
-    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, current, &p.name));
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, current, &p.name));
     if !ui.is_rect_visible(full) {
         return;
     }
@@ -696,7 +696,7 @@ fn group_header(ui: &mut egui::Ui, label: &str, key: &str, folder: &[String], op
     let font = if folder.is_empty() { theme::semibold(12.0) } else { theme::medium(12.0) };
     ui.painter().text(pos2(x + 40.0, r.center().y), egui::Align2::LEFT_CENTER, shown, font, t.text);
     ui.painter().text(pos2(r.right() - 8.0, r.center().y), egui::Align2::RIGHT_CENTER, count.to_string(), theme::medium(11.0), t.text_faint);
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::CollapsingHeader, true, shown));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::DisclosureTriangle, true, shown));
     let me = match folder {
         [] => BrushDrag::Group(key.to_string()),
         f => BrushDrag::Folder { group: key.to_string(), folder: f.to_vec() },
@@ -866,8 +866,10 @@ fn rename_bar(ui: &mut egui::Ui, st: &mut BrushesPanelState, acts: &mut Vec<Acti
     }
     let mut done = false;
     ui.horizontal(|ui| {
-        ui.label(RichText::new(if r.group { tl!("Group name") } else { tl!("Brush name") }).color(t.text_dim));
-        let resp = ui.add(egui::TextEdit::singleline(&mut r.text).desired_width((ui.available_width() - 140.0).max(60.0)).id_salt("brush-rename"));
+        let name_label = ui.label(RichText::new(if r.group { tl!("Group name") } else { tl!("Brush name") }).color(t.text_dim));
+        let resp = ui
+            .add(egui::TextEdit::singleline(&mut r.text).desired_width((ui.available_width() - 140.0).max(60.0)).id_salt("brush-rename"))
+            .labelled_by(name_label.id);
         if !resp.has_focus() && !resp.lost_focus() {
             resp.request_focus();
         }
@@ -952,7 +954,7 @@ pub fn preset_list(ui: &mut egui::Ui, presets: &[BrushPreset], current: Option<&
             }
             BrushDrag::Folder { folder, .. } => folder.last().cloned().unwrap_or_default(),
         };
-        egui::Area::new(egui::Id::new(("brush-drag-label", layout.id))).order(egui::Order::Tooltip).fixed_pos(p + vec2(12.0, 8.0)).interactable(false).show(
+        egui::Area::new(egui::Id::unique(("brush-drag-label", layout.id))).order(egui::Order::Tooltip).fixed_pos(p + vec2(12.0, 8.0)).interactable(false).show(
             ui.ctx(),
             |ui| {
                 if matches!(&*d, BrushDrag::Preset(_)) {
@@ -1002,7 +1004,7 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             r
         });
         let mut s = b.size;
-        if widgets::value_field(ui, &mut s, 1.0..=MAX_BRUSH_SIZE, "px", 74.0).changed() {
+        if widgets::value_field(ui, &mut s, 1.0..=MAX_BRUSH_SIZE, "px", 74.0).accessible_name(tl!("Size")).changed() {
             b.size = s.round().clamp(1.0, MAX_BRUSH_SIZE);
         }
     });
@@ -1012,7 +1014,7 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         icons::paint(ui, egui::Rect::from_min_size(ui.cursor().min + vec2(0.0, 3.0), vec2(16.0, 16.0)), "search", 14.0, t.text_faint);
         ui.add_space(20.0);
         let search_w = (inner_w - 112.0).clamp(90.0, inner_w - 40.0);
-        widgets::text_field(ui, ui.id().with("brush-search"), &mut app.ui.brushes_panel.filter, tl!("Search Brushes"), search_w, false);
+        widgets::text_field(ui, ui.scope_id().with("brush-search"), &mut app.ui.brushes_panel.filter, tl!("Search Brushes"), search_w, false);
         ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
             let view = &mut app.ui.brushes_panel.view;
             let grid_tip = "Grid view";
diff --git a/crates/ui-egui/src/brushes_tab_tests.rs b/crates/ui-egui/src/brushes_tab_tests.rs
index e5cf21b74e..85bf63d38e 100644
--- a/crates/ui-egui/src/brushes_tab_tests.rs
+++ b/crates/ui-egui/src/brushes_tab_tests.rs
@@ -262,7 +262,7 @@ fn brush_picker_menu_closes_when_a_slider_or_the_grip_is_grabbed() {
     h.state_mut().ui.tool = crate::state::Tool::Brush;
     h.state_mut().ui.brush_picker = Some([300.0, 120.0]);
     h.run_steps(8);
-    let picker = h.ctx.memory(|m| m.area_rect(egui::Id::new("canvas-brush-picker"))).expect("the picker is shown");
+    let picker = h.ctx.memory(|m| m.area_rect(egui::Id::unique("canvas-brush-picker"))).expect("the picker is shown");
     assert!(!egui::Popup::is_any_open(&h.ctx), "nothing open to start with");
     click_gear(&h);
     h.run_steps(2);
@@ -312,7 +312,7 @@ fn brush_picker_upper_controls_stop_at_their_max_width() {
     h.state_mut().ui.brush_picker = Some([300.0, 120.0]);
     h.state_mut().ui.brush_picker_size = Some([500.0, 420.0]);
     h.run_steps(8);
-    let picker = h.ctx.memory(|m| m.area_rect(egui::Id::new("canvas-brush-picker"))).expect("the picker is shown");
+    let picker = h.ctx.memory(|m| m.area_rect(egui::Id::unique("canvas-brush-picker"))).expect("the picker is shown");
     let size_label = h.query_all_by_label(crate::i18n::t("Size")).find(|n| picker.contains(n.rect().center())).expect("the picker's Size label").rect();
     // The Size slider's middle: 12 pt below the label's (the row stands as tall as its 24 pt value
     // field, the label centred in it), the style's spacing, then half the slider's 18 pt — 27 pt
diff --git a/crates/ui-egui/src/caf_ui.rs b/crates/ui-egui/src/caf_ui.rs
index 149474b260..04bd6e05f5 100644
--- a/crates/ui-egui/src/caf_ui.rs
+++ b/crates/ui-egui/src/caf_ui.rs
@@ -1243,7 +1243,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let mut reset_what: Option<&str> = None;
     let mut rebase_needed = false;
     let mut dragging = false;
-    egui::Area::new(egui::Id::new("caf-workspace")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
+    egui::Area::new(egui::Id::unique("caf-workspace")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
         let Some(w) = app.distort.caf.as_mut() else { return };
         let before = w.opts.clone();
         w.texture_limit = ctx.input(|i| i.max_texture_side);
@@ -1279,7 +1279,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 bui.add_space(8.0);
                 bui.label(tl!("Size:"));
                 let mut size = w.brush_size as f32;
-                if widgets::value_field(&mut bui, &mut size, 1.0..=5000.0, " px", 64.0).changed() {
+                if widgets::value_field(&mut bui, &mut size, 1.0..=5000.0, " px", 64.0).accessible_name(tl!("Size:")).changed() {
                     w.brush_size = f64::from(size);
                 }
             }
@@ -1303,7 +1303,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 if widgets::secondary_button(&mut bui, tl!("Contract"), 70.0).clicked() {
                     fill_btn = Some(json!({"op": "contract", "by": w.expand_by}));
                 }
-                widgets::value_field(&mut bui, &mut w.expand_by, 1.0..=100.0, " px", 56.0);
+                widgets::value_field(&mut bui, &mut w.expand_by, 1.0..=100.0, " px", 56.0).accessible_name(tl!("Expand"));
                 if crate::icons::button(&mut bui, "undo-2", 26.0, false, tl!("Reset")).clicked() {
                     reset_what = Some("lasso");
                 }
@@ -1338,7 +1338,14 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                     widgets::color_edit_button_srgb(ui, &mut w.opts.color);
                     ui.add_space(8.0);
                     ui.label(tl!("Indicates"));
-                    widgets::dropdown(ui, "caf-indicates", &mut w.opts.excluded, &[(false, tl!("Sampling Area")), (true, tl!("Excluded Area"))], 120.0);
+                    widgets::dropdown(
+                        ui,
+                        "caf-indicates",
+                        tl!("Indicates"),
+                        &mut w.opts.excluded,
+                        &[(false, tl!("Sampling Area")), (true, tl!("Excluded Area"))],
+                        120.0,
+                    );
                 });
             });
             widgets::hairline(ui);
@@ -1377,7 +1384,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                     ("high".to_string(), tl!("High")),
                     ("veryHigh".to_string(), tl!("Very High")),
                 ];
-                widgets::dropdown(ui, "caf-color", &mut w.opts.color_adaptation, &o, 110.0);
+                widgets::dropdown(ui, "caf-color", tl!("Color Adaptation"), &mut w.opts.color_adaptation, &o, 110.0);
             });
             ui.horizontal(|ui| {
                 ui.label(tl!("Rotation Adaptation"));
@@ -1388,7 +1395,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                     ("high".to_string(), tl!("High")),
                     ("full".to_string(), tl!("Full")),
                 ];
-                widgets::dropdown(ui, "caf-rotation", &mut w.opts.rotation, &o, 110.0);
+                widgets::dropdown(ui, "caf-rotation", tl!("Rotation Adaptation"), &mut w.opts.rotation, &o, 110.0);
             });
             ui.horizontal(|ui| {
                 widgets::checkbox(ui, &mut w.opts.scale, tl!("Scale"));
@@ -1400,7 +1407,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 ui.label(tl!("Output To"));
                 let o =
                     [("current".to_string(), tl!("Current Layer")), ("new".to_string(), tl!("New Layer")), ("duplicate".to_string(), tl!("Duplicate Layer"))];
-                widgets::dropdown(ui, "caf-output", &mut w.opts.output, &o, 140.0);
+                widgets::dropdown(ui, "caf-output", tl!("Output To"), &mut w.opts.output, &o, 140.0);
             });
             if let Some(e) = w.error.as_ref().or(w.preview.error.as_ref()) {
                 ui.label(egui::RichText::new(e.as_str()).color(t.danger).size(11.0));
@@ -1453,7 +1460,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
             let sp = ERect::from_min_size(pv_area.right_bottom() - vec2(26.0, 26.0), vec2(18.0, 18.0));
             ui.put(sp, egui::Spinner::new().size(16.0));
         }
-        let presp = ui.interact(pv_area, egui::Id::new("caf-preview-view"), Sense::click_and_drag());
+        let presp = ui.interact(pv_area, egui::Id::unique("caf-preview-view"), Sense::click_and_drag());
         if presp.dragged() {
             let d = presp.drag_delta();
             w.preview.center = [w.preview.center[0] - f64::from(d.x / pv.zoom), w.preview.center[1] - f64::from(d.y / pv.zoom)];
@@ -1467,11 +1474,11 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         let zrow = ERect::from_min_size(pos2(pv_rect.left() + 10.0, pv_rect.bottom() - 38.0), vec2(PREVIEW_W - 20.0, 30.0));
         let mut zr = ui.new_child(egui::UiBuilder::new().max_rect(zrow).layout(egui::Layout::left_to_right(egui::Align::Center)));
         let mut pct = (w.preview.zoom * 100.0).round();
-        if widgets::value_field(&mut zr, &mut pct, 1.0..=3200.0, "%", 64.0).changed() {
+        if widgets::value_field(&mut zr, &mut pct, 1.0..=3200.0, "%", 64.0).accessible_name(tl!("Zoom")).changed() {
             w.preview.zoom = pct / 100.0;
         }
         let mut lz = pct.max(1.0).ln();
-        if zr.add(egui::Slider::new(&mut lz, 0.0..=3200f32.ln()).show_value(false)).changed() {
+        if zr.add(egui::Slider::new(&mut lz, 0.0..=3200f32.ln()).show_value(false)).accessible_name(tl!("Zoom")).changed() {
             w.preview.zoom = lz.exp() / 100.0;
         }
         // The document view.
@@ -1481,7 +1488,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         if w.zoom <= 0.0 {
             w.zoom = ((area.width() - 40.0) / cw).min((area.height() - 40.0) / chh).clamp(0.01, 4.0);
         }
-        let resp = ui.interact(area, egui::Id::new("caf-view"), Sense::click_and_drag());
+        let resp = ui.interact(area, egui::Id::unique("caf-view"), Sense::click_and_drag());
         if resp.hovered() {
             let scroll = ui.input(|i| i.smooth_scroll_delta.y);
             if scroll != 0.0
diff --git a/crates/ui-egui/src/camera_raw_gpu.rs b/crates/ui-egui/src/camera_raw_gpu.rs
new file mode 100644
index 0000000000..5e9f8719fa
--- /dev/null
+++ b/crates/ui-egui/src/camera_raw_gpu.rs
@@ -0,0 +1,294 @@
+//! Camera Raw's preview develop on the GPU (#6916). When every stage the settings use reads
+//! only its own pixel, the proxy develops in one wgpu pass (`photocraft_gpu::CameraRawDevelop`)
+//! on the canvas's device and is read back for the histogram, scopes and display conversion.
+//! Spatial stages, Rendering Mode CPU, `PHOTOCRAFT_CPU_CAMERA_RAW`, no GPU canvas, a software
+//! adapter, a device fault or a failed develop all keep the CPU develop on the worker.
+//!
+//! The pipeline builds on a thread the first time a dialog opens (DX12's shader compiler takes
+//! about 0.35 s, #6419); frames develop on the CPU until it is ready.
+
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
+use std::sync::{Arc, Mutex, OnceLock};
+
+use eframe::wgpu;
+use photocraft_algo::camera_raw::CameraRaw;
+use photocraft_gpu::{CameraRawDevelop, DeviceHealth};
+
+use crate::PhotocraftApp;
+
+/// The built pass, shared by every Camera Raw dialog on the device (never built on the web).
+#[derive(Clone)]
+#[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+pub(crate) struct Pass(Arc<Mutex<CameraRawDevelop>>);
+
+/// A device's pass: unset while it builds, `None` when the device can't run it.
+pub(crate) type Slot = Arc<OnceLock<Option<Pass>>>;
+
+impl Pass {
+    /// Whether `adapter` may run the pass: not a software adapter (the CPU develop is faster
+    /// there), one that renders `Rgba32Float`, and not on the web (no blocking readback yet).
+    fn usable(adapter: &wgpu::Adapter) -> bool {
+        if cfg!(target_arch = "wasm32") {
+            return false;
+        }
+        if adapter.get_info().device_type == wgpu::DeviceType::Cpu {
+            log::info!("Camera Raw develops on the CPU: software graphics adapter");
+            return false;
+        }
+        if !CameraRawDevelop::supported(adapter) {
+            log::info!("Camera Raw develops on the CPU: the adapter can't render Rgba32Float");
+            return false;
+        }
+        true
+    }
+
+    /// Builds the pass into `slot`, on a thread where there are threads.
+    pub(crate) fn start(adapter: &wgpu::Adapter, device: &wgpu::Device, slot: &Slot) {
+        if !Self::usable(adapter) {
+            let _ = (slot.set(None), device);
+            return;
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let (on, out) = (device.clone(), slot.clone());
+            let spawned = std::thread::Builder::new().name("camera-raw-pipeline".into()).spawn(move || {
+                let pass = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| Self::build_on(&on))).unwrap_or_else(|_| {
+                    log::warn!("building the Camera Raw pipeline panicked; Camera Raw develops on the CPU");
+                    None
+                });
+                let _ = out.set(pass);
+            });
+            if spawned.is_err() {
+                let _ = slot.set(Self::build_on(device));
+            }
+        }
+    }
+
+    /// The pass on `device`, whatever its adapter.
+    #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+    pub(crate) fn build_on(device: &wgpu::Device) -> Option<Self> {
+        match CameraRawDevelop::new(device) {
+            Ok(pass) => Some(Pass(Arc::new(Mutex::new(pass)))),
+            Err(e) => {
+                log::warn!("{e}; Camera Raw develops on the CPU");
+                None
+            }
+        }
+    }
+}
+
+/// The dialog's GPU develop, if the app may use one.
+pub(crate) fn for_app(app: &PhotocraftApp) -> Option<CameraRawGpu> {
+    let cpu = app.session.prefs().performance.effective_rendering_mode() == photocraft_engine::prefs::RenderingMode::Cpu;
+    if cpu || std::env::var_os("PHOTOCRAFT_CPU_CAMERA_RAW").is_some() {
+        return None;
+    }
+    app.gpu.as_ref()?.camera_raw()
+}
+
+/// A key for a dialog's proxy pixels, unique in the process: the pass keeps the last source it
+/// uploaded, and a new dialog's proxy may reuse a closed one's memory.
+pub(crate) fn source_key() -> u64 {
+    static NEXT: AtomicU64 = AtomicU64::new(1);
+    NEXT.fetch_add(1, Ordering::Relaxed)
+}
+
+/// The source key and the settings the black and white points depend on.
+type PointsKey = (u64, [u32; 5]);
+/// The last [`PointsKey`] and its points.
+type Points = Option<(PointsKey, Option<(f32, f32)>)>;
+
+/// One dialog's handle on the pass (cheap to clone into each proxy job).
+#[derive(Clone)]
+#[cfg_attr(target_arch = "wasm32", allow(dead_code))]
+pub(crate) struct CameraRawGpu {
+    device: wgpu::Device,
+    queue: wgpu::Queue,
+    health: DeviceHealth,
+    pass: Slot,
+    /// Set after a develop failed: the dialog stays on the CPU.
+    failed: Arc<AtomicBool>,
+    /// Whites and Blacks adapt to the image; its points change only with these settings.
+    points: Arc<Mutex<Points>>,
+}
+
+impl CameraRawGpu {
+    pub(crate) fn new(device: wgpu::Device, queue: wgpu::Queue, health: DeviceHealth, pass: Slot) -> Self {
+        CameraRawGpu { device, queue, health, pass, failed: Arc::default(), points: Arc::default() }
+    }
+
+    /// Develops `px` (`w × h`) with `p`, or `None` when the CPU must: a spatial stage, the pass
+    /// still building, a fault, or a GPU error (logged; the dialog then stays on the CPU). `key` names the pixels when they
+    /// are the dialog's unchanged proxy ([`source_key`]), so they upload once. Neutral settings
+    /// are `None` too: the CPU develop returns them at once, a GPU round trip would only cost.
+    pub(crate) fn develop(&self, px: &[[f32; 4]], key: Option<u64>, w: usize, h: usize, p: &CameraRaw, float: bool) -> Option<Vec<[f32; 4]>> {
+        if p.spatial() || p.is_identity() || self.failed.load(Ordering::Relaxed) || !self.health.is_ok() {
+            return None;
+        }
+        #[cfg(target_arch = "wasm32")]
+        {
+            let _ = (px, key, w, h, float);
+            None
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let Some(Some(pass)) = self.pass.get() else { return None };
+            let points = self.points(px, key, w, h, p);
+            let stages = photocraft_algo::camera_raw::per_pixel(p, w, h, float, points)?;
+            let size = [u32::try_from(w).ok()?, u32::try_from(h).ok()?];
+            let mut pass = pass.0.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            match pass.develop(&self.device, &self.queue, Some(&self.health), px, key, size, &stages) {
+                Ok(out) => Some(out),
+                Err(e) => {
+                    log::warn!("{}; Camera Raw develops on the CPU", e.0);
+                    self.failed.store(true, Ordering::Relaxed);
+                    None
+                }
+            }
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn points(&self, px: &[[f32; 4]], key: Option<u64>, w: usize, h: usize, p: &CameraRaw) -> Option<(f32, f32)> {
+        if p.whites == 0.0 && p.blacks == 0.0 {
+            return None;
+        }
+        let Some(key) = key else { return photocraft_algo::camera_raw::white_black_points(px, w, h, p) };
+        let key = (key, [p.temperature, p.tint, p.exposure, p.contrast, p.encoding_gamma].map(f32::to_bits));
+        let mut cache = self.points.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+        if let Some((k, points)) = *cache
+            && k == key
+        {
+            return points;
+        }
+        let points = photocraft_algo::camera_raw::white_black_points(px, w, h, p);
+        *cache = Some((key, points));
+        points
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use photocraft_algo::camera_raw::develop;
+    use serde_json::json;
+
+    /// The pass evaluates develop's expressions in f32 (see `photocraft-gpu`'s Camera Raw tests).
+    const TOL: f32 = 1.0 / 4096.0;
+
+    /// The app on egui_kittest's device (a software adapter where there is one), or `None`.
+    fn gpu_app(depth: u32) -> Option<(PhotocraftApp, egui::Context)> {
+        let Ok(rs) = std::panic::catch_unwind(|| egui_kittest::wgpu::create_render_state(crate::gpu_canvas::wgpu_setup(), Default::default())) else {
+            eprintln!("skipping: no GPU adapter");
+            return None;
+        };
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+        app.set_wgpu(rs);
+        app.gpu.as_ref()?;
+        app.run("file.new", json!({"width": 300, "height": 200, "depth": depth})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("filter.render.clouds", json!({"seed": 5})).unwrap();
+        app.run("select.rect", json!({"x": 40, "y": 30, "width": 120, "height": 90})).unwrap();
+        app.run("edit.fill", json!({"color": "#cc4422"})).unwrap();
+        app.run("select.deselect", json!({})).unwrap();
+        Some((app, egui::Context::default()))
+    }
+
+    /// The canvas's pass, built even on a software adapter (which the app leaves on the CPU).
+    fn force_pass(app: &PhotocraftApp) {
+        app.gpu.as_ref().expect("GPU canvas").force_camera_raw_pass();
+    }
+
+    fn developed(app: &mut PhotocraftApp, ctx: &egui::Context, p: CameraRaw) -> (&'static str, Vec<[f32; 4]>, Vec<[f32; 4]>) {
+        let d = app.camera_raw.as_mut().expect("dialog");
+        d.params = p;
+        d.render(ctx);
+        let mut cpu = d.proxy.to_vec();
+        let mut q = d.params.clone();
+        q.pixel_scale = (d.pw as f32 / d.full_w.max(1) as f32).min(1.0);
+        develop(&mut cpu, d.pw, d.ph, &q, d.float);
+        (d.develop_backend, d.processed.clone(), cpu)
+    }
+
+    #[test]
+    fn the_pass_is_built_when_camera_raw_first_opens_not_with_the_canvas() {
+        let _gpu = photocraft_testkit::gpu_lock();
+        let Some((mut app, ctx)) = gpu_app(8) else { return };
+        let canvas = app.gpu.clone().expect("GPU canvas");
+        assert!(!canvas.camera_raw_started(), "no Camera Raw pipeline at launch (#6419)");
+        crate::camera_raw_ui::open(&mut app, &ctx).unwrap();
+        assert!(canvas.camera_raw_started(), "built (or refused) from the first open");
+        assert_eq!(app.camera_raw.as_ref().map(|d| d.develop_backend), Some("cpu"), "the first frame doesn't wait for the pipeline");
+        canvas.wait_camera_raw_pass();
+        let software = canvas.adapter_info().device_type == wgpu::DeviceType::Cpu;
+        let d = app.camera_raw.as_ref().expect("dialog");
+        assert_eq!(d.gpu.is_none(), software, "a software adapter keeps the CPU develop");
+    }
+
+    #[test]
+    fn per_pixel_settings_develop_on_the_gpu_like_the_cpu_and_the_rest_stays_on_the_cpu() {
+        let _gpu = photocraft_testkit::gpu_lock();
+        for depth in [8, 16, 32] {
+            let Some((mut app, ctx)) = gpu_app(depth) else { return };
+            force_pass(&app);
+            crate::camera_raw_ui::open(&mut app, &ctx).unwrap();
+            if app.camera_raw.as_ref().is_some_and(|d| d.gpu.is_none()) {
+                eprintln!("skipping: the device can't run the Camera Raw pass");
+                return;
+            }
+            let per_pixel = CameraRaw {
+                temperature: 20.0,
+                exposure: 0.4,
+                contrast: 30.0,
+                whites: 25.0,
+                blacks: -20.0,
+                vibrance: 40.0,
+                curve_lights: 25.0,
+                grade_shadows: photocraft_algo::camera_raw::Wheel { hue: 220.0, sat: 40.0, lum: 0.0 },
+                vignette_amount: -40.0,
+                grain_amount: 30.0,
+                ..Default::default()
+            };
+            let (backend, gpu, cpu) = developed(&mut app, &ctx, per_pixel.clone());
+            assert_eq!(backend, "gpu", "{depth}-bit");
+            let worst = gpu.iter().zip(&cpu).flat_map(|(a, b)| (0..4).map(move |c| (a[c] - b[c]).abs())).fold(0.0f32, f32::max);
+            assert!(worst <= TOL, "{depth}-bit: off by {worst}");
+            let described = app.camera_raw.as_ref().map(|d| d.describe(&app.ui.camera_raw_scope, &app.ui.camera_raw_preview)).unwrap();
+            assert_eq!(described["developBackend"], "gpu");
+            // A spatial stage develops the whole frame on the CPU.
+            let (backend, shown, cpu) = developed(&mut app, &ctx, CameraRaw { shadows: 40.0, ..per_pixel.clone() });
+            assert_eq!((backend, shown == cpu), ("cpu", true), "{depth}-bit");
+            // A device fault: the CPU, from the next frame on.
+            app.gpu.as_ref().unwrap().health().mark(photocraft_gpu::Fault::Lost("test".into()));
+            let (backend, shown, cpu) = developed(&mut app, &ctx, per_pixel);
+            assert_eq!((backend, shown == cpu), ("cpu", true), "{depth}-bit after a fault");
+        }
+    }
+
+    #[test]
+    fn neutral_settings_skip_the_gpu_round_trip() {
+        let _gpu = photocraft_testkit::gpu_lock();
+        let Some((mut app, ctx)) = gpu_app(8) else { return };
+        force_pass(&app);
+        crate::camera_raw_ui::open(&mut app, &ctx).unwrap();
+        if app.camera_raw.as_ref().is_some_and(|d| d.gpu.is_none()) {
+            eprintln!("skipping: the device can't run the Camera Raw pass");
+            return;
+        }
+        let (backend, _, _) = developed(&mut app, &ctx, CameraRaw { exposure: 0.5, ..Default::default() });
+        assert_eq!(backend, "gpu", "a per-pixel setting develops on the GPU");
+        let (backend, shown, cpu) = developed(&mut app, &ctx, CameraRaw::default());
+        assert_eq!((backend, shown == cpu), ("cpu", true), "default settings: the CPU returns them unchanged");
+    }
+
+    #[test]
+    fn rendering_mode_cpu_keeps_the_cpu_develop() {
+        let _gpu = photocraft_testkit::gpu_lock();
+        let Some((mut app, ctx)) = gpu_app(8) else { return };
+        force_pass(&app);
+        app.run("prefs.set", json!({"path": "performance.renderingMode", "value": "cpu"})).unwrap();
+        crate::camera_raw_ui::open(&mut app, &ctx).unwrap();
+        let (backend, shown, cpu) = developed(&mut app, &ctx, CameraRaw { exposure: 0.5, ..Default::default() });
+        assert_eq!((backend, shown == cpu), ("cpu", true));
+    }
+}
diff --git a/crates/ui-egui/src/camera_raw_identity_tests.rs b/crates/ui-egui/src/camera_raw_identity_tests.rs
index 17c4967ba6..a66e172158 100644
--- a/crates/ui-egui/src/camera_raw_identity_tests.rs
+++ b/crates/ui-egui/src/camera_raw_identity_tests.rs
@@ -2,7 +2,9 @@
 
 use std::sync::Arc;
 
-use super::*;
+use serde_json::{Value, json};
+
+use super::{CameraRaw, PhotocraftApp, RawOpen, commit_open_raw, finish_redevelop, queue_open_dialog, replace_raw_document};
 
 fn synthetic_raw() -> Vec<u8> {
     use photocraft_raw::testgen::{DngSpec, mosaic, scene};
@@ -63,14 +65,14 @@ fn identity_app() -> (PhotocraftApp, RawOpen, Control) {
 fn completed_redevelop(app: &mut PhotocraftApp, raw: &RawOpen) -> (CameraRaw, Value, photocraft_doc::DocId) {
     app.background_jobs = true;
     let params = CameraRaw { exposure: 1.0, contrast: 20.0, ..Default::default() };
-    let started = commit_open_raw(app, &params, raw).unwrap();
+    let started = commit_open_raw(app, &params, raw, None).unwrap();
     let job = photocraft_engine::jobs::JobId(started["job"].as_u64().expect("the sensor re-develop runs as a real job"));
     let mut result = app.session.wait_job(job).unwrap();
     let replacement = app.session.documents()[result["document"].as_u64().unwrap() as usize].doc.id;
     // The producer has a separate contract test. Supply the observed identity here to isolate
     // the UI consumer's handling even when run against the old result schema.
     result["docId"] = json!(replacement.0);
-    app.raw_redevelop = None;
+    app.raw_redevelop.clear();
     app.background_jobs = false;
     (params, result, replacement)
 }
@@ -96,7 +98,7 @@ fn completion_identity_applies_remaining_settings_after_tab_reordering() {
     let index = result["document"].as_u64().unwrap() as usize;
     app.session.move_document(index, 0).unwrap();
     assert_eq!(app.session.documents()[index].doc.id, control.doc.id, "another completion may move this tab before the RAW callback");
-    finish_redevelop(&mut app, &params, &raw, &result).unwrap();
+    finish_redevelop(&mut app, &params, &raw, &result, &Default::default()).unwrap();
     control.assert_untouched(&app);
     let state = app.session.active().unwrap();
     assert_eq!(state.doc.id, replacement);
@@ -113,7 +115,7 @@ fn completion_identity_rejects_a_closed_replacement_without_filtering_the_active
     let index = app.session.documents().iter().position(|state| state.doc.id == replacement).unwrap();
     app.session.close(index).unwrap();
     assert_eq!(app.session.active().unwrap().doc.id, control.doc.id);
-    assert!(finish_redevelop(&mut app, &params, &raw, &result).is_err(), "a closed replacement must not fall back to the active document");
+    assert!(finish_redevelop(&mut app, &params, &raw, &result, &Default::default()).is_err(), "a closed replacement must not fall back to the active document");
     control.assert_untouched(&app);
     assert_eq!(app.session.documents().len(), 1);
 }
@@ -133,7 +135,7 @@ fn completion_identity_rejects_missing_and_invalid_ids_before_any_side_effect()
         app.session.set_active(0);
         let views = app.view_docs.clone();
         let notices = app.ui.notices.len();
-        assert!(finish_redevelop(&mut app, &params, &raw, &result).is_err(), "invalid identity was accepted: {result}");
+        assert!(finish_redevelop(&mut app, &params, &raw, &result, &Default::default()).is_err(), "invalid identity was accepted: {result}");
         control.assert_untouched(&app);
         assert_eq!(app.session.active().unwrap().doc.id, control.doc.id);
         assert_eq!(app.view_docs, views, "identity validation precedes view remapping");
diff --git a/crates/ui-egui/src/camera_raw_preview_ui.rs b/crates/ui-egui/src/camera_raw_preview_ui.rs
index e2d15f9e0c..dff92fd50e 100644
--- a/crates/ui-egui/src/camera_raw_preview_ui.rs
+++ b/crates/ui-egui/src/camera_raw_preview_ui.rs
@@ -98,9 +98,16 @@ struct ZoomCapture {
 
 /// One capture shared with the colour sampler. Space/middle drag always pans; S takes
 /// precedence over the persistent Zoom/Hand tool, so a sampler click never zooms.
-pub(crate) fn interact(ui: &mut Ui, state: &mut CameraRawPreviewState, viewport: Rect, size: Vec2, sampler: &mut bool) -> (Rect, Response, bool, Option<Rect>) {
+pub(crate) fn interact(
+    ui: &mut Ui,
+    state: &mut CameraRawPreviewState,
+    viewport: Rect,
+    size: Vec2,
+    sampler: &mut bool,
+    animated_zoom: bool,
+) -> (Rect, Response, bool, Option<Rect>) {
     let sampling = *sampler;
-    let response = ui.interact(viewport, ui.id().with("cr-sample-preview"), Sense::click_and_drag());
+    let response = ui.interact(viewport, ui.scope_id().with("cr-sample-preview"), Sense::click_and_drag());
     let modifiers = ui.input(|i| i.modifiers);
     let temporary_zoom = modifiers.command && (state.hand || sampling);
     let hand = !temporary_zoom && (state.hand && !sampling || ui.input(|i| i.key_down(Key::Space)));
@@ -111,11 +118,18 @@ pub(crate) fn interact(ui: &mut Ui, state: &mut CameraRawPreviewState, viewport:
     // Reuse the canvas wheel policy: retain the modifiers of the wheel event while egui
     // smooths it, even if Alt is released before the final part of the notch arrives.
     let cr_hovered = response.hovered();
-    let wheel = crate::wheel_nav::read(ui.ctx(), false, true, ui.id().with("cr-wheel"), cr_hovered);
+    let cr_wheel = ui.scope_id().with("cr-wheel");
+    let wheel = crate::wheel_nav::read(ui.ctx(), false, true, animated_zoom, cr_wheel, cr_hovered);
     if cr_hovered {
         ui.input_mut(|i| i.smooth_scroll_delta = Vec2::ZERO);
         match wheel {
-            Some(crate::wheel_nav::Wheel::Zoom(factor)) => state.zoom_at(state.scale(viewport, size) * factor, at, viewport, size),
+            Some(crate::wheel_nav::Wheel::Zoom(factor)) => {
+                let zoom = state.scale(viewport, size) * factor;
+                if zoom != zoom.clamp(MIN_ZOOM, MAX_ZOOM) {
+                    crate::wheel_nav::settle(ui.ctx(), cr_wheel);
+                }
+                state.zoom_at(zoom, at, viewport, size);
+            }
             Some(crate::wheel_nav::Wheel::SnapZoom(n)) => {
                 let dir = if n > 0 { 1 } else { -1 };
                 let mut nz = state.scale(viewport, size);
@@ -236,7 +250,7 @@ pub(crate) fn interact(ui: &mut Ui, state: &mut CameraRawPreviewState, viewport:
 
 pub(crate) fn toolbar(ui: &mut Ui, state: &mut CameraRawPreviewState, viewport: Rect, size: Vec2, sampler: &mut bool) {
     let zoom_tool = crate::icons::button(ui, "zoom-in", 28.0, !state.hand && !*sampler, tl!("Zoom Tool"));
-    zoom_tool.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), tl!("Zoom Tool")));
+    zoom_tool.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tl!("Zoom Tool")));
     if zoom_tool.double_clicked() {
         state.fit();
     }
@@ -245,7 +259,7 @@ pub(crate) fn toolbar(ui: &mut Ui, state: &mut CameraRawPreviewState, viewport:
         *sampler = false;
     }
     let hand_tool = crate::icons::button(ui, "hand", 28.0, state.hand && !*sampler, tl!("Hand Tool"));
-    hand_tool.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), tl!("Hand Tool")));
+    hand_tool.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tl!("Hand Tool")));
     if hand_tool.double_clicked() {
         state.fit();
     }
@@ -269,7 +283,7 @@ pub(crate) fn toolbar(ui: &mut Ui, state: &mut CameraRawPreviewState, viewport:
     if !options.iter().any(|(z, _)| *z == zoom) {
         options.push((zoom, &current_label));
     }
-    if widgets::dropdown(ui, "cr-preview-zoom", &mut zoom, &options, 80.0) {
+    if widgets::dropdown(ui, "cr-preview-zoom", tl!("Zoom"), &mut zoom, &options, 80.0) {
         match zoom {
             Some(z) => state.zoom_at(z, viewport.center(), viewport, size),
             None => state.fit(),
diff --git a/crates/ui-egui/src/camera_raw_scope_ui.rs b/crates/ui-egui/src/camera_raw_scope_ui.rs
index 4e93b72df9..daf0a4855f 100644
--- a/crates/ui-egui/src/camera_raw_scope_ui.rs
+++ b/crates/ui-egui/src/camera_raw_scope_ui.rs
@@ -344,8 +344,8 @@ fn readout_text(value: Option<Value>) -> String {
 
 fn warning(ui: &mut egui::Ui, rect: Rect, mask: u8, on: &mut bool, label: &str) {
     let t = Tokens::get(ui.ctx());
-    let response = ui.interact(rect, ui.id().with(label), Sense::click()).on_hover_text(label);
-    response.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, ui.is_enabled(), *on, label));
+    let response = ui.interact(rect, ui.scope_id().with(label), Sense::click()).on_hover_text(label);
+    response.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, ui.is_enabled(), *on, label));
     let r = rect.shrink(3.0);
     ui.painter().add(egui::Shape::convex_polygon(
         vec![pos2(r.center().x, r.top()), r.left_bottom(), r.right_bottom()],
@@ -381,7 +381,7 @@ fn graph(ui: &mut egui::Ui, d: &mut CameraRawDialog, view: &mut CameraRawScopeSt
     let t = Tokens::get(ui.ctx());
     let (rect, response) = ui.allocate_exact_size(vec2(ui.available_width().max(1.0), height), Sense::click_and_drag());
     d.scope.rect = Some(rect);
-    response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Other, ui.is_enabled(), tl!("Tone Histogram")));
+    response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Unknown, ui.is_enabled(), tl!("Tone Histogram")));
     ui.painter().rect_filled(rect, t.radius_sm, t.histogram_background());
     let plot = rect.shrink(4.0);
     // Camera Raw's scale: the typical columns set it and a shadow or highlight spike runs off the top.
@@ -525,7 +525,7 @@ pub(crate) fn floating(ctx: &egui::Context, d: &mut CameraRawDialog, view: &mut
         r[1].clamp(content.top(), (content.bottom() - 150.0).max(content.top())),
     );
     let window = egui::Window::new("")
-        .id(egui::Id::new("cr-floating-scope"))
+        .id(egui::Id::unique("cr-floating-scope"))
         .order(egui::Order::Foreground)
         .collapsible(false)
         .resizable(true)
diff --git a/crates/ui-egui/src/camera_raw_ui.rs b/crates/ui-egui/src/camera_raw_ui.rs
index f78d467b7c..1ff5fb4bd1 100644
--- a/crates/ui-egui/src/camera_raw_ui.rs
+++ b/crates/ui-egui/src/camera_raw_ui.rs
@@ -4,8 +4,10 @@
 //! The preview runs [`photocraft_algo::camera_raw::develop`] on a CPU proxy of the layer
 //! (≤ 900 px, `pixel_scale` keeps pixel radii true to the full image), recomputed when a
 //! control changes: on a worker for the dialog's own controls, so a drag never waits for it, and
-//! on the UI thread for the control channel, so a reply describes its own settings. OK runs `filter.cameraRaw` with the non-default settings, so the result is
-//! one history step (or a smart filter on a smart object) and exactly replayable.
+//! on the UI thread for the control channel, so a reply describes its own settings. Settings
+//! whose stages are all per pixel develop on the GPU instead where it can (`camera_raw_gpu`).
+//! OK runs `filter.cameraRaw` with the non-default settings, so the result is one history step
+//! (or a smart filter on a smart object) and exactly replayable.
 //!
 //! Control channel: `ui.menu.invoke {"id":"filter.cameraRaw","params":{"ui":{"set":{…},
 //! "commit":true | "cancel":true}}}`; the reply describes the dialog. `{"ui":{"saveSettings":true}}`
@@ -47,7 +49,7 @@ pub struct CameraRawDialog {
     pub(crate) selection: Option<std::sync::Arc<Vec<f32>>>,
     pub(crate) pw: usize,
     pub(crate) ph: usize,
-    full_w: usize,
+    pub(crate) full_w: usize,
     full_h: usize,
     preview_ppp: f32,
     pub(crate) detail: super::camera_raw_detail_ui::DetailPreview,
@@ -78,6 +80,13 @@ pub struct CameraRawDialog {
     pending: Option<std::sync::mpsc::Receiver<Result<ProxyFrame, String>>>,
     /// The last worker failure the status bar shows, with the preview revision it failed on.
     preview_error: Option<(String, u64)>,
+    /// The GPU develop, when the app may use one.
+    pub(crate) gpu: Option<crate::camera_raw_gpu::CameraRawGpu>,
+    /// Names [`Self::proxy`] for the GPU pass's upload cache.
+    source_key: u64,
+    /// The last frame's develop alone, and where it ran ("gpu" or "cpu").
+    develop_ms: f64,
+    pub(crate) develop_backend: &'static str,
     /// Settings before each finished edit, so Ctrl+Z works inside the dialog (#4100).
     undo: Vec<CameraRaw>,
     redo: Vec<CameraRaw>,
@@ -89,7 +98,7 @@ impl CameraRawDialog {
     pub fn describe(&self, view: &crate::state::CameraRawScopeState, navigation: &crate::state::CameraRawPreviewState) -> Value {
         let h = self.histogram();
         let mut result = json!({"layer": self.layer.0, "params": serde_json::to_value(&self.params).unwrap_or(Value::Null), "proxy": [self.pw, self.ph],
-            "renderMs": self.render_ms, "histogramMs": self.histogram_ms, "previewRevision": self.preview_revision, "before": self.show_before,
+            "renderMs": self.render_ms, "developMs": self.develop_ms, "developBackend": self.develop_backend, "histogramMs": self.histogram_ms, "previewRevision": self.preview_revision, "before": self.show_before,
             "histogram": {"source": if self.show_before { "before" } else { "after" }, "approximate": true, "size": [self.pw, self.ph],
                 "sampleDomain": "preview-rgb", "range": [0, 1], "red": h.channels[0].as_slice(), "green": h.channels[1].as_slice(), "blue": h.channels[2].as_slice(),
                 "samples": h.samples, "transparent": h.transparent, "invalid": h.invalid, "underflow": h.underflow, "overflow": h.overflow, "shadows": h.shadows, "highlights": h.highlights}});
@@ -170,6 +179,8 @@ impl CameraRawDialog {
             size: (self.pw, self.ph),
             full_w: self.full_w,
             display: self.display.clone(),
+            gpu: self.gpu.clone(),
+            source_key: self.source_key,
         }
     }
 
@@ -191,6 +202,8 @@ impl CameraRawDialog {
         self.processed = frame.px;
         self.scope.cache = None;
         self.render_ms = frame.ms;
+        self.develop_ms = frame.develop_ms;
+        self.develop_backend = frame.backend;
         self.preview_revision = self.preview_revision.saturating_add(1);
     }
 
@@ -270,6 +283,8 @@ struct ProxyJob {
     size: (usize, usize),
     full_w: usize,
     display: std::sync::Arc<photocraft_engine::display_color::CanvasDisplay>,
+    gpu: Option<crate::camera_raw_gpu::CameraRawGpu>,
+    source_key: u64,
 }
 
 /// A developed proxy, ready to show.
@@ -280,21 +295,38 @@ struct ProxyFrame {
     image: egui::ColorImage,
     display: std::sync::Arc<photocraft_engine::display_color::CanvasDisplay>,
     ms: f64,
+    develop_ms: f64,
+    backend: &'static str,
 }
 
 impl ProxyJob {
     fn run(self) -> ProxyFrame {
         let t0 = crate::gpu_canvas::now_ms();
         let (pw, ph) = self.size;
-        let mut px = self.proxy.to_vec();
         let mut p = self.params;
         p.pixel_scale = (pw as f32 / self.full_w.max(1) as f32).min(1.0);
-        if let Some(curve) = &self.raw_curve {
-            let tone = raw_stage(&p);
-            photocraft_io::raw::retone(&mut px, pw, ph, curve, tone);
+        // The open-time dialog re-tones the proxy for each job; otherwise the GPU reads the
+        // proxy as it is and uploads it once.
+        let retoned = self.raw_curve.as_ref().map(|curve| {
+            let mut px = self.proxy.to_vec();
+            photocraft_io::raw::retone(&mut px, pw, ph, curve, raw_stage(&p));
+            px
+        });
+        if retoned.is_some() {
             (p.shadows, p.highlights, p.clarity, p.texture, p.dehaze) = (0.0, 0.0, 0.0, 0.0, 0.0);
         }
-        photocraft_algo::camera_raw::develop(&mut px, pw, ph, &p, self.float);
+        let develop_start = crate::gpu_canvas::now_ms();
+        let key = retoned.is_none().then_some(self.source_key);
+        let input = retoned.as_deref().unwrap_or(&self.proxy);
+        let (mut px, backend) = match self.gpu.as_ref().and_then(|g| g.develop(input, key, pw, ph, &p, self.float)) {
+            Some(out) => (out, "gpu"),
+            None => {
+                let mut px = retoned.unwrap_or_else(|| self.proxy.to_vec());
+                photocraft_algo::camera_raw::develop(&mut px, pw, ph, &p, self.float);
+                (px, "cpu")
+            }
+        };
+        let develop_ms = crate::gpu_canvas::now_ms() - develop_start;
         if let Some(mask) = &self.selection {
             let blend = |(out, (original, coverage)): (&mut [f32; 4], (&[f32; 4], &f32))| {
                 for (out, original) in out.iter_mut().zip(original) {
@@ -314,7 +346,7 @@ impl ProxyJob {
         let histogram = RgbHistogram::from_rgba(&px);
         let histogram_ms = crate::gpu_canvas::now_ms() - histogram_start;
         let image = CameraRawDialog::image(&px, pw, ph, &self.display);
-        ProxyFrame { px, histogram, histogram_ms, image, display: self.display, ms: crate::gpu_canvas::now_ms() - t0 }
+        ProxyFrame { px, histogram, histogram_ms, image, display: self.display, ms: crate::gpu_canvas::now_ms() - t0, develop_ms, backend }
     }
 }
 
@@ -393,7 +425,32 @@ fn open_raw(app: &mut PhotocraftApp, ctx: &egui::Context, raw: RawOpen) -> Resul
     let index = document_index(app, raw.document).ok_or("the raw document was closed")?;
     app.session.set_active(index);
     let (layer, surf, _) = crate::distort_ui::active_pixels(app)?;
-    open_pixels(app, ctx, layer, surf, CameraRaw::default(), Coverage::None, Target::OpenRaw)?;
+    // The file's sidecar (`IMG_0001.xmp` beside it) fills the dialog, as Camera Raw's does; the
+    // status bar names what it could not apply.
+    let mut params = CameraRaw::default();
+    let mut from_sidecar = false;
+    if let Some((loaded, report, file)) = raw.path.as_deref().and_then(read_sidecar) {
+        params = loaded;
+        from_sidecar = true;
+        app.ui.status = if report.ignored.is_empty() {
+            crate::i18n::fmt(tl!("Settings from {name}"), &[("name", &file)])
+        } else {
+            crate::i18n::fmt(
+                tl!("Settings from {name}; {count} not supported: {names}"),
+                &[("name", &file), ("count", &report.ignored.len().to_string()), ("names", &report.ignored.join(", "))],
+            )
+        };
+        app.ui.status_error = false;
+    }
+    open_pixels(app, ctx, layer, surf, params, Coverage::None, Target::OpenRaw)?;
+    // Camera Raw Defaults › Apply auto tone: a file without its own settings opens with Auto.
+    if !from_sidecar
+        && app.session.prefs().raw_defaults.apply_auto_tone
+        && let Some(d) = app.camera_raw.as_mut()
+    {
+        photocraft_algo::camera_raw::auto_tone(&d.proxy, &mut d.params);
+        d.dirty = true;
+    }
     let curve = match (&raw.bytes, &raw.path) {
         (Some(b), _) => Some(photocraft_io::raw::tone_curve(b)),
         #[cfg(not(target_arch = "wasm32"))]
@@ -440,8 +497,10 @@ pub struct Redevelop {
     params: CameraRaw,
     raw: RawOpen,
     /// The job is the final Camera Raw step (`filter.cameraRaw`), not the re-develop: when it
-    /// lands the document is marked unmodified.
+    /// lands the Camera Raw Defaults' conversions follow and the document is marked unmodified.
     filter_step: bool,
+    /// The Camera Raw Defaults the open started with, for the conversions after the filter step.
+    defaults: photocraft_engine::prefs::RawDefaults,
 }
 
 /// The sliders a raw open applies while developing, before the tone curve (as Camera Raw does).
@@ -455,8 +514,9 @@ fn raw_stage(p: &CameraRaw) -> photocraft_io::raw::Tone {
 /// on) it runs as a job like the open itself: the reply is `{"job", "pending": true}`, the
 /// document is locked meanwhile, and [`on_redevelop_event`] finishes when it lands. Elsewhere
 /// (tests, the web) it runs inline.
-fn commit_open_raw(app: &mut PhotocraftApp, params: &CameraRaw, raw: &RawOpen) -> Result<Value, String> {
+fn commit_open_raw(app: &mut PhotocraftApp, params: &CameraRaw, raw: &RawOpen, loaded: Option<&CameraRaw>) -> Result<Value, String> {
     let index = document_index(app, raw.document).ok_or("the raw document was closed")?;
+    write_sidecar(app, raw, params, loaded);
     let tuning = photocraft_io::raw::RawTuning {
         temperature: params.temperature,
         tint: params.tint,
@@ -478,7 +538,8 @@ fn commit_open_raw(app: &mut PhotocraftApp, params: &CameraRaw, raw: &RawOpen) -
         _ => None,
     };
     let Some(source) = source.filter(|_| tuning != as_opened) else {
-        return finish_open_raw(app, index, params.clone(), None, Some(raw));
+        let defaults = app.session.prefs().raw_defaults.clone();
+        return finish_open_raw(app, index, params.clone(), None, raw, &defaults);
     };
     app.session.set_active(index);
     let (name, doc_id) = (raw.name.clone(), raw.document);
@@ -506,9 +567,13 @@ fn commit_open_raw(app: &mut PhotocraftApp, params: &CameraRaw, raw: &RawOpen) -
         photocraft_engine::jobs::Started::Done(v)
     };
     match started {
-        photocraft_engine::jobs::Started::Done(v) => finish_redevelop(app, params, raw, &v),
+        photocraft_engine::jobs::Started::Done(v) => {
+            let defaults = app.session.prefs().raw_defaults.clone();
+            finish_redevelop(app, params, raw, &v, &defaults)
+        }
         photocraft_engine::jobs::Started::Job(job) => {
-            app.raw_redevelop = Some(Redevelop { job, params: params.clone(), raw: raw.clone(), filter_step: false });
+            let defaults = app.session.prefs().raw_defaults.clone();
+            app.raw_redevelop.push(Redevelop { job, params: params.clone(), raw: raw.clone(), filter_step: false, defaults });
             app.ui.status = label;
             app.ui.status_error = false;
             Ok(json!({"job": job.0, "pending": true}))
@@ -545,7 +610,13 @@ fn replace_raw_document(
 
 /// After the re-develop: keep the old document's view (zoom, scroll) on the new one, report
 /// the import's notes, then apply the remaining settings.
-fn finish_redevelop(app: &mut PhotocraftApp, params: &CameraRaw, raw: &RawOpen, v: &Value) -> Result<Value, String> {
+fn finish_redevelop(
+    app: &mut PhotocraftApp,
+    params: &CameraRaw,
+    raw: &RawOpen,
+    v: &Value,
+    defaults: &photocraft_engine::prefs::RawDefaults,
+) -> Result<Value, String> {
     // A preceding completion (for example Save and Close) may have shifted the tab indices.
     // Validate identity before remapping views, filtering or marking any document unmodified.
     let replacement = v.get("docId").and_then(Value::as_u64).map(photocraft_doc::DocId).ok_or("the re-develop returned no document identity")?;
@@ -567,32 +638,254 @@ fn finish_redevelop(app: &mut PhotocraftApp, params: &CameraRaw, raw: &RawOpen,
         rest.temperature = 0.0;
         rest.tint = 0.0;
     }
-    finish_open_raw(app, index, rest, Some(true), Some(raw))
+    finish_open_raw(app, index, rest, Some(true), raw, defaults)
 }
 
-/// The other settings as one Camera Raw step on document `index`, then the document is marked
-/// unmodified (developing is part of opening). The step runs like any filter (in the
-/// background in the desktop app); the document is marked unmodified when it lands.
-fn finish_open_raw(app: &mut PhotocraftApp, index: usize, rest: CameraRaw, redeveloped: Option<bool>, raw: Option<&RawOpen>) -> Result<Value, String> {
+/// The other settings as one Camera Raw step on document `index`, then the Camera Raw Defaults'
+/// conversions, then the document is marked unmodified (developing is part of opening). The
+/// step runs like any filter (in the background in the desktop app); the conversions follow and
+/// the document is marked unmodified when it lands. The step works on the developed ProPhoto
+/// pixels the dialog previewed, and the conversion to the workflow space comes last, as in
+/// Camera Raw.
+fn finish_open_raw(
+    app: &mut PhotocraftApp,
+    index: usize,
+    mut rest: CameraRaw,
+    redeveloped: Option<bool>,
+    raw: &RawOpen,
+    d: &photocraft_engine::prefs::RawDefaults,
+) -> Result<Value, String> {
     app.session.set_active(index);
     app.sync_views();
     let mut result = json!({"document": index, "redeveloped": redeveloped.unwrap_or(false)});
+    let mut applied = output_sharpening(d, &mut rest);
+    applied.extend(raw_conversions(d));
+    if !applied.is_empty() {
+        result["defaults"] = json!(applied);
+    }
     if !rest.is_identity() {
         let layer = app.session.active().and_then(|st| st.active_layer).ok_or("no layer to develop")?;
         let mut p = non_defaults(&rest);
         p["layer"] = json!(layer.0);
         let r = app.run("filter.cameraRaw", p)?;
         if r.get("pending").and_then(Value::as_bool) == Some(true)
-            && let (Some(job), Some(raw)) = (r.get("job").and_then(Value::as_u64), raw)
+            && let Some(job) = r.get("job").and_then(Value::as_u64)
         {
-            app.raw_redevelop = Some(Redevelop { job: photocraft_engine::jobs::JobId(job), params: rest.clone(), raw: raw.clone(), filter_step: true });
+            let job = photocraft_engine::jobs::JobId(job);
+            app.raw_redevelop.push(Redevelop { job, params: rest.clone(), raw: raw.clone(), filter_step: true, defaults: d.clone() });
+            result["filter"] = r;
+            mark_unmodified(app, index);
+            return Ok(result);
         }
         result["filter"] = r;
     }
+    // The Camera Raw step has landed: a failed conversion is reported, and the open still
+    // completes (a second Open would apply the step twice).
+    if let Err(e) = apply_raw_conversions(app, index, d) {
+        crate::notices::error(app, format!("{}: {e}", raw.name));
+    }
     mark_unmodified(app, index);
     Ok(result)
 }
 
+/// The sidecar beside a raw file: `IMG_0001.xmp` for `IMG_0001.CR2`, as Camera Raw names it.
+pub fn sidecar_path(path: &str) -> String {
+    match path.rsplit_once('.') {
+        Some((stem, ext)) if !ext.contains(['/', '\\']) => format!("{stem}.xmp"),
+        _ => format!("{path}.xmp"),
+    }
+}
+
+/// A DNG carries its settings inside the file in Camera Raw; a sidecar is read for one too,
+/// but never written beside it.
+fn is_dng(path: &str) -> bool {
+    path.rsplit_once('.').is_some_and(|(_, ext)| ext.eq_ignore_ascii_case("dng"))
+}
+
+/// The settings of the sidecar beside `path`, when there is one that parses: the settings, what
+/// the loader skipped, and the sidecar's file name. A sidecar that doesn't parse is ignored (the
+/// raw still opens) and reported in the log.
+#[cfg(not(target_arch = "wasm32"))]
+fn read_sidecar(path: &str) -> Option<(CameraRaw, photocraft_io::camera_raw_xmp::LoadReport, String)> {
+    let sidecar = sidecar_path(path);
+    let Some(bytes) = read_bounded(&sidecar) else {
+        log::warn!("{sidecar}: not a readable sidecar of at most {} bytes, ignored", photocraft_io::camera_raw_xmp::MAX_XMP_BYTES);
+        return None;
+    };
+    let mut params = CameraRaw::default();
+    match photocraft_io::camera_raw_xmp::load(&mut params, &bytes) {
+        Ok(report) => Some((params, report, crate::file_open::display_name(&sidecar))),
+        Err(e) => {
+            log::warn!("{sidecar}: sidecar ignored: {e}");
+            None
+        }
+    }
+}
+#[cfg(target_arch = "wasm32")]
+fn read_sidecar(_: &str) -> Option<(CameraRaw, photocraft_io::camera_raw_xmp::LoadReport, String)> {
+    None
+}
+
+/// Keep the develop settings beside the raw file (Camera Raw Defaults › Write xmp sidecars):
+/// written when the settings aren't the defaults or PhotoCraft's own sidecar is there, so a
+/// file reopens as it was developed. `loaded` are the settings the open started from: nothing
+/// is written when they didn't change. Not for DNGs, never over a sidecar another application
+/// wrote (Lightroom's and Bridge's hold crops, masks, ratings and keywords PhotoCraft can't keep),
+/// never for a control or MCP request (it has no authority to write beside the user's files), and
+/// never fatal: a folder that can't be written to is reported in a notice.
+fn write_sidecar(app: &mut PhotocraftApp, raw: &RawOpen, params: &CameraRaw, loaded: Option<&CameraRaw>) {
+    if !app.session.prefs().raw_defaults.write_xmp_sidecars || loaded == Some(params) {
+        return;
+    }
+    if app.automation_input || app.session.authorize.is_some() {
+        log::info!("{}: sidecar not written for an automation request", raw.name);
+        return;
+    }
+    let Some(path) = raw.path.as_deref().filter(|p| !is_dng(p)) else { return };
+    let sidecar = sidecar_path(path);
+    let name = crate::file_open::display_name(&sidecar);
+    match existing_sidecar_is_ours(&sidecar) {
+        Some(false) => {
+            let kept = crate::i18n::fmt(tl!("Kept {name}: written by another application"), &[("name", &name)]);
+            crate::notices::post(app, kept, Vec::new(), false, None);
+            return;
+        }
+        None if params.is_identity() => return,
+        _ => {}
+    }
+    let bytes = photocraft_io::camera_raw_xmp::save(params).into_bytes();
+    let Some(write) = app.services.write.as_mut() else { return };
+    if let Err(e) = write(&sidecar, &bytes) {
+        crate::notices::error(app, crate::i18n::fmt(tl!("Could not write {name}: {error}"), &[("name", &name), ("error", &e)]));
+    }
+}
+
+/// `None` when there is no sidecar at `sidecar`, else whether PhotoCraft wrote it. One that
+/// can't be read or is too large to be ours counts as another application's.
+#[cfg(not(target_arch = "wasm32"))]
+fn existing_sidecar_is_ours(sidecar: &str) -> Option<bool> {
+    std::fs::symlink_metadata(sidecar).ok()?;
+    Some(read_bounded(sidecar).is_some_and(|b| photocraft_io::camera_raw_xmp::is_photocraft_xmp(&b)))
+}
+
+/// The bytes of the regular file at `path` when it holds at most
+/// [`photocraft_io::camera_raw_xmp::MAX_XMP_BYTES`]; `None` for anything else (missing, a folder,
+/// a pipe or device that might never end, larger). Never reads more than the cap plus one byte.
+#[cfg(not(target_arch = "wasm32"))]
+fn read_bounded(path: &str) -> Option<Vec<u8>> {
+    use std::io::Read;
+    let cap = photocraft_io::camera_raw_xmp::MAX_XMP_BYTES;
+    // Checked before opening: opening a pipe for reading waits for a writer.
+    if !std::fs::metadata(path).ok()?.is_file() {
+        return None;
+    }
+    let file = std::fs::File::open(path).ok()?;
+    let mut bytes = Vec::new();
+    file.take(cap as u64 + 1).read_to_end(&mut bytes).ok()?;
+    (bytes.len() <= cap).then_some(bytes)
+}
+#[cfg(target_arch = "wasm32")]
+fn existing_sidecar_is_ours(_: &str) -> Option<bool> {
+    None
+}
+
+/// Camera Raw Defaults › Sharpen For: output sharpening, folded into the Camera Raw step `rest`
+/// as the workflow's Sharpen For is. Returns what it applied.
+fn output_sharpening(d: &photocraft_engine::prefs::RawDefaults, rest: &mut CameraRaw) -> Vec<&'static str> {
+    match d.sharpen_for.preset() {
+        Some((amount, radius)) if rest.sharpen_amount == 0.0 => {
+            rest.sharpen_amount = amount;
+            rest.sharpen_radius = radius;
+            vec!["sharpenFor"]
+        }
+        _ => Vec::new(),
+    }
+}
+
+/// The Camera Raw Defaults [`apply_raw_conversions`] applies. Resolution is not among them: the
+/// open itself sets it (`file_cmds::raw_defaults`), and a re-develop keeps it.
+fn raw_conversions(d: &photocraft_engine::prefs::RawDefaults) -> Vec<&'static str> {
+    use photocraft_engine::prefs::{RawColorSpace, RawDepth};
+    let mut out = Vec::new();
+    // Raws develop into ProPhoto-compatible RGB (`photocraft_io::raw`); the other spaces are a
+    // conversion.
+    if d.color_space != RawColorSpace::ProPhoto {
+        out.push("colorSpace");
+    }
+    if d.bit_depth == RawDepth::Eight {
+        out.push("bitDepth");
+    }
+    if d.open_as_smart_object {
+        out.push("openAsSmartObject");
+    }
+    out
+}
+
+/// Camera Raw Defaults (Preferences) after the Camera Raw step: the colour space and bit depth
+/// the developed document opens in, and Open as Smart Object.
+fn apply_raw_conversions(app: &mut PhotocraftApp, index: usize, d: &photocraft_engine::prefs::RawDefaults) -> Result<(), String> {
+    app.session.set_active(index);
+    for step in raw_conversions(d) {
+        let (id, params) = match step {
+            "colorSpace" => ("edit.convertToProfile", json!({"profile": d.color_space.profile_id(), "intent": "relative"})),
+            "bitDepth" => ("image.mode.bits8", json!({})),
+            _ => ("layer.smartObjects.convertToSmartObject", json!({})),
+        };
+        app.session.execute(id, params).map_err(|e| e.to_string())?;
+    }
+    Ok(())
+}
+
+/// A raw that opened without the dialog (Camera Raw Defaults › Open in Camera Raw off): its
+/// sidecar's settings develop it as the dialog's Open would, and the Camera Raw Defaults apply.
+/// `warnings` are the import's; only a developed raw qualifies.
+pub fn opened_without_dialog(app: &mut PhotocraftApp, index: usize, name: &str, path: Option<&str>, warnings: &[String]) {
+    if !warnings.iter().any(|w| w.contains(photocraft_io::raw::DEVELOPED_NOTE)) {
+        return;
+    }
+    let Some(document) = app.session.documents().get(index).map(|st| st.doc.id) else { return };
+    let method = photocraft_io::raw::developed_demosaic(warnings).unwrap_or_else(|| app.session.prefs().raw_defaults.demosaic.method());
+    let raw = RawOpen { document, name: name.to_string(), path: path.map(str::to_string), bytes: None, developed_with: method, demosaic: method };
+    let mut params = CameraRaw::default();
+    let sidecar = path.and_then(read_sidecar).map(|(loaded, _, _)| loaded);
+    if let Some(loaded) = &sidecar {
+        params = loaded.clone();
+    } else if app.session.prefs().raw_defaults.apply_auto_tone
+        && let Some(px) = app.session.active().and_then(|st| st.doc.layer(st.active_layer?)).and_then(|l| l.surface()).map(|s| sample_pixels(s, 512))
+    {
+        photocraft_algo::camera_raw::auto_tone(&px, &mut params);
+    }
+    let r = if params.is_identity() {
+        let defaults = app.session.prefs().raw_defaults.clone();
+        finish_open_raw(app, index, params, None, &raw, &defaults)
+    } else {
+        commit_open_raw(app, &params, &raw, sidecar.as_ref())
+    };
+    if let Err(e) = r {
+        app.ui.status = e;
+        app.ui.status_error = true;
+    }
+}
+
+/// Every k-th pixel of a surface's content, k chosen so the longer side has about `max_side`
+/// samples: enough for a histogram (Auto tone) without reading a whole raw.
+fn sample_pixels(surf: &photocraft_raster::Surface, max_side: usize) -> Vec<[f32; 4]> {
+    let area = surf.content_bounds();
+    let (w, h) = (area.x1.saturating_sub(area.x0).max(0) as usize, area.y1.saturating_sub(area.y0).max(0) as usize);
+    if w == 0 || h == 0 {
+        return Vec::new();
+    }
+    let k = w.max(h).div_ceil(max_side.max(1)).max(1);
+    let mut out = Vec::with_capacity(w.div_ceil(k) * h.div_ceil(k));
+    let mut row = vec![[0.0f32; 4]; w];
+    for y in (0..h).step_by(k) {
+        let yy = area.y0.saturating_add(y as i32);
+        surf.read_rgba_into(Rect::new(area.x0, yy, area.x1, yy.saturating_add(1)), &mut row);
+        out.extend(row.iter().step_by(k).copied());
+    }
+    out
+}
+
 fn mark_unmodified(app: &mut PhotocraftApp, index: usize) {
     let active = app.session.active_index();
     app.session.set_active(index);
@@ -608,18 +901,29 @@ fn mark_unmodified(app: &mut PhotocraftApp, index: usize) {
 /// A finished background re-develop ([`REDEVELOP_JOB`]) or open-time Camera Raw step. `true`
 /// when the event was one of those (handled here).
 pub fn on_redevelop_event(app: &mut PhotocraftApp, e: &photocraft_engine::jobs::JobEvent) -> bool {
-    let Some(pending) = app.raw_redevelop.take_if(|r| r.job == e.id) else { return false };
+    let Some(at) = app.raw_redevelop.iter().position(|r| r.job == e.id) else { return false };
+    let pending = app.raw_redevelop.remove(at);
     if pending.filter_step {
-        if matches!(e.outcome, photocraft_engine::jobs::JobOutcome::Done(_))
-            && let Some(index) = e.document.and_then(|id| document_index(app, id))
-        {
-            mark_unmodified(app, index);
+        // The Camera Raw Defaults' conversions follow the Camera Raw step, whatever its outcome:
+        // the document still opens in the workflow's colour space and depth.
+        if let Some(index) = e.document.and_then(|id| document_index(app, id)) {
+            let active = app.session.active_index();
+            if let Err(err) = apply_raw_conversions(app, index, &pending.defaults) {
+                crate::notices::error(app, format!("{}: {err}", pending.raw.name));
+            }
+            if let Some(i) = active {
+                app.session.set_active(i);
+            }
+            if matches!(e.outcome, photocraft_engine::jobs::JobOutcome::Done(_)) {
+                mark_unmodified(app, index);
+            }
+            app.sync_views();
         }
         // The usual filter reporting still applies.
         return false;
     }
     match &e.outcome {
-        photocraft_engine::jobs::JobOutcome::Done(v) => match finish_redevelop(app, &pending.params, &pending.raw, v) {
+        photocraft_engine::jobs::JobOutcome::Done(v) => match finish_redevelop(app, &pending.params, &pending.raw, v, &pending.defaults) {
             Ok(_) => {
                 app.ui.status = crate::i18n::fmt(tl!("Opened {name}"), &[("name", &pending.raw.name)]);
                 app.ui.status_error = false;
@@ -767,6 +1071,8 @@ fn open_pixels(
         app.ui.camera_raw_scope.selected_region = false;
     }
     let float = surf.format().sample == photocraft_color::SampleType::F32;
+    // Builds the GPU pass the first time any Camera Raw dialog opens.
+    let gpu = crate::camera_raw_gpu::for_app(app);
     let mut d = CameraRawDialog {
         layer,
         layer_name: name,
@@ -815,6 +1121,10 @@ fn open_pixels(
         raw_curve: None,
         pending: None,
         preview_error: None,
+        gpu,
+        source_key: crate::camera_raw_gpu::source_key(),
+        develop_ms: 0.0,
+        develop_backend: "cpu",
         undo: Vec::new(),
         redo: Vec::new(),
         edit_origin: None,
@@ -856,8 +1166,8 @@ pub fn menu(app: &mut PhotocraftApp, ctx: &egui::Context, id: &str, params: &Val
     for (key, value) in fields {
         match key.as_str() {
             "set" | "scope" | "view" | "demosaic" => {}
-            "before" | "commit" | "cancel" | "saveSettings" | "loadSettings" | "undo" | "redo" if value.is_boolean() => {}
-            "before" | "commit" | "cancel" | "saveSettings" | "loadSettings" | "undo" | "redo" => {
+            "before" | "commit" | "cancel" | "saveSettings" | "loadSettings" | "undo" | "redo" | "auto" if value.is_boolean() => {}
+            "before" | "commit" | "cancel" | "saveSettings" | "loadSettings" | "undo" | "redo" | "auto" => {
                 return Some(Err(format!("Camera Raw {key} must be a boolean")));
             }
             _ => return Some(Err(format!("unknown Camera Raw ui property {key}"))),
@@ -894,6 +1204,10 @@ fn menu_update(app: &mut PhotocraftApp, ctx: &egui::Context, ui: &Value) -> Opti
     // occurs until every part of the request has passed validation.
     let d = app.camera_raw.as_ref()?;
     let mut next_params = d.params.clone();
+    // Auto (the Light panel's button): the tone sliders from the image's histogram.
+    if ui.get("auto").and_then(Value::as_bool) == Some(true) {
+        photocraft_algo::camera_raw::auto_tone(&d.proxy, &mut next_params);
+    }
     if let Some(set) = ui.get("set") {
         if !set.is_object() {
             return Some(Err("bad Camera Raw settings: expected an object".into()));
@@ -1097,8 +1411,8 @@ fn commit(app: &mut PhotocraftApp) -> Result<Value, String> {
         }
         Target::OpenRaw => {
             let raw = d.raw_open.clone().ok_or("no raw file is being opened")?;
-            let params = d.params.clone();
-            commit_open_raw(app, &params, &raw)?
+            let (params, original) = (d.params.clone(), d.original.clone());
+            commit_open_raw(app, &params, &raw, Some(&original))?
         }
     };
     app.camera_raw = None;
@@ -1119,7 +1433,7 @@ fn demosaic_row(ui: &mut egui::Ui, m: &mut photocraft_io::raw::Demosaic) {
             (Demosaic::Mhc, "Malvar–He–Cutler", "Gradient-corrected interpolation: sharp and fast, with some colour fringing on fine detail."),
             (Demosaic::Bilinear, "Bilinear", "The fastest and the softest, with colour fringing on fine detail."),
         ];
-        widgets::dropdown_with_tooltips(ui, "camera-raw-demosaic", m, &options, 180.0);
+        widgets::dropdown_with_tooltips(ui, "camera-raw-demosaic", tl!("Demosaic"), m, &options, 180.0);
     });
     ui.add_space(4.0);
 }
@@ -1226,7 +1540,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     // Camera Raw is modal, as in Photoshop: the main window is dimmed and takes no input while it
     // is open (in a separate window, or drawn over it where there are no extra windows).
     let main = ctx.content_rect();
-    egui::Area::new(egui::Id::new("camera-raw-modal")).order(egui::Order::Foreground).fixed_pos(main.min).show(ctx, |ui| {
+    egui::Area::new(egui::Id::unique("camera-raw-modal")).order(egui::Order::Foreground).fixed_pos(main.min).show(ctx, |ui| {
         let (r, _) = ui.allocate_exact_size(main.size(), Sense::click_and_drag());
         ui.painter().rect_filled(r, 0.0, Tokens::get(ui.ctx()).scrim);
     });
@@ -1262,7 +1576,7 @@ fn draw(app: &mut PhotocraftApp, ctx: &egui::Context, own_window: bool) {
     let screen = ctx.content_rect();
     let current_display = app.session.active().and_then(|st| app.session.color.canvas_display(&st.doc).ok());
     let mut action: Option<&str> = None;
-    egui::Area::new(egui::Id::new("camera-raw-dialog")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
+    egui::Area::new(egui::Id::unique("camera-raw-dialog")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
         let Some(d) = app.camera_raw.as_mut() else { return };
         history_keys(d, ctx);
         let pointer = ctx.input(|i| i.pointer.primary_down());
@@ -1296,6 +1610,7 @@ fn draw(app: &mut PhotocraftApp, ctx: &egui::Context, own_window: bool) {
         let ok_label = if d.target == Target::OpenRaw { tl!("Open") } else { tl!("OK") };
         let footer_h = 48.0;
         let body = ERect::from_min_max(pos2(full.left(), title.bottom()), pos2(full.right(), full.bottom() - footer_h));
+        let animated_zoom = app.session.prefs().general.animated_zoom;
         let scope = &mut app.ui.camera_raw_scope;
         // Clip both pixels and scope overlays before painting the settings dock/footer.
         let preview_body = ERect::from_min_max(body.min, pos2((body.right() - PANEL_W).max(body.left() + 1.0), body.bottom()));
@@ -1310,7 +1625,8 @@ fn draw(app: &mut PhotocraftApp, ctx: &egui::Context, own_window: bool) {
         let mut preview = ui.new_child(egui::UiBuilder::new().max_rect(view));
         preview.set_clip_rect(view.intersect(ui.clip_rect()));
         preview.painter().rect_filled(view, 0.0, t.canvas);
-        let (r, response, panning, zoom_box) = super::camera_raw_preview_ui::interact(&mut preview, navigation, view, size, &mut scope.sampler_tool);
+        let (r, response, panning, zoom_box) =
+            super::camera_raw_preview_ui::interact(&mut preview, navigation, view, size, &mut scope.sampler_tool, animated_zoom);
         let tex = if d.show_before { d.before_tex.as_ref() } else { d.tex.as_ref() };
         if let Some(tex) = tex {
             // Never tile a checker across the offscreen extent of a highly zoomed image.
@@ -1351,9 +1667,16 @@ fn draw(app: &mut PhotocraftApp, ctx: &egui::Context, own_window: bool) {
         egui::ScrollArea::vertical().id_salt("camera-raw-props").show(&mut props, |ui| {
             ui.spacing_mut().item_spacing.y = 4.0;
             let p = &mut d.params;
+            let proxy = &d.proxy;
             let alt = &mut d.scope.alt_tone;
             let (ts, tn) = (temp_stops(), tint_stops());
             section(ui, "Light", true, |ui| {
+                // Auto: Camera Raw's one-click tone from the histogram; the sliders show what it
+                // chose, so each can be adjusted afterwards.
+                if ui.button(tl!("Auto")).on_hover_text(tl!("Set the tone sliders from the image")).clicked() {
+                    photocraft_algo::camera_raw::auto_tone(proxy, p);
+                    dirty = true;
+                }
                 tone_row(ui, &mut dirty, alt, ToneZone::Exposure, &mut p.exposure);
                 row(ui, &mut dirty, "Contrast", &mut p.contrast, -100.0..=100.0, None);
                 tone_row(ui, &mut dirty, alt, ToneZone::Highlights, &mut p.highlights);
@@ -1377,6 +1700,7 @@ fn draw(app: &mut PhotocraftApp, ctx: &egui::Context, own_window: bool) {
                 if widgets::dropdown(
                     ui,
                     "cr-vig-style",
+                    tl!("Vignetting"),
                     &mut style,
                     &[
                         ("highlightPriority".to_string(), tl!("Highlight Priority")),
@@ -1410,7 +1734,7 @@ fn draw(app: &mut PhotocraftApp, ctx: &egui::Context, own_window: bool) {
                     for (i, source) in ["Hue", "Saturation", "Luminance"].iter().enumerate() {
                         let name = crate::i18n::tr_ctx(crate::i18n::current(), "cameraRaw", source);
                         let response = widgets::pill_tab(ui, name, d.mixer_tab == i);
-                        response.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, ui.is_enabled(), d.mixer_tab == i, name));
+                        response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, ui.is_enabled(), d.mixer_tab == i, name));
                         if response.clicked() {
                             d.mixer_tab = i;
                         }
@@ -1451,6 +1775,19 @@ fn draw(app: &mut PhotocraftApp, ctx: &egui::Context, own_window: bool) {
                 row(ui, &mut dirty, "Color", &mut p.noise_color, 0.0..=100.0, None);
                 row(ui, &mut dirty, "Color Detail", &mut p.noise_color_detail, 0.0..=100.0, None);
             });
+            // Camera Raw's Calibration panel: a tint for the shadows and each primary's hue and
+            // saturation (Process Version is implied: 2012 and later).
+            section(ui, "Calibration", false, |ui| {
+                widgets::section_label(ui, tl!("Shadows"));
+                row(ui, &mut dirty, "Tint", &mut p.shadow_tint, -100.0..=100.0, Some(&tn));
+                for (i, name) in ["Red Primary", "Green Primary", "Blue Primary"].iter().enumerate() {
+                    widgets::section_label(ui, crate::i18n::tr_ctx(crate::i18n::current(), "cameraRaw", name));
+                    ui.push_id(name, |ui| {
+                        row(ui, &mut dirty, "Hue", &mut p.calibration_hue[i], -100.0..=100.0, None);
+                        row(ui, &mut dirty, "Saturation", &mut p.calibration_sat[i], -100.0..=100.0, None);
+                    });
+                }
+            });
         });
         super::camera_raw_scope_ui::floating(ctx, d, scope, right);
         super::camera_raw_scope_ui::shortcuts(ctx, scope);
@@ -1849,7 +2186,11 @@ mod tests {
         let (w, h) = (48, 32);
         let mut spec = DngSpec::cfa(w, h, mosaic(&scene(w, h), w, [0, 1, 1, 2], 0, 30000));
         spec.as_shot_neutral = Some([0.5, 1.0, 0.7]);
-        (PhotocraftApp::new(photocraft_engine::Session::new(), services), spec.build())
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), services);
+        // The pixel comparisons below read the developed ProPhoto values: no conversion on open
+        // (Camera Raw Defaults › Color space is Adobe RGB otherwise).
+        app.run("prefs.set", json!({"path": "rawDefaults.colorSpace", "value": "proPhoto"})).unwrap();
+        (app, spec.build())
     }
 
     fn mean_red(app: &PhotocraftApp) -> f32 {
@@ -1999,12 +2340,12 @@ mod tests {
         assert!(app.camera_raw.is_none());
         for _ in 0..3000 {
             crate::jobs_ui::tick(&mut app, &ctx);
-            if app.raw_redevelop.is_none() && !app.session.has_jobs() {
+            if app.raw_redevelop.is_empty() && !app.session.has_jobs() {
                 break;
             }
             std::thread::sleep(std::time::Duration::from_millis(5));
         }
-        assert!(app.raw_redevelop.is_none() && !app.session.has_jobs(), "the jobs never finished");
+        assert!(app.raw_redevelop.is_empty() && !app.session.has_jobs(), "the jobs never finished");
         let docs = app.session.documents();
         assert_eq!(docs.len(), 3);
         assert_eq!((docs[0].doc.size.width, docs[2].doc.size.width), (10, 12), "the other tabs keep their places");
@@ -2050,7 +2391,8 @@ mod tests {
         let raw = app.pending_raw_open.take().unwrap();
         open_raw(&mut app, &ctx, raw).unwrap();
         let r = menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"commit": true}})).unwrap().unwrap();
-        assert_eq!(r, json!({"document": 0, "redeveloped": false}));
+        assert_eq!((r["document"].as_u64(), r["redeveloped"].as_bool(), r.get("filter")), (Some(0), Some(false), None), "{r}");
+        assert_eq!(r.get("defaults"), None, "ProPhoto, 16-bit: no Camera Raw Default to apply: {r}");
         // Preference off: raws open straight away.
         app.run("prefs.set", json!({"path": "rawDefaults.openInCameraRaw", "value": false})).unwrap();
         app.open_bytes("c.dng", &dng).unwrap();
@@ -2073,6 +2415,400 @@ mod tests {
         );
     }
 
+    #[test]
+    fn calibration_changes_the_preview_and_round_trips_through_xmp() {
+        let (mut app, dng) = raw_app();
+        let ctx = egui::Context::default();
+        app.open_bytes("IMG_0005.dng", &dng).unwrap();
+        let raw = app.pending_raw_open.take().unwrap();
+        open_raw(&mut app, &ctx, raw).unwrap();
+        let before = app.camera_raw.as_ref().unwrap().processed.clone();
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"set": {"shadowTint": 100, "calibrationHue": [100, 0, 0], "calibrationSat": [0, 0, -100]}}}))
+            .unwrap()
+            .unwrap();
+        let d = app.camera_raw.as_mut().unwrap();
+        d.render(&ctx);
+        assert!(
+            d.processed.iter().zip(&before).any(|(a, b)| (a[0] - b[0]).abs() > 0.01 || (a[1] - b[1]).abs() > 0.01),
+            "the Calibration panel changes the preview"
+        );
+        let xmp = photocraft_io::camera_raw_xmp::save(&d.params);
+        assert!(xmp.contains("crs:ShadowTint=\"+100\"") && xmp.contains("crs:RedHue=\"+100\"") && xmp.contains("crs:BlueSaturation=\"-100\""), "{xmp}");
+        let mut back = CameraRaw::default();
+        photocraft_io::camera_raw_xmp::load(&mut back, xmp.as_bytes()).unwrap();
+        assert_eq!((back.shadow_tint, back.calibration_hue, back.calibration_sat), (100.0, [100.0, 0.0, 0.0], [0.0, 0.0, -100.0]));
+        assert!(menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"auto": "yes"}})).unwrap().is_err(), "auto must be a boolean");
+    }
+
+    #[test]
+    fn auto_sets_the_light_sliders_from_the_image() {
+        let (mut app, dng) = raw_app();
+        let ctx = egui::Context::default();
+        app.open_bytes("IMG_0006.dng", &dng).unwrap();
+        let raw = app.pending_raw_open.take().unwrap();
+        open_raw(&mut app, &ctx, raw).unwrap();
+        assert!(app.camera_raw.as_ref().unwrap().params.is_identity());
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"auto": true}})).unwrap().unwrap();
+        let p = app.camera_raw.as_ref().unwrap().params.clone();
+        assert!(!p.is_identity(), "Auto chose something: {p:?}");
+        assert!(p.saturation == 0.0 && p.hsl_hue == [0.0; 8], "only the Light panel: {p:?}");
+        // The preference does the same when a raw opens without a sidecar.
+        app.run("prefs.set", json!({"path": "rawDefaults.applyAutoTone", "value": true})).unwrap();
+        app.open_bytes("IMG_0007.dng", &dng).unwrap();
+        let raw = app.pending_raw_open.take().unwrap();
+        open_raw(&mut app, &ctx, raw).unwrap();
+        assert_eq!(app.camera_raw.as_ref().unwrap().params, p, "Apply auto tone opens the dialog with Auto's settings");
+    }
+
+    #[test]
+    fn a_sidecar_fills_the_dialog_and_open_writes_it_back() {
+        use std::sync::{Arc, Mutex};
+        let (mut app, dng) = raw_app();
+        let dir = std::env::temp_dir().join(format!("photocraft-sidecar-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let raw_path = dir.join("IMG_0008.cr2").to_string_lossy().into_owned();
+        std::fs::write(&raw_path, &dng).unwrap();
+        assert_eq!(sidecar_path(&raw_path), dir.join("IMG_0008.xmp").to_string_lossy());
+        assert_eq!(sidecar_path("/a/b.c/noext"), "/a/b.c/noext.xmp");
+        std::fs::write(
+            sidecar_path(&raw_path),
+            "<x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"PhotoCraft\"><rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"><rdf:Description xmlns:crs=\"http://ns.adobe.com/camera-raw-settings/1.0/\" crs:Exposure2012=\"+1.50\" crs:ShadowTint=\"20\" crs:Temperature=\"5500\"/></rdf:RDF></x:xmpmeta>",
+        )
+        .unwrap();
+        type Written = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
+        let written: Written = Arc::default();
+        let sink = written.clone();
+        app.services.write = Some(Box::new(move |p: &str, b: &[u8]| {
+            sink.lock().unwrap().push((p.to_string(), b.to_vec()));
+            Ok(())
+        }));
+        let ctx = egui::Context::default();
+        app.open_bytes("IMG_0008.cr2", &dng).unwrap();
+        let mut raw = app.pending_raw_open.take().unwrap();
+        raw.path = Some(raw_path.clone());
+        open_raw(&mut app, &ctx, raw).unwrap();
+        let d = app.camera_raw.as_ref().unwrap();
+        assert_eq!((d.params.exposure, d.params.shadow_tint), (1.5, 20.0), "the sidecar fills the dialog");
+        assert!(
+            app.ui.status.contains("IMG_0008.xmp") && app.ui.status.contains("Temperature"),
+            "the absolute white balance is reported as not supported: {}",
+            app.ui.status
+        );
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"set": {"contrast": 15}}})).unwrap().unwrap();
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"commit": true}})).unwrap().unwrap();
+        let w = written.lock().unwrap().clone();
+        assert_eq!(w.len(), 1, "Open writes the sidecar once: {:?}", w.iter().map(|(p, _)| p).collect::<Vec<_>>());
+        assert_eq!(w[0].0, sidecar_path(&raw_path));
+        let text = String::from_utf8(w[0].1.clone()).unwrap();
+        assert!(text.contains("crs:Exposure2012=\"+1.50\"") && text.contains("crs:Contrast2012=\"+15\"") && text.contains("crs:ShadowTint=\"+20\""), "{text}");
+        // A DNG keeps its settings inside: no sidecar beside it. And the preference turns writing off.
+        written.lock().unwrap().clear();
+        let dng_path = dir.join("IMG_0009.dng").to_string_lossy().into_owned();
+        std::fs::write(&dng_path, &dng).unwrap();
+        app.open_bytes("IMG_0009.dng", &dng).unwrap();
+        let mut raw = app.pending_raw_open.take().unwrap();
+        raw.path = Some(dng_path);
+        open_raw(&mut app, &ctx, raw).unwrap();
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"set": {"contrast": 15}, "commit": true}})).unwrap().unwrap();
+        assert!(written.lock().unwrap().is_empty(), "no sidecar for a DNG");
+        app.run("prefs.set", json!({"path": "rawDefaults.writeXmpSidecars", "value": false})).unwrap();
+        app.open_bytes("IMG_0008.cr2", &dng).unwrap();
+        let mut raw = app.pending_raw_open.take().unwrap();
+        raw.path = Some(raw_path.clone());
+        open_raw(&mut app, &ctx, raw).unwrap();
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"set": {"contrast": 30}, "commit": true}})).unwrap().unwrap();
+        assert!(written.lock().unwrap().is_empty(), "the preference stops the write");
+        // Without the dialog, the sidecar still develops the file.
+        app.run("prefs.set", json!({"path": "rawDefaults.openInCameraRaw", "value": false})).unwrap();
+        let before = app.session.documents().len();
+        app.open_file(&raw_path, &dng).unwrap();
+        assert!(app.pending_raw_open.is_none());
+        assert_eq!(app.session.documents().len(), before + 1);
+        let st = app.session.active().unwrap();
+        assert_eq!(st.saved_revision, st.revision, "opening with a sidecar leaves the document unmodified");
+        assert!(mean_red(&app) > 0.0);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn camera_raw_defaults_apply_when_a_raw_opens() {
+        let (mut app, dng) = raw_app();
+        app.run("prefs.set", json!({"values": {"rawDefaults.openInCameraRaw": false, "rawDefaults.colorSpace": "srgb", "rawDefaults.bitDepth": "8", "rawDefaults.resolution": 240.0, "rawDefaults.sharpenFor": "screen", "rawDefaults.openAsSmartObject": true}})).unwrap();
+        app.open_bytes("IMG_0010.dng", &dng).unwrap();
+        assert!(app.pending_raw_open.is_none());
+        let st = app.session.active().unwrap();
+        assert_eq!(st.doc.depth, photocraft_color::SampleType::U8, "Bit depth 8");
+        assert_eq!(st.doc.resolution_dpi, 240.0, "Resolution");
+        let profile = st.doc.icc_profile.as_deref().and_then(|p| photocraft_cms::Profile::parse(p).ok()).map(|p| p.description).unwrap_or_default();
+        assert!(profile.to_lowercase().contains("srgb"), "Color space: {profile}");
+        let layer = st.doc.layer(st.active_layer.unwrap()).unwrap();
+        assert!(matches!(layer.content, photocraft_doc::LayerContent::Smart(_)), "Open as Smart Object");
+        assert_eq!(st.saved_revision, st.revision, "the defaults are part of opening: unmodified");
+        // The dialog's Open applies them too, and reports what it applied.
+        app.run("prefs.set", json!({"values": {"rawDefaults.openInCameraRaw": true, "rawDefaults.openAsSmartObject": false, "rawDefaults.bitDepth": "16"}}))
+            .unwrap();
+        let ctx = egui::Context::default();
+        app.open_bytes("IMG_0011.dng", &dng).unwrap();
+        let raw = app.pending_raw_open.take().unwrap();
+        open_raw(&mut app, &ctx, raw).unwrap();
+        let r = menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"commit": true}})).unwrap().unwrap();
+        assert_eq!(r["defaults"], json!(["sharpenFor", "colorSpace"]), "{r}");
+        assert!(r.get("filter").is_some(), "Sharpen For is a Camera Raw step: {r}");
+        let st = app.session.active().unwrap();
+        assert_eq!(st.doc.depth, photocraft_color::SampleType::U16);
+        assert_eq!(st.saved_revision, st.revision);
+    }
+
+    type Written = std::sync::Arc<std::sync::Mutex<Vec<(String, Vec<u8>)>>>;
+
+    /// A sidecar as Lightroom Classic leaves one beside a raw: its own toolkit, a crop, a rating
+    /// and a keyword next to the develop settings (values synthetic).
+    const LIGHTROOM_SIDECAR: &str = r#"<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.0-c000 1.000000, 0000/00/00-00:00:00        ">
+ <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
+  <rdf:Description rdf:about=""
+    xmlns:xmp="http://ns.adobe.com/xap/1.0/"
+    xmlns:dc="http://purl.org/dc/elements/1.1/"
+    xmlns:crs="http://ns.adobe.com/camera-raw-settings/1.0/"
+   xmp:Rating="4"
+   crs:Exposure2012="+1.00"
+   crs:Sharpness="40"
+   crs:HasCrop="True"
+   crs:CropTop="0.1">
+   <dc:subject><rdf:Bag><rdf:li>harbour</rdf:li></rdf:Bag></dc:subject>
+  </rdf:Description>
+ </rdf:RDF>
+</x:xmpmeta>
+"#;
+
+    /// `raw_app` whose `write` service records what it is asked to write, and a raw file in a fresh
+    /// folder with `sidecar` beside it when given. Returns the app, the raw's bytes, the folder,
+    /// the raw's path and the recorded writes.
+    fn raw_with_sidecar(tag: &str, sidecar: Option<&str>) -> (PhotocraftApp, Vec<u8>, std::path::PathBuf, String, Written) {
+        let (mut app, dng) = raw_app();
+        let dir = std::env::temp_dir().join(format!("photocraft-sidecar-{tag}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let raw_path = dir.join("IMG_0100.cr2").to_string_lossy().into_owned();
+        std::fs::write(&raw_path, &dng).unwrap();
+        if let Some(text) = sidecar {
+            std::fs::write(sidecar_path(&raw_path), text).unwrap();
+        }
+        let written: Written = Default::default();
+        let sink = written.clone();
+        app.services.write = Some(Box::new(move |p: &str, b: &[u8]| {
+            sink.lock().unwrap().push((p.to_string(), b.to_vec()));
+            Ok(())
+        }));
+        (app, dng, dir, raw_path, written)
+    }
+
+    /// Opens the raw at `raw_path` in the open-time dialog, as File › Open does.
+    fn open_dialog_at(app: &mut PhotocraftApp, ctx: &egui::Context, dng: &[u8], raw_path: &str) {
+        app.open_bytes("IMG_0100.cr2", dng).unwrap();
+        let mut raw = app.pending_raw_open.take().unwrap();
+        raw.path = Some(raw_path.to_string());
+        open_raw(app, ctx, raw).unwrap();
+    }
+
+    /// The notices about the sidecar (the open's own import notes aside).
+    fn notice_titles(app: &PhotocraftApp) -> Vec<String> {
+        app.ui.notices.iter().map(|n| n.title.clone()).filter(|t| t.contains(".xmp")).collect()
+    }
+
+    /// A Lightroom or Bridge sidecar holds settings PhotoCraft can't keep (crop, masks, rating,
+    /// keywords): Open uses its develop settings but never writes over it, and says so.
+    #[test]
+    fn a_foreign_sidecar_is_never_overwritten() {
+        let (mut app, dng, dir, raw_path, written) = raw_with_sidecar("foreign", Some(LIGHTROOM_SIDECAR));
+        let ctx = egui::Context::default();
+        open_dialog_at(&mut app, &ctx, &dng, &raw_path);
+        assert_eq!(app.camera_raw.as_ref().unwrap().params.exposure, 1.0, "the sidecar's settings fill the dialog");
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"set": {"contrast": 15}}})).unwrap().unwrap();
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"commit": true}})).unwrap().unwrap();
+        assert!(written.lock().unwrap().is_empty(), "nothing written over Lightroom's sidecar");
+        assert_eq!(std::fs::read_to_string(sidecar_path(&raw_path)).unwrap(), LIGHTROOM_SIDECAR);
+        let titles = notice_titles(&app);
+        assert!(titles.iter().any(|t| t.contains("IMG_0100.xmp") && t.contains("another application")), "{titles:?}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// Bridge writes a sidecar with only a rating (no Camera Raw settings): it is not PhotoCraft's
+    /// to replace, with or without a change in the dialog.
+    #[test]
+    fn a_rating_only_sidecar_is_left_alone() {
+        let bridge = r#"<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.0"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmp:Rating="5"/></rdf:RDF></x:xmpmeta>"#;
+        let (mut app, dng, dir, raw_path, written) = raw_with_sidecar("rating", Some(bridge));
+        let ctx = egui::Context::default();
+        open_dialog_at(&mut app, &ctx, &dng, &raw_path);
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"commit": true}})).unwrap().unwrap();
+        assert!(written.lock().unwrap().is_empty(), "Open with no change writes nothing");
+        assert!(notice_titles(&app).is_empty(), "and has nothing to report: {:?}", notice_titles(&app));
+        open_dialog_at(&mut app, &ctx, &dng, &raw_path);
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"set": {"contrast": 10}, "commit": true}})).unwrap().unwrap();
+        assert!(written.lock().unwrap().is_empty(), "nor with a change");
+        assert_eq!(std::fs::read_to_string(sidecar_path(&raw_path)).unwrap(), bridge);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// With Open in Camera Raw off, opening a raw develops it with its sidecar and writes nothing
+    /// back: nothing changed.
+    #[test]
+    fn opening_without_the_dialog_does_not_rewrite_the_sidecar() {
+        let (mut app, dng, dir, raw_path, written) = raw_with_sidecar("nodialog", Some(LIGHTROOM_SIDECAR));
+        app.run("prefs.set", json!({"path": "rawDefaults.openInCameraRaw", "value": false})).unwrap();
+        app.open_file(&raw_path, &dng).unwrap();
+        assert!(app.pending_raw_open.is_none());
+        assert_eq!(app.session.documents().len(), 1);
+        assert!(written.lock().unwrap().is_empty(), "just opening never writes the sidecar");
+        assert_eq!(std::fs::read_to_string(sidecar_path(&raw_path)).unwrap(), LIGHTROOM_SIDECAR);
+        assert!(notice_titles(&app).is_empty(), "{:?}", notice_titles(&app));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// A control or MCP request has no authority to write beside the user's files: its commit
+    /// develops the raw but writes no sidecar. The same Open from the dialog does.
+    #[test]
+    fn a_control_request_never_writes_the_sidecar() {
+        fn allow(_: &str, _: &Value) -> photocraft_engine::Result<()> {
+            Ok(())
+        }
+        let (mut app, dng, dir, raw_path, written) = raw_with_sidecar("control", None);
+        app.services.automation_authorize = Some(allow);
+        let ctx = egui::Context::default();
+        open_dialog_at(&mut app, &ctx, &dng, &raw_path);
+        let commit = json!({"id": "filter.cameraRaw", "params": {"ui": {"set": {"contrast": 15}, "commit": true}}});
+        let (req, _rx) = crate::control::ControlRequest::new("ui.menu.invoke", commit);
+        let crate::control::Outcome::Done(reply) = crate::control::handle(&mut app, &ctx, &req) else { panic!("expected a reply") };
+        assert_eq!(reply["ok"], true, "{reply}");
+        assert!(app.camera_raw.is_none(), "committed");
+        assert!(written.lock().unwrap().is_empty(), "no sidecar from a control request");
+        open_dialog_at(&mut app, &ctx, &dng, &raw_path);
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"set": {"contrast": 15}, "commit": true}})).unwrap().unwrap();
+        assert_eq!(written.lock().unwrap().len(), 1, "the user's own Open writes it");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// A sidecar that can't be written is reported in a notice that outlasts the status line the
+    /// develop and the Camera Raw step write after it.
+    #[test]
+    fn a_sidecar_write_error_stays_reported() {
+        let (mut app, dng, dir, raw_path, _) = raw_with_sidecar("readonly", None);
+        app.services.write = Some(Box::new(|_: &str, _: &[u8]| Err("read-only volume".to_string())));
+        let ctx = egui::Context::default();
+        open_dialog_at(&mut app, &ctx, &dng, &raw_path);
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"set": {"exposure": 0.5, "contrast": 15}, "commit": true}})).unwrap().unwrap();
+        let errors: Vec<_> = app.ui.notices.iter().filter(|n| n.error).map(|n| n.title.clone()).collect();
+        assert!(errors.iter().any(|t| t.contains("IMG_0100.xmp") && t.contains("read-only volume")), "{errors:?}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    fn open_with_settings(app: &mut PhotocraftApp, ctx: &egui::Context, dng: &[u8], name: &str) {
+        app.open_bytes(name, dng).unwrap();
+        let raw = app.pending_raw_open.take().unwrap();
+        open_raw(app, ctx, raw).unwrap();
+        menu(app, ctx, "filter.cameraRaw", &json!({"ui": {"set": {"exposure": 0.5, "contrast": 60, "saturation": 40, "vibrance": 30}}})).unwrap().unwrap();
+    }
+
+    fn profile_name(app: &PhotocraftApp) -> String {
+        let st = app.session.active().unwrap();
+        st.doc.icc_profile.as_deref().and_then(|p| photocraft_cms::Profile::parse(p).ok()).map(|p| p.description).unwrap_or_default()
+    }
+
+    /// Camera Raw renders in its own space and converts to the workflow space last, so Open gives
+    /// what the dialog previewed on the developed ProPhoto pixels: with the default Adobe RGB the
+    /// result is the Camera Raw step on the ProPhoto develop, then the conversion. Inline and with
+    /// the re-develop as a background job.
+    #[test]
+    fn the_camera_raw_step_runs_before_the_workflow_conversion() {
+        let ctx = egui::Context::default();
+        let (mut app, dng) = raw_app();
+        open_with_settings(&mut app, &ctx, &dng, "a.dng");
+        menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"commit": true}})).unwrap().unwrap();
+        app.run("edit.convertToProfile", json!({"profile": "adobe-rgb-compat", "intent": "relative"})).unwrap();
+        let want = pixels(&app);
+        let close = |a: &[f32], b: &[f32]| a.len() == b.len() && a.iter().zip(b).all(|(x, y)| (x - y).abs() < 1e-5);
+        for background in [false, true] {
+            let (mut app, dng) = raw_app();
+            app.run("prefs.set", json!({"path": "rawDefaults.colorSpace", "value": "adobeRgb"})).unwrap();
+            open_with_settings(&mut app, &ctx, &dng, "b.dng");
+            app.background_jobs = background;
+            let r = menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"commit": true}})).unwrap().unwrap();
+            if background {
+                assert_eq!(r["pending"], true, "the re-develop runs as a job: {r}");
+            } else {
+                assert_eq!(r["defaults"], json!(["colorSpace"]), "{r}");
+            }
+            for _ in 0..3000 {
+                crate::jobs_ui::tick(&mut app, &ctx);
+                if app.raw_redevelop.is_empty() && !app.session.has_jobs() {
+                    break;
+                }
+                std::thread::sleep(std::time::Duration::from_millis(5));
+            }
+            assert!(app.raw_redevelop.is_empty() && !app.session.has_jobs(), "the jobs never finished");
+            assert!(profile_name(&app).to_lowercase().contains("adobe"), "background {background}: {}", profile_name(&app));
+            assert!(close(&pixels(&app), &want), "background {background}: the step ran on other pixels than the preview");
+            let st = app.session.active().unwrap();
+            assert_eq!(st.saved_revision, st.revision, "background {background}: unmodified");
+        }
+    }
+
+    /// Two raws opened one after the other while the first one's re-develop still runs in the
+    /// background: each lands with its Camera Raw step and conversions and is left unmodified.
+    #[test]
+    fn two_raws_opened_back_to_back_both_finish_their_open() {
+        let ctx = egui::Context::default();
+        let (mut app, dng) = raw_app();
+        app.run("prefs.set", json!({"path": "rawDefaults.colorSpace", "value": "adobeRgb"})).unwrap();
+        open_with_settings(&mut app, &ctx, &dng, "a.dng");
+        app.background_jobs = true;
+        let a = menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"commit": true}})).unwrap().unwrap();
+        assert_eq!(a["pending"], true, "the re-develop runs as a job: {a}");
+        app.background_jobs = false;
+        open_with_settings(&mut app, &ctx, &dng, "b.dng");
+        app.background_jobs = true;
+        let b = menu(&mut app, &ctx, "filter.cameraRaw", &json!({"ui": {"commit": true}})).unwrap().unwrap();
+        assert_eq!(b["pending"], true, "{b}");
+        for _ in 0..3000 {
+            crate::jobs_ui::tick(&mut app, &ctx);
+            if app.raw_redevelop.is_empty() && !app.session.has_jobs() {
+                break;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        assert!(app.raw_redevelop.is_empty() && !app.session.has_jobs(), "the jobs never finished");
+        assert_eq!(app.session.documents().len(), 2);
+        for i in 0..2 {
+            app.session.set_active(i);
+            assert!(profile_name(&app).to_lowercase().contains("adobe"), "document {i}: {}", profile_name(&app));
+            let st = app.session.active().unwrap();
+            assert_eq!(st.saved_revision, st.revision, "document {i} unmodified");
+        }
+    }
+
+    /// A sidecar is read only from a regular file of at most `MAX_XMP_BYTES`: a folder, or a file
+    /// one byte larger, is not read (a pipe or device named like one would never end).
+    #[test]
+    fn sidecars_are_read_from_small_regular_files_only() {
+        let dir = std::env::temp_dir().join(format!("photocraft-sidecar-bounded-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(dir.join("folder.xmp")).unwrap();
+        let cap = photocraft_io::camera_raw_xmp::MAX_XMP_BYTES;
+        let (fits, larger) = (dir.join("fits.xmp"), dir.join("larger.xmp"));
+        std::fs::write(&fits, vec![b' '; cap]).unwrap();
+        std::fs::write(&larger, vec![b' '; cap + 1]).unwrap();
+        let s = |p: std::path::PathBuf| p.to_string_lossy().into_owned();
+        assert_eq!(read_bounded(&s(fits)).map(|b| b.len()), Some(cap));
+        assert_eq!(read_bounded(&s(larger.clone())), None);
+        assert_eq!(read_bounded(&s(dir.join("folder.xmp"))), None);
+        assert_eq!(read_bounded(&s(dir.join("missing.xmp"))), None);
+        assert_eq!(existing_sidecar_is_ours(&s(dir.join("folder.xmp"))), Some(false), "something is there: never written over");
+        assert_eq!(existing_sidecar_is_ours(&s(larger)), Some(false));
+        assert_eq!(existing_sidecar_is_ours(&s(dir.join("missing.xmp"))), None);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn save_and_load_settings_round_trip_through_xmp_files() {
         use crate::file_dialog::FileDialogAnswer;
@@ -2081,7 +2817,7 @@ mod tests {
         let written: Written = Arc::default();
         let w = written.clone();
         let foreign = br#"<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
-            <rdf:Description xmlns:crs="http://ns.adobe.com/camera-raw-settings/1.0/" crs:Clarity2012="+25" crs:RedHue="-5"/>
+            <rdf:Description xmlns:crs="http://ns.adobe.com/camera-raw-settings/1.0/" crs:Clarity2012="+25" crs:LensProfileEnable="1"/>
             </rdf:RDF></x:xmpmeta>"#;
         let answers = vec![
             Some(FileDialogAnswer::SaveTo("/out/Look.xmp".into())),
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index ab3e6939a7..f00f2c7ce8 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -550,22 +550,27 @@ pub(crate) fn draw_readout<const N: usize>(ctx: &egui::Context, id: &str, cursor
     let labels = labels.map(|label| tl!(label));
     let (lw, vw) = (labels.map(width), values.each_ref().map(|v| width(v)));
     let (label_col, value_col) = (lw.iter().fold(0.0f32, |a, &b| a.max(b)), vw.iter().fold(0.0f32, |a, &b| a.max(b)));
-    egui::Area::new(egui::Id::new(id)).order(egui::Order::Tooltip).fixed_pos(cursor + vec2(16.0, 18.0)).interactable(false).constrain(true).show(ctx, |ui| {
-        egui::Frame::new().fill(t.card).stroke(Stroke::new(1.0, t.card_border)).corner_radius(t.radius_sm).inner_margin(egui::Margin::symmetric(7, 4)).show(
-            ui,
-            |ui| {
-                ui.spacing_mut().item_spacing = vec2(0.0, 1.0);
-                for (i, value) in values.into_iter().enumerate() {
-                    // Labels left, values right-aligned on one edge, sharing a baseline.
-                    ui.horizontal(|ui| {
-                        ui.add(egui::Label::new(egui::RichText::new(labels[i]).font(font.clone()).color(t.text_dim)).extend());
-                        ui.add_space(label_col - lw[i] + 12.0 + value_col - vw[i]);
-                        ui.add(egui::Label::new(egui::RichText::new(value).font(font.clone()).color(t.text)).extend());
-                    });
-                }
-            },
-        );
-    });
+    egui::Area::new(egui::Id::unique(id)).order(egui::Order::Tooltip).fixed_pos(cursor + vec2(16.0, 18.0)).interactable(false).constrain(true).show(
+        ctx,
+        |ui| {
+            egui::Frame::new()
+                .fill(t.card)
+                .stroke(Stroke::new(1.0, t.card_border))
+                .corner_radius(t.radius_sm)
+                .inner_margin(egui::Margin::symmetric(7, 4))
+                .show(ui, |ui| {
+                    ui.spacing_mut().item_spacing = vec2(0.0, 1.0);
+                    for (i, value) in values.into_iter().enumerate() {
+                        // Labels left, values right-aligned on one edge, sharing a baseline.
+                        ui.horizontal(|ui| {
+                            ui.add(egui::Label::new(egui::RichText::new(labels[i]).font(font.clone()).color(t.text_dim)).extend());
+                            ui.add_space(label_col - lw[i] + 12.0 + value_col - vw[i]);
+                            ui.add(egui::Label::new(egui::RichText::new(value).font(font.clone()).color(t.text)).extend());
+                        });
+                    }
+                });
+        },
+    );
 }
 
 /// The engine's live stroke of a tool: the Brush, Pencil and Eraser paint dabs; the Clone Stamp,
@@ -574,6 +579,7 @@ enum EngineStroke {
     Brush(Box<photocraft_engine::brush_cmds::LiveStroke>),
     Retouch(photocraft_engine::retouch_cmds::LiveRetouch),
     Dab(photocraft_engine::retouch_cmds::LiveDab),
+    Mixer(Box<photocraft_engine::brush_cmds::mixer_live::LiveMixer>),
 }
 
 impl EngineStroke {
@@ -582,6 +588,7 @@ impl EngineStroke {
     fn wants_time(&self) -> bool {
         match self {
             EngineStroke::Brush(l) => l.wants_time(),
+            EngineStroke::Mixer(l) => l.wants_time(),
             EngineStroke::Retouch(_) | EngineStroke::Dab(_) => false,
         }
     }
@@ -591,6 +598,7 @@ impl EngineStroke {
             Self::Brush(s) => &s.doc,
             Self::Retouch(s) => &s.doc,
             Self::Dab(s) => &s.doc,
+            Self::Mixer(s) => &s.doc,
         }
     }
     fn bounds(&self) -> DRect {
@@ -598,6 +606,7 @@ impl EngineStroke {
             Self::Brush(s) => s.bounds(),
             Self::Retouch(s) => s.bounds(),
             Self::Dab(s) => s.bounds(),
+            Self::Mixer(s) => s.bounds(),
         }
     }
     fn push(&mut self, pts: &[photocraft_engine::paint::StrokePoint]) -> photocraft_engine::Result<DRect> {
@@ -605,12 +614,14 @@ impl EngineStroke {
             Self::Brush(s) => s.push(pts),
             Self::Retouch(s) => s.push(pts),
             Self::Dab(s) => s.push(pts),
+            Self::Mixer(s) => s.push(pts),
         }
     }
     /// The jitter seed the commit must reuse (the Clone Stamp's comes from the session brush).
     fn seed(&self) -> Option<u64> {
         match self {
             Self::Brush(s) => Some(s.seed),
+            Self::Mixer(s) => Some(s.seed),
             Self::Retouch(_) => None,
             Self::Dab(_) => None,
         }
@@ -620,6 +631,7 @@ impl EngineStroke {
 /// A stroke shown while it is drawn: the engine renders the real result onto a copy of the
 /// document, and the canvas redraws only what each step changed.
 pub(crate) struct LiveStroke {
+    preview_failed: bool,
     stroke: EngineStroke,
     doc: photocraft_doc::DocId,
     revision: u64,
@@ -706,6 +718,7 @@ pub(crate) fn strokes_live(tool: Tool) -> bool {
         tool,
         Tool::Brush
             | Tool::Pencil
+            | Tool::MixerBrush
             | Tool::Eraser
             | Tool::ColorReplacement
             | Tool::Blur
@@ -854,7 +867,11 @@ fn begin_live_stroke(app: &PhotocraftApp) -> Option<LiveStroke> {
     static STROKES: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
     let st = app.session.active()?;
     let d = app.drag.as_ref()?;
-    let stroke = if d.tool == Tool::ColorReplacement {
+    let stroke = if d.tool == Tool::MixerBrush {
+        let points = app.stylus.stroke_points(&d.points);
+        let p = stroke_params(app, d, points.get(..1)?);
+        EngineStroke::Mixer(Box::new(photocraft_engine::brush_cmds::mixer_live::LiveMixer::begin(&app.session, &p).ok()?))
+    } else if d.tool == Tool::ColorReplacement {
         // The params `retouch_ui::finish_stroke` commits.
         let mut p = crate::retouch_ui::color_replacement_params(app);
         p["points"] = json!(d.points);
@@ -880,7 +897,7 @@ fn begin_live_stroke(app: &PhotocraftApp) -> Option<LiveStroke> {
         EngineStroke::Dab(photocraft_engine::eraser_cmds::live_background_eraser(&app.session, &p).ok()?)
     } else if let Some(cmd) = live_retouch_command(d.tool) {
         // The params `retouch_ui::finish_stroke` commits.
-        let mut p = if d.tool == Tool::HistoryBrush { json!({}) } else { crate::retouch_ui::clone_params(app)? };
+        let mut p = if d.tool == Tool::HistoryBrush { crate::retouch_ui::history_brush_params(app) } else { crate::retouch_ui::clone_params(app)? };
         p["points"] = json!(d.points);
         p["target"] = paint_target(app);
         EngineStroke::Retouch(photocraft_engine::retouch_cmds::LiveRetouch::begin(&app.session, cmd, &p).ok()?)
@@ -890,7 +907,30 @@ fn begin_live_stroke(app: &PhotocraftApp) -> Option<LiveStroke> {
     };
     let n = STROKES.fetch_add(1, std::sync::atomic::Ordering::Relaxed) & 0xff_ffff;
     let damage = vec![stroke.bounds()];
-    Some(LiveStroke { stroke, doc: st.doc.id, revision: st.revision, key: (1 << 44) | (n << 20), damage, fed: d.points.len() })
+    Some(LiveStroke {
+        stroke,
+        doc: st.doc.id,
+        revision: st.revision,
+        key: (1 << 44) | (n << 20),
+        damage,
+        fed: if d.tool == Tool::MixerBrush { 1 } else { d.points.len() },
+        preview_failed: false,
+    })
+}
+
+/// Cancel uncommitted mixer paint when its document, tool or input context goes away.
+pub(crate) fn cancel_mixer_on_context_change(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
+    if !app.drag.as_ref().is_some_and(|drag| drag.tool == Tool::MixerBrush) {
+        return false;
+    }
+    let changed = app.ui.tool != Tool::MixerBrush
+        || app.live_stroke.as_ref().is_some_and(|live| !app.session.active().is_some_and(|st| st.doc.id == live.doc && st.revision == live.revision));
+    if changed || ctx.input_mut(|input| input.consume_key(egui::Modifiers::NONE, egui::Key::Escape)) {
+        app.drag = None;
+        app.live_stroke = None;
+        return true;
+    }
+    false
 }
 
 /// Render the drag points the live stroke hasn't seen yet, with the pen pressure, tilt and
@@ -902,6 +942,9 @@ fn feed_live_stroke(app: &mut PhotocraftApp) {
         return;
     }
     let (Some(l), Some(d)) = (app.live_stroke.as_mut(), app.drag.as_ref()) else { return };
+    if l.preview_failed {
+        return;
+    }
     let pose = &app.stylus.stroke;
     // The same times `stroke_points` gives the commit (from the drag's first point).
     let t0 = app.stylus.point_ms(0);
@@ -922,7 +965,17 @@ fn feed_live_stroke(app: &mut PhotocraftApp) {
     let started = crate::gpu_canvas::now_ms();
     match l.stroke.push(&pts) {
         Ok(r) => l.damage.push(r),
-        Err(_) => app.live_stroke = None,
+        Err(e) => {
+            if d.tool == Tool::MixerBrush {
+                // Keep the last valid preview and its document/revision guard. All input
+                // stays in the drag; release replays it without the preview tile budget.
+                l.preview_failed = true;
+                app.ui.status = e.to_string();
+                app.ui.status_error = true;
+            } else {
+                app.live_stroke = None;
+            }
+        }
     }
     app.stroke_trace.stroke(crate::gpu_canvas::now_ms() - started);
 }
@@ -971,9 +1024,16 @@ fn tap_at_peak_pressure(app: &mut PhotocraftApp) {
         return;
     }
     let peak = f64::from(app.stylus.tap_pressure());
-    if let Some(p) = app.drag.as_mut().filter(|d| d.points.len() == 1).and_then(|d| d.points.first_mut()) {
+    let mut refresh_mixer = false;
+    if let Some(d) = app.drag.as_mut().filter(|d| d.points.len() == 1)
+        && let Some(p) = d.points.first_mut()
+    {
+        refresh_mixer = d.tool == Tool::MixerBrush && peak > p[2];
         p[2] = p[2].max(peak);
     }
+    if refresh_mixer {
+        app.live_stroke = begin_live_stroke(app);
+    }
 }
 
 /// While a stroke is held still, its point repeats this often (in ms) so time-based brush
@@ -1010,6 +1070,7 @@ pub(crate) fn freehand_tool(tool: Tool) -> bool {
             | Tool::BackgroundEraser
             | Tool::HistoryBrush
             | Tool::Remove
+            | Tool::ArtHistoryBrush
             | Tool::SpotHealing
             | Tool::Healing
             | Tool::CloneStamp
@@ -1423,6 +1484,9 @@ pub(crate) fn display_doc(app: &mut PhotocraftApp, idx: usize) -> (std::sync::Ar
     if let Some(shown) = crate::type_font_preview::display_doc(app, idx) {
         return shown;
     }
+    // Vanishing Point's strokes over the document as it is now (the Layers panel may have
+    // changed it since the options bar synced them this frame).
+    crate::vp_ui::sync_preview(app);
     // Puppet / Perspective Warp previews hide the layer they draw on a mesh.
     if let Some(shown) = crate::distort_ui::display_doc(app, idx) {
         return shown;
@@ -1578,7 +1642,7 @@ pub fn navigator_gpu_view(app: &PhotocraftApp, idx: usize, rect: Rect, ctx: &egu
         rotation: 0.0,
         shadow: false,
         pixel_grid: false,
-        view_key: egui::Id::new(("pc-navigator", ctx.viewport_id(), idx)).value(),
+        view_key: egui::Id::unique(("pc-navigator", ctx.viewport_id(), idx)).value(),
         offset: [0.0, 0.0],
         ..params
     })
@@ -1599,7 +1663,7 @@ pub fn navigator_waits_for_gpu(app: &PhotocraftApp, idx: usize, ctx: &egui::Cont
     if app.canvases.keys().any(|(d, _)| *d == id) {
         return false;
     }
-    let key = egui::Id::new(("navigator-waits", id.0));
+    let key = egui::Id::unique(("navigator-waits", id.0));
     let waited = ctx.data(|d| d.get_temp::<u32>(key)).unwrap_or(0);
     if waited >= NAVIGATOR_WAIT_FRAMES {
         return false;
@@ -1976,6 +2040,13 @@ pub(crate) fn damage_since(app: &PhotocraftApp, idx: usize, seen: (u64, u64), no
     {
         return Some(if r.is_empty() { r } else { r.inflate(effect_reach(&st.doc.layers)) });
     }
+    // Between Vanishing Point stamp previews (and the document): the areas the strokes painted.
+    if seen.0 == now.0
+        && let Some(st) = app.session.documents().get(idx)
+        && let Some(r) = crate::vp_ui::damage(app, st.doc.id, now.0, seen.1 ^ display_key, now.1)
+    {
+        return Some(if r.is_empty() { r } else { r.inflate(effect_reach(&st.doc.layers)) });
+    }
     // Between hovered blend modes (and the document): where the layer's blending shows.
     if seen.0 == now.0
         && let Some(st) = app.session.documents().get(idx)
@@ -2737,11 +2808,11 @@ fn tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
             let name_g = crate::tab_strip::elided(ui, &name, font.clone(), t.text, name_max);
             // The title was cut: the tooltip has the rest of it.
             let cut = name_g.size().x + 0.5 < natural_w - STUDIO_TAB_PAD + STUDIO_TAB_GAP - meta_g.size().x;
-            let resp = ui.interact(r, ui.id().with(("dtab", i)), Sense::click_and_drag());
+            let resp = ui.interact(r, ui.scope_id().with(("dtab", i)), Sense::click_and_drag());
             let saving = crate::jobs_ui::save_progress(app, st.doc.id);
             resp.widget_info(|| {
                 let label = saving.as_ref().map_or_else(|| st.doc.name.clone(), |s| format!("{} - {s}", st.doc.name));
-                egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, sel, label)
+                egui::WidgetInfo::selected(egui::Role::Button, true, sel, label)
             });
             doc_tabs.push((i, r));
             if sel {
@@ -2759,7 +2830,7 @@ fn tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
             ui.painter().galley_with_override_text_color(egui::pos2(r.left() + 10.0, ny), name_g.clone(), color);
             ui.painter().galley(egui::pos2(r.left() + 16.0 + name_g.size().x, r.center().y - meta_g.size().y / 2.0), meta_g, t.text_faint);
             let xr = Rect::from_center_size(egui::pos2(r.right() - 12.0, r.center().y), egui::vec2(16.0, 16.0));
-            let xresp = ui.interact(xr, ui.id().with(("dtabx", i)), Sense::click());
+            let xresp = ui.interact(xr, ui.scope_id().with(("dtabx", i)), Sense::click());
             if xresp.hovered() {
                 ui.painter().rect_filled(xr, 4.0, t.hover);
             }
@@ -2786,7 +2857,7 @@ fn tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
             let sel = app.jobs.focus == Some(*job);
             let meta_g = ui.painter().layout_no_wrap(format!("{:.0}%", frac * 100.0), meta_font.clone(), t.text_faint);
             let name_g = crate::tab_strip::elided(ui, name, font.clone(), t.text, (r.width() - STUDIO_TAB_PAD + STUDIO_TAB_GAP - meta_g.size().x).max(1.0));
-            let resp = ui.interact(r, ui.id().with(("dtabjob", job.0)), Sense::click());
+            let resp = ui.interact(r, ui.scope_id().with(("dtabjob", job.0)), Sense::click());
             if sel {
                 ui.painter().rect_filled(r, t.radius_sm, t.card);
                 ui.painter().rect_stroke(r, t.radius_sm, Stroke::new(1.0, t.card_border), egui::StrokeKind::Inside);
@@ -2798,7 +2869,7 @@ fn tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
             ui.painter().galley(egui::pos2(r.left() + 16.0 + name_g.size().x, r.center().y - meta_g.size().y / 2.0), meta_g, t.text_faint);
             crate::jobs_ui::tab_underline(ui, r, *frac, &t);
             let xr = Rect::from_center_size(egui::pos2(r.right() - 12.0, r.center().y), egui::vec2(16.0, 16.0));
-            let xresp = ui.interact(xr, ui.id().with(("dtabjobx", job.0)), Sense::click());
+            let xresp = ui.interact(xr, ui.scope_id().with(("dtabjobx", job.0)), Sense::click());
             if xresp.hovered() {
                 ui.painter().rect_filled(xr, 4.0, t.hover);
             }
@@ -2819,7 +2890,7 @@ fn tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
             // Like Photoshop's, the menu lists every open document, not only the hidden ones, and checks
             // the active one (#4487).
             let every: Vec<usize> = (0..labels.len()).collect();
-            crate::tab_strip::overflow_button(ui, ui.id().with("dtab-overflow"), r, tl!("More documents"), &labels, &every, Some(selected), &mut picked);
+            crate::tab_strip::overflow_button(ui, ui.scope_id().with("dtab-overflow"), r, tl!("More documents"), &labels, &every, Some(selected), &mut picked);
             match picked {
                 Some(i) if i < tab_count => activate = Some(i),
                 Some(i) => focus_open = opening.get(i - tab_count).map(|(job, _, _)| *job).or(focus_open),
@@ -2911,7 +2982,7 @@ fn tab_drag(ui: &egui::Ui, resp: &egui::Response, i: usize, r: Rect, strip: Rect
     {
         if torn_off(strip, p) {
             let ghost = Rect::from_min_size(p - egui::vec2(40.0, 12.0), egui::vec2(240.0, 160.0));
-            let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Tooltip, ui.id().with("tab-tear-off")));
+            let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Tooltip, ui.scope_id().with("tab-tear-off")));
             painter.rect_filled(ghost, t.radius_sm, t.accent.gamma_multiply(0.12));
             painter.rect_stroke(ghost, t.radius_sm, Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
         } else {
@@ -3082,7 +3153,7 @@ fn pro_tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
     for &(i, r) in placed.iter().filter(|(i, _)| *i < tab_count) {
         let Some(title) = titles.get(i) else { continue };
         let g = crate::tab_strip::elided(ui, title, font.clone(), t.text, (r.width() - DOC_TAB_PAD).max(1.0));
-        let resp = ui.interact(r, ui.id().with(("ptab", i)), Sense::click_and_drag());
+        let resp = ui.interact(r, ui.scope_id().with(("ptab", i)), Sense::click_and_drag());
         let sel = Some(i) == active;
         if sel {
             ui.painter().rect_filled(r, 0.0, t.chrome);
@@ -3095,10 +3166,10 @@ fn pro_tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
         }
         ui.painter().line_segment([r.right_top(), r.right_bottom()], Stroke::new(1.0, t.separator));
         let (xr, at) = pro_tab_layout(r, g.size().y, mac);
-        let xresp = ui.interact(xr, ui.id().with(("ptabx", i)), Sense::click());
+        let xresp = ui.interact(xr, ui.scope_id().with(("ptabx", i)), Sense::click());
         // Painted: name the tab and its × for accessibility (and so tests and agents can find them).
-        resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, sel, g.text()));
-        xresp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Close")));
+        resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, sel, g.text()));
+        xresp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Close")));
         crate::icons::paint(ui, xr, "x", 10.0, if xresp.hovered() { t.text } else { t.text_faint });
         ui.painter().galley_with_override_text_color(at, g, if sel { t.text } else { t.text_faint });
         let cut = natural.get(i).copied().unwrap_or(0.0) > r.width() + 0.5;
@@ -3123,7 +3194,7 @@ fn pro_tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
         let Some((job, _, frac)) = opening.get(i - tab_count) else { continue };
         let Some(title) = titles.get(i) else { continue };
         let g = crate::tab_strip::elided(ui, title, font.clone(), t.text, (r.width() - DOC_TAB_PAD).max(1.0));
-        let resp = ui.interact(r, ui.id().with(("ptabjob", job.0)), Sense::click());
+        let resp = ui.interact(r, ui.scope_id().with(("ptabjob", job.0)), Sense::click());
         let sel = app.jobs.focus == Some(*job);
         if sel {
             ui.painter().rect_filled(r, 0.0, t.chrome);
@@ -3133,8 +3204,8 @@ fn pro_tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
         ui.painter().line_segment([r.right_top(), r.right_bottom()], Stroke::new(1.0, t.separator));
         crate::jobs_ui::tab_underline(ui, r, *frac, &t);
         let (xr, at) = pro_tab_layout(r, g.size().y, mac);
-        let xresp = ui.interact(xr, ui.id().with(("ptabjobx", job.0)), Sense::click());
-        xresp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Close")));
+        let xresp = ui.interact(xr, ui.scope_id().with(("ptabjobx", job.0)), Sense::click());
+        xresp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Close")));
         crate::icons::paint(ui, xr, "x", 10.0, if xresp.hovered() { t.text } else { t.text_faint });
         ui.painter().galley_with_override_text_color(at, g, if sel { t.text } else { t.text_faint });
         if xresp.on_hover_text(tl!("Cancel opening")).clicked() {
@@ -3152,7 +3223,7 @@ fn pro_tabs(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> TabStrip {
         // Like Photoshop's, the menu lists every open document, not only the hidden ones, and checks
         // the active one (#4487).
         let every: Vec<usize> = (0..labels.len()).collect();
-        crate::tab_strip::overflow_button(ui, ui.id().with("ptab-overflow"), r, tl!("More documents"), &labels, &every, Some(selected), &mut picked);
+        crate::tab_strip::overflow_button(ui, ui.scope_id().with("ptab-overflow"), r, tl!("More documents"), &labels, &every, Some(selected), &mut picked);
         match picked {
             Some(i) if i < tab_count => activate = Some(i),
             Some(i) => focus_open = opening.get(i - tab_count).map(|(job, _, _)| *job).or(focus_open),
@@ -3235,7 +3306,7 @@ fn dots(ctx: &egui::Context, t: &crate::theme::Tokens) -> Option<egui::TextureId
     if t.bevel || t.canvas_dot == t.canvas {
         return None;
     }
-    let key = egui::Id::new(("canvas-dots", format!("{:?}", t.kind)));
+    let key = egui::Id::unique(("canvas-dots", format!("{:?}", t.kind)));
     if let Some(tex) = ctx.data(|d| d.get_temp::<egui::TextureHandle>(key)) {
         return Some(tex.id());
     }
@@ -3285,7 +3356,7 @@ pub fn mode_label(doc: &Document) -> &'static str {
 /// (#5367), and so does the Home screen's blank background. Registered before anything drawn over
 /// `area`, so the buttons and links there keep their own clicks; not a keyboard focus stop.
 fn open_on_double_click(app: &mut PhotocraftApp, ui: &egui::Ui, area: Rect) {
-    if app.session.documents().is_empty() && ui.interact(area, ui.id().with("empty-workspace"), Sense::CLICK).double_clicked() {
+    if app.session.documents().is_empty() && ui.interact(area, ui.scope_id().with("empty-workspace"), Sense::CLICK).double_clicked() {
         let _ = app.open_dialog_file();
     }
 }
@@ -3424,12 +3495,12 @@ fn home_recent(app: &mut PhotocraftApp, ui: &mut egui::Ui, recent: &[String]) {
             let fg = crate::tab_strip::elided(ui, &folder, egui::FontId::proportional(11.5), t.text_faint, folder_max);
             ui.painter().galley(egui::pos2(right - fg.size().x, row.center().y - fg.size().y / 2.0), fg, t.text_faint);
         }
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &name));
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &name));
         let resp = resp.on_hover_text(path).on_hover_cursor(egui::CursorIcon::PointingHand);
         if hovered {
             let x = ui.interact(close, resp.id.with("remove"), Sense::click());
             let label = crate::i18n::fmt(tl!("Remove {name} from Recent"), &[("name", &name)]);
-            x.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &label));
+            x.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &label));
             let color = crate::icons::button_chrome(ui, close, false, x.hovered());
             crate::icons::paint(ui, close, "x", 12.0, color);
             if x.on_hover_text(tl!("Remove from Recent")).clicked() {
@@ -3541,7 +3612,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
     // too, as in Photoshop (#6017).
     let rect = crate::rulers::content_rect(app, rect);
     // Both wheel reads share one owner so snap-zoom input is accumulated only once per frame.
-    let wheel_owner = ui.id().with(("canvas-wheel", idx));
+    let wheel_owner = ui.scope_id().with(("canvas-wheel", idx));
     // Direct navigation starts from the authoritative camera. This also means a click or drag
     // never maps through a camera that is still moving under the pointer.
     let (pointer_here, hover_here) = ctx.input(|i| {
@@ -3556,6 +3627,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
                 &ctx,
                 app.session.prefs().general.zoom_with_scroll_wheel,
                 app.session.prefs().enhanced_controls.zoom_with_trackpad_pinch,
+                app.session.prefs().general.animated_zoom,
                 wheel_owner,
                 hover_here,
                 app.session.prefs().interface.enable_animations,
@@ -3668,7 +3740,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
                     !t.bevel && !t.pro && drop_shadow
                 },
                 pixel_grid: false,
-                view_key: egui::Id::new(("pc-canvas-proxy", ctx.viewport_id(), idx)).value(),
+                view_key: egui::Id::unique(("pc-canvas-proxy", ctx.viewport_id(), idx)).value(),
                 display: sync_display_lut(app, &shown, key, output),
                 output: output.unwrap_or(0),
                 hdr: hdr_preview(app, &doc),
@@ -3690,7 +3762,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
                     !t.bevel && !t.pro && drop_shadow
                 },
                 pixel_grid,
-                view_key: egui::Id::new(("pc-canvas", ctx.viewport_id(), idx)).value(),
+                view_key: egui::Id::unique(("pc-canvas", ctx.viewport_id(), idx)).value(),
                 display: sync_display_lut(app, &doc, doc.id.0, output),
                 output: output.unwrap_or(0),
                 hdr: hdr_preview(app, &doc),
@@ -3706,8 +3778,11 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
             app.navigator_gpu.remove(&doc.id);
             // A document too large for one full-resolution texture also gets the part in view at
             // the screen's resolution, drawn over the reduced whole (#7568).
-            let in_view =
-                InView { visible: visible_doc_rect(&xf), zoom: view.zoom, key: egui::Id::new(("pc-canvas-detail", ctx.viewport_id(), idx, primary)).value() };
+            let in_view = InView {
+                visible: visible_doc_rect(&xf),
+                zoom: view.zoom,
+                key: egui::Id::unique(("pc-canvas-detail", ctx.viewport_id(), idx, primary)).value(),
+            };
             let textures = ensure_texture_in_view(app, &ctx, idx, output, Some(in_view));
             let tex = textures.as_ref().map(|t| t.texture);
             // The area the image covers: a size-changing preview's own (Image › Rotation).
@@ -3920,10 +3995,11 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
     }
     // Navigation (wheel_nav.rs): scroll pans (⇧ or ⌘/Ctrl sideways); pinch and ⌥-scroll zoom around the pointer.
     // The wheel also scrolls over the scrollbars drawn on top of the canvas (last frame's hover).
-    let bars_id = egui::Id::new(("pc-canvas-bars-hover", idx));
+    let bars_id = egui::Id::unique(("pc-canvas-bars-hover", idx));
     let over_bars = ctx.data(|d| d.get_temp::<bool>(bars_id)).unwrap_or(false);
     let nav_hovered = response.hovered() || free_hover || over_bars;
     // Interface › Enable Animations off: the wheel moves the canvas without a glide (#5721).
+    // General › Animated Zoom: the wheel zoom eases over the frames of a notch, or is one instant step.
     // Enhanced Controls › Enable Gestures off: two fingers on a touch screen neither zoom nor
     // turn the view (#204); the mouse and trackpad are unaffected.
     let touch_gestures = app.session.prefs().enhanced_controls.touch_gestures;
@@ -3931,6 +4007,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
         &ctx,
         app.session.prefs().general.zoom_with_scroll_wheel,
         app.session.prefs().enhanced_controls.zoom_with_trackpad_pinch,
+        app.session.prefs().general.animated_zoom,
         wheel_owner,
         nav_hovered,
         app.session.prefs().interface.enable_animations,
@@ -3943,6 +4020,9 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
                 // At a limit the view stays put, as in Photoshop: a notch past 12800 % neither
                 // zooms nor slides the image towards the pointer.
                 let nz = crate::zoom_levels::clamp(view.zoom * f, view.doc_size);
+                if nz != view.zoom * f {
+                    crate::wheel_nav::settle(&ctx, wheel_owner);
+                }
                 if nz != view.zoom {
                     // Over the pasteboard the anchor is the image's nearest point (#3720).
                     let at = wheel_anchor(&xf, p, view.doc_size);
@@ -4143,7 +4223,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
     let transform_owns_pointer = primary && app.ui.transform.is_some() && temporary.is_none() && !middle;
     let hand_pan = tool == Tool::Hand && !transform_owns_pointer;
     // Preferences › Tools › Enable Flick Panning: a Hand drag let go while moving glides on.
-    let flick_id = egui::Id::new(("pc-flick-pan", idx, primary, ctx.viewport_id()));
+    let flick_id = egui::Id::unique(("pc-flick-pan", idx, primary, ctx.viewport_id()));
     let flick_on = app.session.prefs().tools.enable_flick_panning;
     if let Some(d) = crate::flick_pan::frame(&ctx, flick_id, hand_pan && response.dragged() && !stroke_dismissal, response.drag_delta(), flick_on) {
         let d = xf.unmap_vec(d) / (view.zoom / ppp);
@@ -4186,7 +4266,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
     } else if primary && !stroke_dismissal {
         let mods = ui.input(|i| i.modifiers);
         // An ⌥-click the window manager took never arrives; say so (alt_grab.rs).
-        crate::alt_grab::watch(app, &ctx, egui::Id::new(("pc-alt-grab", idx)), rect, tool, !under_dialog);
+        crate::alt_grab::watch(app, &ctx, egui::Id::unique(("pc-alt-grab", idx)), rect, tool, !under_dialog);
         // Tools follow the left button; the right one opens the Brush Preset picker or erases
         // (Preferences › Tools, `paint_mouse`).
         crate::paint_mouse::sync_tool_brush(app);
@@ -4200,7 +4280,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
         // Type transforms keep Command; selections keep Add/Subtract if Shift/Alt is released.
         let capture_press = tool.is_type()
             || matches!(tool, Tool::RectMarquee | Tool::EllipseMarquee | Tool::SingleRowMarquee | Tool::SingleColumnMarquee | Tool::ObjectSelection);
-        let tool_press = egui::Id::new(("tool-pointer-press-modifiers", idx));
+        let tool_press = egui::Id::unique(("tool-pointer-press-modifiers", idx));
         if capture_press
             && let Some((p, press_mods)) = ui.input(|i| {
                 i.events.iter().find_map(|e| match e {
@@ -4268,9 +4348,18 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
             && !crate::layer_pick_ui::is_gesture(tool, mods)
             && let Some(p) = response.interact_pointer_pos()
         {
+            // A pending crop: its menu, also outside the image, where the frame can reach (#6561).
             // Outside the image: the pasteboard colour menu (#2462), else the tool's own. The view
-            // menu belongs to the selected Zoom or Hand, not to Space or a held zoom key.
-            if crate::canvas_tool_menu::pasteboard_at(app, tool, xf.to_doc(p)) {
+            // menu belongs to the selected Zoom or Hand, not to Space or a held zoom key. A crop
+            // frame or Straighten line still dragged by the left button gets no menu over it: the
+            // gesture and the held button both, as either alone can outlive a lost release. A
+            // finger held still (egui's press-and-hold right-click) is down too, but drags nothing.
+            let crop_gesture = tool == Tool::Crop
+                && !response.long_touched()
+                && (app.crop.drag.is_some() || app.crop.straighten.line.is_some())
+                && ctx.input(|i| i.pointer.primary_down());
+            if crop_gesture || crate::canvas_tool_menu::open_crop(app, &ctx, tool, [p.x, p.y]) {
+            } else if crate::canvas_tool_menu::pasteboard_at(app, tool, xf.to_doc(p)) {
                 crate::canvas_tool_menu::open_pasteboard(app, &ctx, tool, [p.x, p.y]);
             } else if crate::canvas_tool_menu::is_view_tool(tool) {
                 if tool == app.ui.tool {
@@ -4334,7 +4423,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
         let press_stroke = app.press_stroke;
         // A live tool's press that went to the ⌥ eyedropper keeps sampling for the whole press: the
         // drag recognised later must not decide again with ⌥ already let go and paint (#7802).
-        if press_stroke || (strokes_live(tool) && app.alt_sampling) {
+        if press_stroke || (strokes_live(tool) && (app.alt_sampling || app.mixer_sampling)) {
             buttons.started = false;
         }
         if buttons.started
@@ -4641,6 +4730,9 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
         });
         if panning {
             // The fist set with the pan above stays (#2196).
+        } else if crate::tool_cursor::pointer_elsewhere(&ctx, &crate::panel_docking::native_viewports(app, &ctx)) {
+            // The pointer is over a floating panel's own window; this window's last position of
+            // it is stale, so no tool cursor or brush outline is painted at it.
         } else if let Some((vertical, _)) = guide_hover {
             ui.ctx().set_cursor_icon(crate::rulers::guide_cursor(&xf, vertical));
         } else if let Some(p) = response.hover_pos()
@@ -4911,7 +5003,7 @@ pub fn canvas_view(app: &mut PhotocraftApp, ui: &mut egui::Ui, idx: usize, rect:
     let t0 = crate::gpu_canvas::now_ms();
     let before = view.center;
     let over_bars = app.ui.view.shows_scrollbars()
-        && crate::scrollbars::show(ui, rect, &mut view, flip, aspect, app.session.prefs().tools.overscroll, egui::Id::new(("pc-canvas", idx)));
+        && crate::scrollbars::show(ui, rect, &mut view, flip, aspect, app.session.prefs().tools.overscroll, egui::Id::unique(("pc-canvas", idx)));
     ctx.data_mut(|d| d.insert_temp(bars_id, over_bars));
     if view.center != before {
         ctx.request_repaint();
@@ -5006,7 +5098,7 @@ fn paint_gpu_view(painter: &egui::Painter, rect: Rect, params: crate::gpu_canvas
             offset: crate::pattern_preview::offset(c, params.doc_size),
             shadow: false,
             // Keyed by slot, not by tile index, so panning reuses the same few uniform buffers.
-            view_key: egui::Id::new((params.view_key, "pattern", k)).value(),
+            view_key: egui::Id::unique((params.view_key, "pattern", k)).value(),
             ..params
         };
         crate::gpu_canvas::GpuCanvas::paint(painter, rect, copy);
@@ -5310,7 +5402,7 @@ fn ring(outer: DRect, inner: DRect) -> Vec<DRect> {
 fn draw_beyond_canvas(app: &mut PhotocraftApp, painter: &egui::Painter, xf: &ViewXform, idx: usize, output: Option<u32>) -> bool {
     let ctx = painter.ctx().clone();
     let Some((snapshot, id)) = app.session.documents().get(idx).map(|st| (std::sync::Arc::downgrade(&st.doc), st.doc.id)) else { return false };
-    let key = egui::Id::new(("crop-beyond-canvas", id.0, output));
+    let key = egui::Id::unique(("crop-beyond-canvas", id.0, output));
     let frame =
         app.ui.crop_rect.filter(|f| f.iter().all(|v| v.is_finite()) && app.session.active_index() == Some(idx) && crate::crop_ui::shows_beyond_canvas(app));
     let Some(f) = frame else {
@@ -5921,6 +6013,30 @@ pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers)
     if crate::cam_transform::pointer(app, ev, mods) {
         return;
     }
+    // A Mixer Brush press that loaded paint stays a sample press until it is released, with ⌥
+    // let go or not (`mixer_sampling`; `canvas_view` holds back egui's later drag start too).
+    match ev {
+        ToolEvent::Down { .. } => app.mixer_sampling = false,
+        ToolEvent::Up { .. } if app.mixer_sampling => {
+            app.mixer_sampling = false;
+            return;
+        }
+        _ if app.mixer_sampling => return,
+        _ => {}
+    }
+    // The tool in use, so a held temporary tool (⌘ = Move) with ⌥ doesn't load paint.
+    if app.active_tool() == Tool::MixerBrush && mods.alt && !mods.ctrl && app.drag.is_none() && !armed && app.brush_resize.is_none() {
+        if let ToolEvent::Down { x, y, pressure } = ev {
+            app.mixer_sampling = true;
+            let pen = app.stylus.sample().unwrap_or_default();
+            let p = json!({"points":[[x,y,pressure,pen.tilt_x,pen.tilt_y,pen.rotation]],"target":paint_target(app)});
+            if let Err(e) = app.run("brush.mixer.sample", p) {
+                app.ui.status = e;
+                app.ui.status_error = true;
+            }
+        }
+        return;
+    }
     // View › Snap / Snap To and smart guides (snap_ui.rs).
     let raw = ev;
     // The Move tool's marquee selecting layers takes its moves and release unsnapped (move_box.rs).
@@ -6223,7 +6339,8 @@ pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers)
                 Tool::PaintBucket => {
                     let o = app.ui.tool_options.clone();
                     let contents = if o.bucket_fill_pattern { "pattern" } else { "foreground" };
-                    let _ = app.run("paint.bucket", json!({"x": x.floor(), "y": y.floor(), "tolerance": o.tolerance, "contiguous": o.contiguous, "antiAlias": o.anti_alias, "sampleAllLayers": o.sample_all.paint_bucket, "opacity": o.fill_opacity, "contents": contents, "target": paint_target(app)}));
+                    let mode = if o.bucket_clear { "clear" } else { o.bucket_blend_mode.label() };
+                    let _ = app.run("paint.bucket", json!({"x": x.floor(), "y": y.floor(), "tolerance": o.tolerance, "contiguous": o.contiguous, "antiAlias": o.anti_alias, "sampleAllLayers": o.sample_all.paint_bucket, "opacity": o.fill_opacity, "contents": contents, "mode": mode, "target": paint_target(app)}));
                     return;
                 }
                 Tool::RedEye => {
@@ -6283,6 +6400,23 @@ pub fn tool_event(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers)
                 app.stylus.record_point();
             }
             app.live_stroke = if strokes_live(tool) { begin_live_stroke(app) } else { None };
+            if tool == Tool::MixerBrush && app.live_stroke.is_none() {
+                use photocraft_engine::brush_cmds::mixer_live::LiveMixer;
+                let p = app.drag.as_ref().map(|d| stroke_params(app, d, &app.stylus.stroke_points(&d.points)));
+                // A tip above the preview size keeps the drag: `finish_gesture` renders it on release.
+                // Otherwise the first dab itself is invalid. Do not queue an unexpected release edit.
+                if let Some(p) = p
+                    && !LiveMixer::defers_to_release(&app.session, &p).is_ok_and(|deferred| deferred)
+                {
+                    if let Err(e) = LiveMixer::begin(&app.session, &p) {
+                        app.ui.status = e.to_string();
+                        app.ui.status_error = true;
+                    }
+                    app.drag = None;
+                }
+            } else if tool == Tool::MixerBrush {
+                feed_live_stroke(app);
+            }
         }
         ToolEvent::Move { x, y, pressure } => {
             // Polygonal Lasso: ⌥ held while the button is down draws freehand into the polygon;
@@ -6604,6 +6738,12 @@ fn snap_aliased_tip(app: &PhotocraftApp, tool: Tool, x: f64, y: f64) -> (f64, f6
 }
 
 pub(crate) fn finish_gesture(app: &mut PhotocraftApp, d: Drag) {
+    // Control can select a different tool and release before the next frame cancels the drag.
+    // Cancel before even recording a Shift-stroke anchor, including the preview fallback paths.
+    if d.tool == Tool::MixerBrush && app.ui.tool != Tool::MixerBrush {
+        app.live_stroke = None;
+        return;
+    }
     let mut end = d.points.last().copied().unwrap_or([d.start[0], d.start[1], 1.0]);
     let (sx, sy) = snap_aliased_tip(app, d.tool, end[0], end[1]);
     end[0] = sx;
@@ -6618,6 +6758,44 @@ pub(crate) fn finish_gesture(app: &mut PhotocraftApp, d: Drag) {
     {
         app.last_stroke_end = Some((st.doc.id, end));
     }
+    if d.tool == Tool::MixerBrush {
+        // The release can carry a new endpoint, including moves deferred in this frame.
+        // Feed those samples before offering the already-rendered document for commit.
+        app.drag = Some(d);
+        let deferred = std::mem::replace(&mut app.defer_live_stroke, false);
+        feed_live_stroke(app);
+        app.defer_live_stroke = deferred;
+        let Some(d) = app.drag.take() else { return };
+        let live = app.live_stroke.take();
+        if let Some(l) = live {
+            let (doc, key, steps) = (l.doc, l.key, l.damage.len() as u64);
+            if let EngineStroke::Mixer(mixer) = l.stroke {
+                if l.preview_failed {
+                    let mut p = stroke_params(app, &d, &app.stylus.stroke_points(&d.points));
+                    p["seed"] = json!(mixer.seed);
+                    drop(mixer);
+                    let _ = app.run("paint.mixerBrush", p);
+                    return;
+                }
+                match mixer.prepare_commit(&mut app.session) {
+                    Ok(p) => {
+                        if app.run("paint.mixerBrush", p).is_ok() {
+                            shown_as_document(app, doc, |k| k == 0 || (key..=key + steps).contains(&k));
+                        }
+                    }
+                    Err(e) => {
+                        app.ui.status = e.to_string();
+                        app.ui.status_error = true;
+                    }
+                }
+            }
+        } else {
+            // No preview (a tip above its size): render the whole stroke now.
+            let p = stroke_params(app, &d, &app.stylus.stroke_points(&d.points));
+            let _ = app.run("paint.mixerBrush", p);
+        }
+        return;
+    }
     // A live retouching preview ends here; the commit below replaces it (the Clone Stamp's,
     // History Brush's and sequential-dab tools' with the pixels it already drew).
     offer_live_retouch(app, &d);
@@ -6884,9 +7062,13 @@ pub fn paint_target(app: &PhotocraftApp) -> serde_json::Value {
         ChannelTarget::LayerMask => return json!("mask"),
         _ => {}
     }
+    // A smart object's targeted (or shown) filter mask takes the paint (FILE-215-3).
+    if app.filter_mask_targeted() {
+        return json!("filterMask");
+    }
     let has_mask = st.active_layer.and_then(|id| st.doc.layer(id)).is_some_and(|l| l.mask.is_some());
     // Viewing the mask (⌥-click its thumbnail, #196) paints the mask.
-    let viewing = photocraft_engine::mask_view_cmds::current(st).is_some();
+    let viewing = photocraft_engine::mask_view_cmds::current(st).is_some_and(|v| !v.filter);
     let mask = app.ui.mask_target || viewing || crate::adjustment_layer_active(st);
     json!(if mask && has_mask { "mask" } else { "pixels" })
 }
@@ -8099,7 +8281,7 @@ mod tests {
         let revision = app.session.active().unwrap().revision;
         let mut output = ctx.run_ui(Default::default(), |ui| {
             let ctx = ui.ctx();
-            let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("clone-test")));
+            let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::unique("clone-test")));
             draw_clone_preview(&mut app, &painter, &xf, [32.0, 32.0], None);
         });
         output.textures_delta.clear();
@@ -8119,7 +8301,7 @@ mod tests {
         let ordinary_key = app.clone_preview.as_ref().unwrap().key.clone();
         app.ui.view.pattern_preview = true;
         let mut periodic_output = ctx.run_ui(Default::default(), |ui| {
-            let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("clone-test")));
+            let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::unique("clone-test")));
             draw_clone_preview(&mut app, &painter, &xf, [32.0, 32.0], None);
         });
         assert_ne!(app.clone_preview.as_ref().unwrap().key, ordinary_key, "toggling Pattern Preview invalidates source pixels");
@@ -8129,7 +8311,7 @@ mod tests {
         app.session.presets.clone.overlay.show = false;
         let mut output = ctx.run_ui(Default::default(), |ui| {
             let ctx = ui.ctx();
-            let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("clone-test")));
+            let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::unique("clone-test")));
             draw_clone_preview(&mut app, &painter, &xf, [32.0, 32.0], None);
         });
         output.textures_delta.clear();
@@ -8173,7 +8355,7 @@ mod tests {
         let mut centre = |mode: &str| {
             app.run("cloneSource.overlay", json!({"blend": mode})).unwrap();
             let mut output = ctx.run_ui(Default::default(), |ui| {
-                let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("clone-test")));
+                let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::unique("clone-test")));
                 draw_clone_preview(&mut app, &painter, &xf, [32.0, 32.0], None);
             });
             // The brush's 20 × 20 px square (the font atlas may upload too).
@@ -8204,7 +8386,7 @@ mod tests {
         let xf =
             ViewXform { rect: Rect::from_min_size(Pos2::ZERO, vec2(100.0, 100.0)), zoom: 1.0, center: [32.0, 32.0], flip: false, rotation: 0.0, aspect: 1.0 };
         let mut output = ctx.run_ui(Default::default(), |ui| {
-            let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("clone-test")));
+            let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::unique("clone-test")));
             draw_clone_preview(&mut app, &painter, &xf, [32.0, 32.0], None);
         });
         let image = output
@@ -8702,6 +8884,222 @@ mod tests {
         }
     }
 
+    /// The held drag shows true mixed paint while Alt sampling remains separate from painting.
+    #[test]
+    fn mixer_drag_shows_actual_mixed_paint_before_release_and_alt_never_paints() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+        app.run("file.new", json!({"width":120,"height":60,"background":"#00ff00"})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("tools.setColors", json!({"foreground":"#ff0000"})).unwrap();
+        app.run("tools.setBrush", json!({"brush":{"size":16,"mixer":{"wet":1.0,"mix":0.7,"sampleAllLayers":true},"smoothing":{"amount":0.0}}})).unwrap();
+        app.ui.tool = Tool::MixerBrush;
+        let before = app.session.active().unwrap().doc.clone();
+        let count = app.session.active().unwrap().history.past_len();
+        let alt = egui::Modifiers { alt: true, ..Default::default() };
+        tool_event(&mut app, ToolEvent::Down { x: 30.0, y: 30.0, pressure: 1.0 }, alt);
+        tool_event(&mut app, ToolEvent::Move { x: 35.0, y: 30.0, pressure: 1.0 }, egui::Modifiers::NONE);
+        tool_event(&mut app, ToolEvent::Up { x: 35.0, y: 30.0 }, egui::Modifiers::NONE);
+        assert!(app.drag.is_none());
+        assert!(app.session.tools.mixer.spatial.is_some());
+        assert!(std::sync::Arc::ptr_eq(&before, &app.session.active().unwrap().doc));
+        app.run("brush.mixer.load", json!({})).unwrap();
+        tool_event(&mut app, ToolEvent::Down { x: 20.0, y: 30.0, pressure: 1.0 }, egui::Modifiers::NONE);
+        tool_event(&mut app, ToolEvent::Move { x: 70.0, y: 30.0, pressure: 0.6 }, egui::Modifiers::NONE);
+        assert!(app.live_stroke.is_some());
+        let shown = display_doc(&mut app, 0).0;
+        let id = app.session.active().unwrap().active_layer.unwrap();
+        let pixel = shown.layer(id).unwrap().surface().unwrap().rgba(45, 30);
+        assert!(pixel[0] > 0.0 && pixel[1] > 0.0 && pixel[3] > 0.0, "actual red/green mixture {pixel:?}");
+        assert!(std::sync::Arc::ptr_eq(&before, &app.session.active().unwrap().doc));
+        assert_eq!(app.session.active().unwrap().history.past_len(), count);
+        tool_event(&mut app, ToolEvent::Up { x: 70.0, y: 30.0 }, egui::Modifiers::NONE);
+        let st = app.session.active().unwrap();
+        assert_eq!(st.history.past_len(), count + 1);
+        assert_eq!(
+            shown.layer(id).unwrap().surface().unwrap().read_region(before.bounds()),
+            st.doc.layer(id).unwrap().surface().unwrap().read_region(before.bounds())
+        );
+        app.session.undo();
+        assert_eq!(app.session.active().unwrap().doc.layer(id).unwrap().surface().unwrap().rgba(45, 30)[3], 0.0);
+    }
+
+    /// Release incorporates its final endpoint and deferred samples in both live and fallback paths.
+    #[test]
+    fn mixer_release_includes_a_new_endpoint_and_deferred_frame_samples() {
+        for (deferred, failed) in [(false, false), (true, false), (false, true)] {
+            let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+            app.run("file.new", json!({"width":120,"height":60,"background":"#00ff00"})).unwrap();
+            app.run("layer.new.layer", json!({})).unwrap();
+            app.run("tools.setBrush", json!({"size":12,"pressureSize":false})).unwrap();
+            app.ui.tool = Tool::MixerBrush;
+            let before = app.session.active().unwrap().doc.clone();
+            let m = egui::Modifiers::NONE;
+            tool_event(&mut app, ToolEvent::Down { x: 20.0, y: 30.0, pressure: 1.0 }, m);
+            app.defer_live_stroke = deferred;
+            if failed {
+                app.live_stroke.as_mut().unwrap().preview_failed = true;
+            }
+            tool_event(&mut app, ToolEvent::Move { x: 50.0, y: 30.0, pressure: 1.0 }, m);
+            tool_event(&mut app, ToolEvent::Up { x: 95.0, y: 30.0 }, m);
+            let doc = app.session.active().unwrap().doc.clone();
+            let id = app.session.active().unwrap().active_layer.unwrap();
+            assert!(doc.layer(id).unwrap().surface().unwrap().rgba(92, 30)[3] > 0.0);
+            let params = app.session.journal.iter().rev().find(|(name, _)| name == "paint.mixerBrush").unwrap().1.clone();
+            app.run("edit.undo", json!({})).unwrap();
+            assert_eq!(*app.session.active().unwrap().doc, *before);
+            app.run("paint.mixerBrush", params).unwrap();
+            assert_eq!(*app.session.active().unwrap().doc, *doc);
+        }
+    }
+
+    /// Reproduce a tool change and release in one control call, before a UI frame can cancel the old gesture.
+    #[test]
+    fn mixer_control_tool_switch_before_release_cancels_every_preview_path() {
+        for preview in 0..3 {
+            let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+            app.run("file.new", json!({"width":120,"height":60,"background":"#00ff00"})).unwrap();
+            app.run("layer.new.layer", json!({})).unwrap();
+            app.run("tools.setBrush", json!({"size":12,"pressureSize":false})).unwrap();
+            let before = app.session.active().unwrap().doc.clone();
+            let steps = app.session.active().unwrap().history.past_len();
+            let anchor = app.last_stroke_end;
+            let ctx = egui::Context::default();
+            let (request, _reply) = crate::control::ControlRequest::new(
+                "ui.pointer",
+                json!({"tool":"mixerBrush","events":[{"kind":"down","x":20,"y":30},{"kind":"move","x":50,"y":30}]}),
+            );
+            let _ = crate::control::handle(&mut app, &ctx, &request);
+            assert!(app.drag.is_some() && app.live_stroke.is_some());
+            if preview == 1 {
+                app.live_stroke.as_mut().unwrap().preview_failed = true;
+            } else if preview == 2 {
+                app.live_stroke = None;
+            }
+            // No intervening UI frame: control selects the new tool before dispatching Up.
+            let (request, _reply) = crate::control::ControlRequest::new("ui.pointer", json!({"tool":"brush","events":[{"kind":"up","x":95,"y":30}]}));
+            let _ = crate::control::handle(&mut app, &ctx, &request);
+            assert_eq!(app.ui.tool, Tool::Brush);
+            assert!(app.drag.is_none() && app.live_stroke.is_none());
+            assert!(std::sync::Arc::ptr_eq(&before, &app.session.active().unwrap().doc));
+            assert_eq!(app.session.active().unwrap().history.past_len(), steps);
+            assert_eq!(app.last_stroke_end, anchor);
+            assert!(!app.session.journal.iter().any(|(id, _)| id == "paint.mixerBrush"));
+        }
+    }
+
+    /// Escape and tool changes cancel both ordinary previews and failed-preview fallback gestures.
+    #[test]
+    fn mixer_escape_and_tool_switch_cancel_without_an_edit() {
+        for mode in 0..4 {
+            let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+            app.run("file.new", json!({"width":120,"height":60,"background":"#00ff00"})).unwrap();
+            app.run("layer.new.layer", json!({})).unwrap();
+            app.ui.tool = Tool::MixerBrush;
+            let before = app.session.active().unwrap().doc.clone();
+            let steps = app.session.active().unwrap().history.past_len();
+            tool_event(&mut app, ToolEvent::Down { x: 30.0, y: 30.0, pressure: 1.0 }, egui::Modifiers::NONE);
+            assert!(app.live_stroke.is_some());
+            if mode >= 2 {
+                app.live_stroke.as_mut().unwrap().preview_failed = true;
+            }
+            let mode = mode % 2;
+            let ctx = egui::Context::default();
+            let mut raw = egui::RawInput { focused: true, ..Default::default() };
+            if mode == 0 {
+                raw.events.push(egui::Event::Key {
+                    key: egui::Key::Escape,
+                    physical_key: None,
+                    pressed: true,
+                    repeat: false,
+                    modifiers: egui::Modifiers::NONE,
+                });
+            }
+            if mode == 1 {
+                app.ui.tool = Tool::Brush;
+            }
+            ctx.begin_pass(raw);
+            assert!(cancel_mixer_on_context_change(&mut app, &ctx));
+            let mut output = ctx.end_pass();
+            output.textures_delta.clear();
+            tool_event(&mut app, ToolEvent::Up { x: 30.0, y: 30.0 }, egui::Modifiers::NONE);
+            assert!(app.drag.is_none() && app.live_stroke.is_none());
+            assert!(std::sync::Arc::ptr_eq(&before, &app.session.active().unwrap().doc));
+            assert_eq!(app.session.active().unwrap().history.past_len(), steps);
+        }
+    }
+
+    /// Control-driven strokes remain live in a background window, matching the ordinary Brush.
+    #[test]
+    fn mixer_background_window_keeps_and_commits_control_strokes() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+        app.run("file.new", json!({"width":120,"height":60,"background":"transparent"})).unwrap();
+        app.run("tools.setBrush", json!({"brush":{"size":12,"pressureSize":false}})).unwrap();
+        let steps = app.session.active().unwrap().history.past_len();
+        let ctx = egui::Context::default();
+        ctx.begin_pass(egui::RawInput { focused: false, ..Default::default() });
+        let (request, _reply) = crate::control::ControlRequest::new(
+            "ui.pointer",
+            json!({"tool":"mixerBrush","events":[{"kind":"down","x":20,"y":30},{"kind":"move","x":60,"y":30}]}),
+        );
+        let _ = crate::control::handle(&mut app, &ctx, &request);
+        assert!(!cancel_mixer_on_context_change(&mut app, &ctx));
+        assert!(app.drag.is_some());
+        let (request, _reply) = crate::control::ControlRequest::new("ui.pointer", json!({"tool":"mixerBrush","events":[{"kind":"up","x":95,"y":30}]}));
+        let _ = crate::control::handle(&mut app, &ctx, &request);
+        let mut output = ctx.end_pass();
+        output.textures_delta.clear();
+        assert_eq!(app.session.active().unwrap().history.past_len(), steps + 1);
+        assert!(app.session.journal.iter().any(|(id, _)| id == "paint.mixerBrush"));
+        let st = app.session.active().unwrap();
+        assert!(st.doc.layer(st.active_layer.unwrap()).unwrap().surface().unwrap().rgba(60, 30)[3] > 0.0);
+    }
+
+    /// A tip above the live preview's 1024 px paints on release, as main and Photoshop paint it
+    /// up to 5000 px; a stroke that can't paint at all is still refused on press.
+    #[test]
+    fn mixer_drag_above_the_preview_size_paints_on_release() {
+        for locked in [false, true] {
+            let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+            app.run("file.new", json!({"width":120,"height":60,"background":"#00ff00"})).unwrap();
+            app.run("layer.new.layer", json!({})).unwrap();
+            if locked {
+                app.run("layer.lockLayers", json!({"pixels": true})).unwrap();
+            }
+            app.run("tools.setColors", json!({"foreground":"#ff0000"})).unwrap();
+            app.run("tools.setBrush", json!({"brush":{"size":2000,"hardness":1.0,"pressureSize":false,"mixer":{"wet":0.0,"mix":0.0}}})).unwrap();
+            app.ui.tool = Tool::MixerBrush;
+            let steps = app.session.active().unwrap().history.past_len();
+            let m = egui::Modifiers::NONE;
+            tool_event(&mut app, ToolEvent::Down { x: 20.0, y: 30.0, pressure: 1.0 }, m);
+            assert!(app.live_stroke.is_none(), "no live preview above 1024 px");
+            assert_eq!(app.drag.is_some(), !locked, "a valid 2000 px stroke is kept for release");
+            assert_eq!(app.ui.status_error, locked, "{}", app.ui.status);
+            tool_event(&mut app, ToolEvent::Move { x: 50.0, y: 30.0, pressure: 1.0 }, m);
+            tool_event(&mut app, ToolEvent::Up { x: 50.0, y: 30.0 }, m);
+            let st = app.session.active().unwrap();
+            assert_eq!(st.history.past_len(), steps + usize::from(!locked));
+            let pixel = st.doc.layer(st.active_layer.unwrap()).unwrap().surface().unwrap().rgba(60, 30);
+            assert_eq!(pixel[0] > 0.9 && pixel[3] > 0.9, !locked, "{pixel:?}");
+        }
+    }
+
+    /// ⌥ with a held temporary tool (macOS ⌘ = Move) is that tool's, not a Mixer Brush paint load.
+    #[test]
+    fn mixer_alt_with_a_held_temporary_tool_does_not_load_paint() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+        app.run("file.new", json!({"width":120,"height":60,"background":"#00ff00"})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.ui.tool = Tool::MixerBrush;
+        app.tool_override = Some(Tool::Move);
+        let alt = egui::Modifiers { alt: true, ..Default::default() };
+        tool_event(&mut app, ToolEvent::Down { x: 30.0, y: 30.0, pressure: 1.0 }, alt);
+        tool_event(&mut app, ToolEvent::Up { x: 30.0, y: 30.0 }, alt);
+        assert!(app.session.tools.mixer.spatial.is_none(), "the held Move tool doesn't sample");
+        app.tool_override = None;
+        tool_event(&mut app, ToolEvent::Down { x: 30.0, y: 30.0, pressure: 1.0 }, alt);
+        assert!(app.session.tools.mixer.spatial.is_some(), "⌥ with the Mixer Brush itself samples");
+    }
+
     #[test]
     fn brush_drag_shows_the_real_stroke_and_commits_it() {
         // The drag used to draw a hard, flat stand-in and only showed the soft brush on release.
@@ -9121,6 +9519,56 @@ mod tests {
         assert!(app.session.active().unwrap().revision > rev, "a plain drag paints");
     }
 
+    #[test]
+    fn letting_go_of_alt_during_a_mixer_brush_sample_press_does_not_paint() {
+        // As #7802 for the Brush: an Alt-press with the Mixer Brush loads paint from the canvas.
+        // If Alt was let go before egui recognised the drag, that drag started a Mixer stroke.
+        let ctx = egui::Context::default();
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+        app.run("file.new", json!({"width": 400, "height": 300, "background": "white"})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("view.actualPixels", json!({})).unwrap();
+        app.ui.tool = Tool::MixerBrush;
+        app.sync_views();
+        let mut view = app.ui.views[0].clone();
+        view.zoom = 1.0;
+        view.center = [200.0, 150.0];
+        view.fit_pending = false;
+        view.fill_pending = false;
+        let rect = Rect::from_min_size(Pos2::ZERO, vec2(400.0, 300.0));
+        let frame = |app: &mut PhotocraftApp, events: Vec<egui::Event>| {
+            let input = egui::RawInput { screen_rect: Some(rect), events, ..Default::default() };
+            let mut out = ctx.run_ui(input, |ui| {
+                canvas_view(app, ui, 0, rect, view.clone(), true);
+            });
+            out.textures_delta.clear();
+        };
+        let (alt, none) = (egui::Modifiers::ALT, egui::Modifiers::NONE);
+        let start = Pos2::new(200.0, 150.0);
+        let press =
+            |pos: Pos2, pressed: bool, modifiers: egui::Modifiers| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers };
+        // Alt released mid-press, and Alt held throughout: both only load paint.
+        for release_alt in [true, false] {
+            let rev = app.session.active().unwrap().revision;
+            frame(&mut app, vec![egui::Event::ModifiersChanged(alt), egui::Event::PointerMoved(start)]);
+            frame(&mut app, vec![press(start, true, alt)]);
+            let later = if release_alt { none } else { alt };
+            let end = start + vec2(20.0, 0.0);
+            frame(&mut app, vec![egui::Event::ModifiersChanged(later), egui::Event::PointerMoved(end)]);
+            frame(&mut app, vec![press(end, false, later)]);
+            frame(&mut app, vec![egui::Event::ModifiersChanged(none)]);
+            assert_eq!(app.session.active().unwrap().revision, rev, "release_alt={release_alt}: an Alt-sample press must not paint");
+            assert!(app.drag.is_none() && !app.mixer_sampling, "release_alt={release_alt}");
+        }
+        // Without Alt the same gesture paints.
+        let rev = app.session.active().unwrap().revision;
+        frame(&mut app, vec![egui::Event::PointerMoved(start)]);
+        frame(&mut app, vec![press(start, true, none)]);
+        frame(&mut app, vec![egui::Event::PointerMoved(start + vec2(20.0, 0.0))]);
+        frame(&mut app, vec![press(start + vec2(20.0, 0.0), false, none)]);
+        assert!(app.session.active().unwrap().revision > rev, "a plain drag paints");
+    }
+
     #[test]
     fn guides_draw_over_the_transform_preview_and_under_its_box() {
         // #5086: a guide crossing a layer under Free Transform was hidden behind the preview of
diff --git a/crates/ui-egui/src/canvas_menu_tests.rs b/crates/ui-egui/src/canvas_menu_tests.rs
index d2a5c7a2b9..dfed592653 100644
--- a/crates/ui-egui/src/canvas_menu_tests.rs
+++ b/crates/ui-egui/src/canvas_menu_tests.rs
@@ -185,7 +185,7 @@ fn reopened_canvas_menus_still_choose_their_actions() {
     dismiss_outside(&mut h, Popup::Layers);
     tap(&mut h, at, Modifiers::NONE, true);
     assert!(is_open(&h, Popup::Layers));
-    let menu_rect = h.ctx.memory(|m| m.area_rect(egui::Id::new("canvas-layer-menu"))).unwrap();
+    let menu_rect = h.ctx.memory(|m| m.area_rect(egui::Id::unique("canvas-layer-menu"))).unwrap();
     h.query_all_by_label("Background").find(|node| menu_rect.contains(node.rect().center())).expect("Background in the layer menu").click();
     h.run_steps(3);
     assert!(!is_open(&h, Popup::Layers));
@@ -362,7 +362,7 @@ fn brush_preset_menu_action_outside_the_picker_keeps_it_open() {
     let before = document_state(&h);
     let at = fractional_point(&h, 1.0);
     tap(&mut h, at, Modifiers::NONE, true);
-    let picker = h.ctx.memory(|m| m.area_rect(egui::Id::new("canvas-brush-picker"))).unwrap();
+    let picker = h.ctx.memory(|m| m.area_rect(egui::Id::unique("canvas-brush-picker"))).unwrap();
     let name = h.state().session.tools.presets.first().unwrap().name.clone();
     let card = h.query_all_by_label(&name).find(|n| picker.contains(n.rect().center())).expect("visible preset card").rect();
     // Open by the right edge so the action lands outside the picker on a foreground menu.
diff --git a/crates/ui-egui/src/canvas_popup.rs b/crates/ui-egui/src/canvas_popup.rs
index 4f6e7dfc8d..83ecb7d27b 100644
--- a/crates/ui-egui/src/canvas_popup.rs
+++ b/crates/ui-egui/src/canvas_popup.rs
@@ -33,7 +33,7 @@ mod tests {
     #[test]
     fn opening_frame_survives_layout_retries_and_later_presses_close() {
         let ctx = Context::default();
-        let id = Id::new("menu");
+        let id = Id::unique("menu");
         let rect = Rect::from_min_size(pos2(6.0, 6.0), vec2(100.0, 100.0));
         for _ in 0..3 {
             let mut passes = 0;
@@ -66,8 +66,8 @@ mod tests {
     #[test]
     fn opening_one_menu_does_not_protect_another() {
         let ctx = Context::default();
-        let first = Id::new("first");
-        let second = Id::new("second");
+        let first = Id::unique("first");
+        let second = Id::unique("second");
         let rect = Rect::from_min_size(pos2(6.0, 6.0), vec2(100.0, 100.0));
         ctx.run_ui(RawInput::default(), |ui| mark_open(ui.ctx(), first)).drop_without_applying_deltas();
         ctx.run_ui(outside_press(), |ui| {
diff --git a/crates/ui-egui/src/canvas_tool_menu.rs b/crates/ui-egui/src/canvas_tool_menu.rs
index e4256949ee..1f5ae2e066 100644
--- a/crates/ui-egui/src/canvas_tool_menu.rs
+++ b/crates/ui-egui/src/canvas_tool_menu.rs
@@ -1,6 +1,6 @@
 //! Canvas context menus for the selection tools, the Pen, the Zoom and Hand tools, an active Free
 //! Transform box, text being edited with a Type tool, committed type under a Type tool, the
-//! pasteboard (outside the image) and a guide.
+//! pasteboard (outside the image), a guide and a pending crop.
 
 use egui::Context;
 use photocraft_doc::LayerContent;
@@ -42,6 +42,10 @@ pub struct CanvasToolMenu {
     /// the menu.
     #[serde(default)]
     pub spelling: Option<Spelling>,
+    /// Opened on a pending crop: the crop menu, listing the saved crop presets by the names they
+    /// had when it opened.
+    #[serde(default)]
+    pub crop: Option<Vec<String>>,
 }
 
 /// A misspelled word in the type layer being edited (`edit.checkSpelling`'s `list` entry).
@@ -63,7 +67,7 @@ const SPELLING_NONE: &str = "spelling.none";
 const SPELLING_ADD: &str = "spelling.add";
 
 /// One menu row: label and command id. `None` is a separator.
-pub type Row = Option<(&'static str, &'static str)>;
+pub type Row<S = &'static str> = Option<(S, S)>;
 
 /// Right-click while transforming, in Photoshop's order: what the box's handles do, then Rotate
 /// and Flip, which turn the open box without committing it (`transform_tool::intercept`).
@@ -196,6 +200,146 @@ pub const GUIDE_MENU: &[Row] = &[
     Some(("Clear Selected Artboard Guides", "view.clearSelectedArtboardGuides")),
 ];
 
+/// The crop menu's row ids. A ratio row is `crop.ratio.<key>`, the options bar's preset dropdown
+/// key (`crop_size::dropdown_options`); a saved preset is `crop.preset.<n>`, the n-th name the menu
+/// opened with; an overlay row is `crop.overlay.<id>` or `crop.overlayShow.<id>`.
+const CROP_RATIO: &str = "crop.ratio.";
+const CROP_PRESET: &str = "crop.preset.";
+const CROP_OVERLAY: &str = "crop.overlay.";
+const CROP_SHOW: &str = "crop.overlayShow.";
+pub const CROP_CLEAR: &str = "crop.clear";
+pub const CROP_NEW: &str = "crop.newPreset";
+pub const CROP_DELETE: &str = "crop.deletePreset";
+pub const CROP_CANCEL: &str = "crop.cancel";
+pub const CROP_COMMIT: &str = "crop.commit";
+
+/// The crop menu (right-click on a pending crop, #6561): the options bar's preset dropdown, in its
+/// order, and its Clear; the overlay and when it shows; then Cancel and Crop, the bar's ⊘ and ✓.
+/// Built from the bar's own lists, so the two cannot disagree. Empty for any other menu.
+pub fn crop_rows(menu: &CanvasToolMenu) -> Vec<Row<String>> {
+    use crate::crop_overlay::{CropOverlay, OverlayShow};
+    let Some(users) = menu.crop.as_ref() else { return Vec::new() };
+    let ratio = |(k, l): &(String, &str)| Some((l.to_string(), format!("{CROP_RATIO}{k}")));
+    let (before, after): (Vec<_>, Vec<_>) = crate::crop_size::dropdown_options().into_iter().partition(|(k, _)| k != crate::crop_size::FRONT);
+    let mut rows: Vec<Row<String>> = before.iter().map(ratio).collect();
+    rows.extend(users.iter().enumerate().map(|(i, name)| Some((name.clone(), format!("{CROP_PRESET}{i}")))));
+    rows.extend(after.iter().map(ratio));
+    rows.push(Some(("Clear".into(), CROP_CLEAR.into())));
+    rows.push(None);
+    rows.push(Some(("New Crop Preset…".into(), CROP_NEW.into())));
+    rows.push(Some(("Delete Crop Preset…".into(), CROP_DELETE.into())));
+    rows.push(None);
+    rows.extend(CropOverlay::ALL.iter().map(|k| Some((k.label().to_string(), format!("{CROP_OVERLAY}{}", k.id())))));
+    rows.push(None);
+    rows.extend(OverlayShow::ALL.iter().map(|k| Some((k.label().to_string(), format!("{CROP_SHOW}{}", k.id())))));
+    rows.push(None);
+    rows.push(Some(("Cancel".into(), CROP_CANCEL.into())));
+    rows.push(Some(("Crop".into(), CROP_COMMIT.into())));
+    rows
+}
+
+/// Is a crop row's label UI text (translated), rather than a saved preset's name?
+pub fn crop_label_is_ui(id: &str) -> bool {
+    !id.starts_with(CROP_PRESET)
+}
+
+/// Is `command` one of the crop menu's rows?
+fn is_crop(menu: &CanvasToolMenu, command: &str) -> bool {
+    crop_rows(menu).iter().flatten().any(|(_, id)| id == command)
+}
+
+/// The saved crop preset a `crop.preset.<n>` row picks.
+fn crop_preset<'a>(menu: &'a CanvasToolMenu, command: &str) -> Option<&'a String> {
+    let n = command.strip_prefix(CROP_PRESET)?.parse::<usize>().ok()?;
+    menu.crop.as_ref()?.get(n)
+}
+
+/// The crop menu's checkmarks, as the options bar shows them: the dropdown's entry (a saved
+/// preset the fields hold, else the mode or ratio, so a size preset checks W x H x Resolution),
+/// the overlay and when it shows.
+fn crop_checked(app: &PhotocraftApp, menu: &CanvasToolMenu, command: &str) -> bool {
+    let o = &app.ui.tool_options;
+    let user = crate::crop_presets::current_user(app);
+    if let Some(k) = command.strip_prefix(CROP_RATIO) {
+        return user.is_none() && k == o.crop_ratio;
+    }
+    if command.starts_with(CROP_PRESET) {
+        return user.is_some() && crop_preset(menu, command) == user.as_ref();
+    }
+    if let Some(k) = command.strip_prefix(CROP_OVERLAY) {
+        return k == o.crop_overlay.id();
+    }
+    command.strip_prefix(CROP_SHOW).is_some_and(|k| k == o.crop_overlay_show.id())
+}
+
+fn crop_enabled(app: &PhotocraftApp, menu: &CanvasToolMenu, command: &str) -> bool {
+    match command {
+        CROP_NEW => crate::crop_presets::savable(&app.ui.tool_options).is_some(),
+        CROP_DELETE => menu.crop.as_ref().is_some_and(|u| !u.is_empty()),
+        c => is_crop(menu, c),
+    }
+}
+
+/// Right-click with `tool` on a pending crop: the crop menu at screen point `pos`. Only the Crop
+/// tool itself, not one held over it (Space's Hand).
+pub fn open_crop(app: &mut PhotocraftApp, ctx: &Context, tool: Tool, pos: [f32; 2]) -> bool {
+    if tool != Tool::Crop || !crate::crop_ui::pending(app) || !pos.iter().all(|v| v.is_finite()) {
+        return false;
+    }
+    app.ui.brush_picker = None;
+    app.ui.layer_menu = None;
+    let users = crate::crop_presets::user_presets(app).into_iter().map(|(name, _)| name).collect();
+    app.ui.canvas_tool_menu = Some(CanvasToolMenu {
+        pos,
+        tool,
+        has_selection: false,
+        has_path: false,
+        path_name: None,
+        transform: false,
+        pasteboard: false,
+        anchor: None,
+        text: false,
+        type_layer: false,
+        guide: false,
+        spelling: None,
+        crop: Some(users),
+    });
+    crate::canvas_popup::mark_open(ctx, menu_id());
+    true
+}
+
+/// A crop row: each runs what its options-bar twin runs.
+fn choose_crop(app: &mut PhotocraftApp, menu: &CanvasToolMenu, command: &str) -> Result<(), String> {
+    use crate::crop_overlay::{CropOverlay, OverlayShow};
+    use crate::crop_presets::{Choice, apply_choice};
+    match command {
+        CROP_CANCEL => crate::crop_ui::cancel(app),
+        CROP_COMMIT => crate::canvas::commit_crop(app),
+        CROP_NEW => apply_choice(app, Choice::New),
+        CROP_DELETE => apply_choice(app, Choice::Delete),
+        _ => {
+            let before = crate::crop_ui::preset_ratio(app);
+            if let Some(k) = command.strip_prefix(CROP_RATIO) {
+                apply_choice(app, Choice::Builtin(k.to_string()));
+            } else if let Some(name) = crop_preset(menu, command) {
+                apply_choice(app, Choice::User(name.clone()));
+            } else if command == CROP_CLEAR {
+                crate::crop_size::clear_ratio(&mut app.ui.tool_options);
+            } else if let Some(k) = command.strip_prefix(CROP_OVERLAY).and_then(CropOverlay::from_id) {
+                crate::crop_overlay::set_overlay(&mut app.ui.tool_options, k);
+            } else if let Some(k) = command.strip_prefix(CROP_SHOW).and_then(OverlayShow::from_id) {
+                app.ui.tool_options.crop_overlay_show = k;
+            }
+            // As the options bar does: a saved preset or Clear changes the ratio without refitting
+            // the frame, so refit it when the ratio (or W x H) the frame follows changed.
+            if crate::crop_ui::preset_ratio(app) != before {
+                crate::crop_ui::apply_ratio(app);
+            }
+        }
+    }
+    Ok(())
+}
+
 /// The pasteboard colours in the menu's order, which Space+F steps through.
 const CANVAS_COLORS: [CanvasColor; 6] =
     [CanvasColor::Default, CanvasColor::Black, CanvasColor::DarkGray, CanvasColor::MediumGray, CanvasColor::LightGray, CanvasColor::Custom];
@@ -339,7 +483,10 @@ pub fn selection_rows(has_selection: bool) -> &'static [Row] {
 
 /// The rows of an open menu.
 pub fn rows(menu: &CanvasToolMenu) -> &'static [Row] {
-    if menu.guide {
+    if menu.crop.is_some() {
+        // Built per menu: [`crop_rows`].
+        &[]
+    } else if menu.guide {
         GUIDE_MENU
     } else if menu.pasteboard {
         PASTEBOARD_MENU
@@ -360,13 +507,16 @@ pub fn rows(menu: &CanvasToolMenu) -> &'static [Row] {
 
 /// Is `command` one of the open menu's rows, and enabled?
 pub fn available(app: &PhotocraftApp, menu: &CanvasToolMenu, command: &str) -> bool {
-    (rows(menu).iter().flatten().any(|(_, id)| *id == command) || is_spelling(menu, command)) && entry_enabled(app, menu, command)
+    (rows(menu).iter().flatten().any(|(_, id)| *id == command) || is_spelling(menu, command) || is_crop(menu, command)) && entry_enabled(app, menu, command)
 }
 
 /// Is `command` the transform box's current mode (checked in the transform menu)?
 /// Scale stays Free Transform's mode (only Free Transform is checked). Rotate is its own mode.
 /// Warp is not a box mode (it is its own session), and `for_command` would read it as Free.
 pub(crate) fn mode_checked(app: &PhotocraftApp, menu: &CanvasToolMenu, command: &str) -> bool {
+    if menu.crop.is_some() {
+        return crop_checked(app, menu, command);
+    }
     if menu.guide {
         return command == "view.lockGuides" && app.ui.extras.lock_guides;
     }
@@ -488,6 +638,7 @@ pub fn open_transform(app: &mut PhotocraftApp, ctx: &Context, pos: [f32; 2]) ->
         type_layer: false,
         guide: false,
         spelling: None,
+        crop: None,
     });
     crate::canvas_popup::mark_open(ctx, menu_id());
     true
@@ -502,6 +653,9 @@ fn pasteboard_choice(command: &str) -> Option<CanvasColor> {
 /// The engine command (and params) a pasteboard row runs, for the automation policy: every row
 /// changes a preference.
 pub fn engine_call(app: &PhotocraftApp, menu: &CanvasToolMenu, command: &str) -> (String, Value) {
+    if menu.crop.is_some() && command == CROP_COMMIT {
+        return ("image.crop".into(), json!({}));
+    }
     if menu.guide {
         let selected = crate::guide_select::selected(app);
         return match command {
@@ -562,6 +716,7 @@ pub fn open_pasteboard(app: &mut PhotocraftApp, ctx: &Context, tool: Tool, pos:
         type_layer: false,
         guide: false,
         spelling: None,
+        crop: None,
     });
     crate::canvas_popup::mark_open(ctx, menu_id());
     true
@@ -592,6 +747,7 @@ pub fn open_guide(app: &mut PhotocraftApp, ctx: &Context, tool: Tool, mods: egui
         type_layer: false,
         guide: true,
         spelling: None,
+        crop: None,
     });
     crate::canvas_popup::mark_open(ctx, menu_id());
     true
@@ -619,6 +775,9 @@ fn choose_pasteboard(app: &mut PhotocraftApp, menu: &CanvasToolMenu, command: &s
 }
 
 pub fn entry_enabled(app: &PhotocraftApp, menu: &CanvasToolMenu, command: &str) -> bool {
+    if menu.crop.is_some() {
+        return crop_enabled(app, menu, command);
+    }
     if menu.guide {
         return match command {
             GUIDE_EDIT | GUIDE_CLEAR => crate::guide_select::selected(app).is_some(),
@@ -719,6 +878,7 @@ pub fn open_at(app: &mut PhotocraftApp, ctx: &Context, tool: Tool, pos: [f32; 2]
         type_layer,
         guide: false,
         spelling,
+        crop: None,
     });
     crate::canvas_popup::mark_open(ctx, menu_id());
     true
@@ -745,6 +905,7 @@ pub fn open_view(app: &mut PhotocraftApp, ctx: &Context, tool: Tool, pos: [f32;
         type_layer: false,
         guide: false,
         spelling: None,
+        crop: None,
     });
     crate::canvas_popup::mark_open(ctx, menu_id());
     true
@@ -784,7 +945,9 @@ pub fn choose(app: &mut PhotocraftApp, ctx: &Context, command: &str) {
     if !available(app, &menu, command) {
         return;
     }
-    let result = if menu.guide {
+    let result = if menu.crop.is_some() {
+        choose_crop(app, &menu, command)
+    } else if menu.guide {
         choose_guide(app, ctx, command)
     } else if menu.pasteboard {
         choose_pasteboard(app, &menu, command)
@@ -937,7 +1100,7 @@ fn choose_pen(app: &mut PhotocraftApp, ctx: &Context, menu: &CanvasToolMenu, com
 }
 
 fn menu_id() -> egui::Id {
-    egui::Id::new("canvas-selection-menu")
+    egui::Id::unique("canvas-selection-menu")
 }
 
 pub fn show(app: &mut PhotocraftApp, ctx: &Context) {
@@ -947,6 +1110,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &Context) {
         || (menu.transform && app.ui.transform.is_none())
         || (menu.text && app.ui.text_edit.is_none())
         || (menu.type_layer && app.ui.text_edit.is_some())
+        || (menu.crop.is_some() && !crate::crop_ui::pending(app))
     {
         app.ui.canvas_tool_menu = None;
         return;
@@ -981,6 +1145,17 @@ pub fn show(app: &mut PhotocraftApp, ctx: &Context) {
                 if !spelling.is_empty() {
                     ui.separator();
                 }
+                for row in crop_rows(&menu) {
+                    let Some((label, command)) = row else {
+                        ui.separator();
+                        continue;
+                    };
+                    let text = if crop_label_is_ui(&command) { tl!(&label).to_string() } else { label };
+                    let item = egui::Button::selectable(mode_checked(app, &menu, &command), text).min_size(egui::vec2(200.0, 20.0));
+                    if ui.add_enabled(entry_enabled(app, &menu, &command), item).clicked() {
+                        selected = Some(command);
+                    }
+                }
                 for row in rows(&menu) {
                     let Some((label, command)) = *row else {
                         ui.separator();
@@ -1937,4 +2112,277 @@ mod tests {
         }
         assert!(entry_enabled(&app, menu, "path.toSelection"));
     }
+
+    /// A 32 × 32 document with the Crop tool picked (Classic Mode, so the view stays put) and its
+    /// untouched default frame.
+    fn crop_app() -> PhotocraftApp {
+        let mut app = app();
+        app.ui.tool = Tool::Crop;
+        app.ui.tool_options.crop_shield.classic_mode = true;
+        app.ui.extras.snap = false;
+        crate::crop_ui::ensure_frame(&mut app);
+        app
+    }
+
+    /// Draws a crop frame from (4, 4) to (28, 28): a pending crop. Returns the frame.
+    fn draw_crop(app: &mut PhotocraftApp) -> [f64; 4] {
+        use crate::canvas::{ToolEvent, tool_event};
+        tool_event(app, ToolEvent::Down { x: 4.0, y: 4.0, pressure: 1.0 }, Modifiers::NONE);
+        tool_event(app, ToolEvent::Move { x: 16.0, y: 16.0, pressure: 1.0 }, Modifiers::NONE);
+        tool_event(app, ToolEvent::Move { x: 28.0, y: 28.0, pressure: 1.0 }, Modifiers::NONE);
+        tool_event(app, ToolEvent::Up { x: 28.0, y: 28.0 }, Modifiers::NONE);
+        assert!(crate::crop_ui::pending(app), "the drag draws a pending frame");
+        app.ui.crop_rect.unwrap()
+    }
+
+    fn aspect(r: [f64; 4]) -> f64 {
+        (r[2] - r[0]) / (r[3] - r[1])
+    }
+
+    /// #6561: right-click on a pending crop opens its menu without touching the frame, and a ratio
+    /// row refits the frame as the options bar's dropdown does.
+    #[test]
+    fn right_click_on_a_pending_crop_opens_the_crop_menu_and_a_ratio_refits_the_frame() {
+        let mut app = crop_app();
+        let frame = draw_crop(&mut app);
+        let mut h = harness(app);
+        let center = h.state().last_canvas_rect.center();
+        right_click(&mut h, center, Modifiers::NONE);
+        let menu = h.state().ui.canvas_tool_menu.clone().expect("right-click on a pending crop opens a menu");
+        assert_eq!(h.state().ui.crop_rect, Some(frame), "the right-click leaves the frame alone");
+        assert!(available(h.state(), &menu, "crop.ratio.16:9"), "the menu lists the options bar's ratios");
+        let ctx = h.ctx.clone();
+        choose(h.state_mut(), &ctx, "crop.ratio.16:9");
+        assert_eq!(h.state().ui.tool_options.crop_ratio, "16:9");
+        let r = h.state().ui.crop_rect.unwrap();
+        assert!((aspect(r) - 16.0 / 9.0).abs() < 1e-9, "the frame is 16 : 9 now: {r:?}");
+        assert!(r[0] >= frame[0] && r[1] >= frame[1] && r[2] <= frame[2] && r[3] <= frame[3], "fitted inside the old frame: {r:?}");
+        assert!(h.state().ui.canvas_tool_menu.is_none());
+    }
+
+    #[test]
+    fn untouched_crop_frame_has_no_menu_and_a_pending_one_wins_over_the_pasteboard() {
+        let mut h = harness(crop_app());
+        let rect = h.state().last_canvas_rect;
+        let outside = rect.min + vec2(5.0, 5.0);
+        right_click(&mut h, rect.center(), Modifiers::NONE);
+        assert!(h.state().ui.canvas_tool_menu.is_none(), "the tool's untouched frame is no crop in progress");
+        right_click(&mut h, outside, Modifiers::NONE);
+        assert!(h.state().ui.canvas_tool_menu.as_ref().is_some_and(|m| m.pasteboard), "outside: the pasteboard menu, as before");
+        h.state_mut().ui.canvas_tool_menu = None;
+        draw_crop(h.state_mut());
+        h.run_steps(2);
+        right_click(&mut h, outside, Modifiers::NONE);
+        let menu = h.state().ui.canvas_tool_menu.clone().unwrap();
+        assert!(menu.crop.is_some() && !menu.pasteboard, "with a crop pending, its menu also outside the image");
+    }
+
+    /// A harness in the app's order: shortcuts (the crop's Esc and ↵ among them), then the canvas.
+    fn shortcut_harness(mut app: PhotocraftApp) -> Harness<'static, PhotocraftApp> {
+        app.sync_views();
+        let mut h = Harness::builder().with_size(vec2(1000.0, 700.0)).build_ui_state(
+            |ui, app: &mut PhotocraftApp| {
+                let ctx = ui.ctx().clone();
+                if !ctx.fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
+                    return;
+                }
+                crate::shortcuts::handle(app, &ctx);
+                egui::CentralPanel::default().show(ui, |ui| crate::canvas::document_area(app, ui));
+            },
+            app,
+        );
+        PhotocraftApp::setup_context(&h.ctx, crate::theme::ThemeKind::default());
+        h.run_steps(4);
+        h
+    }
+
+    #[test]
+    fn esc_closes_only_the_crop_menu() {
+        let mut app = crop_app();
+        let frame = draw_crop(&mut app);
+        let mut h = shortcut_harness(app);
+        let center = h.state().last_canvas_rect.center();
+        right_click(&mut h, center, Modifiers::NONE);
+        assert!(h.state().ui.canvas_tool_menu.as_ref().is_some_and(|m| m.crop.is_some()));
+        h.key_press(egui::Key::Escape);
+        h.run_steps(2);
+        assert!(h.state().ui.canvas_tool_menu.is_none(), "Esc closes the menu");
+        assert_eq!(h.state().ui.crop_rect, Some(frame), "and only the menu: the crop is not cancelled");
+        assert!(crate::crop_ui::pending(h.state()));
+    }
+
+    /// ↵ under the open crop menu doesn't commit the crop beneath it.
+    #[test]
+    fn enter_under_the_crop_menu_does_not_crop() {
+        let mut app = crop_app();
+        let frame = draw_crop(&mut app);
+        let mut h = shortcut_harness(app);
+        let size = h.state().session.active().map(|s| s.doc.size);
+        let center = h.state().last_canvas_rect.center();
+        right_click(&mut h, center, Modifiers::NONE);
+        assert!(h.state().ui.canvas_tool_menu.as_ref().is_some_and(|m| m.crop.is_some()));
+        h.key_press(egui::Key::Enter);
+        h.run_steps(2);
+        assert_eq!(h.state().session.active().map(|s| s.doc.size), size, "↵ under the menu doesn't crop");
+        assert_eq!(h.state().ui.crop_rect, Some(frame));
+        assert!(crate::crop_ui::pending(h.state()));
+    }
+
+    /// A right-click while the left button drags the crop frame opens no menu over the drag, on
+    /// the image or outside it (no pasteboard menu either), and the menu opens again once the left
+    /// button is up, though egui ended that drag without a release of its own.
+    #[test]
+    fn no_crop_menu_while_the_left_button_drags_the_frame() {
+        let mut app = crop_app();
+        draw_crop(&mut app);
+        let mut h = harness(app);
+        let rect = h.state().last_canvas_rect;
+        let (center, outside) = (rect.center(), rect.min + vec2(5.0, 5.0));
+        let left = |pos, pressed| egui::Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE };
+        h.event(egui::Event::PointerMoved(center));
+        h.run_steps(1);
+        h.event(left(center, true));
+        h.run_steps(1);
+        for k in 1..=4 {
+            h.event(egui::Event::PointerMoved(center + vec2(8.0 * k as f32, 0.0)));
+            h.run_steps(1);
+        }
+        assert!(h.state().crop.drag.is_some(), "the left button drags the frame");
+        let held = center + vec2(32.0, 0.0);
+        right_click(&mut h, held, Modifiers::NONE);
+        assert!(h.state().ui.canvas_tool_menu.is_none(), "no crop menu over the drag");
+        right_click(&mut h, outside, Modifiers::NONE);
+        assert!(h.state().ui.canvas_tool_menu.is_none(), "nor the pasteboard menu outside the image");
+        h.event(egui::Event::PointerMoved(held));
+        h.event(left(held, false));
+        h.run_steps(2);
+        right_click(&mut h, center, Modifiers::NONE);
+        assert!(h.state().ui.canvas_tool_menu.as_ref().is_some_and(|m| m.crop.is_some()), "with the button up the menu opens");
+    }
+
+    /// The left button down with no crop gesture under way (a press egui doesn't take for a drag
+    /// yet, or one whose release was lost to an Alt+Tab or a cancelled touch) doesn't keep the
+    /// crop menu shut.
+    #[test]
+    fn a_left_button_down_without_a_crop_drag_keeps_the_crop_menu() {
+        let mut app = crop_app();
+        draw_crop(&mut app);
+        let mut h = harness(app);
+        let center = h.state().last_canvas_rect.center();
+        h.event(egui::Event::PointerMoved(center));
+        h.run_steps(1);
+        h.event(egui::Event::PointerButton { pos: center, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+        h.run_steps(1);
+        assert!(h.ctx.input(|i| i.pointer.primary_down()) && h.state().crop.drag.is_none(), "down, dragging nothing");
+        right_click(&mut h, center, Modifiers::NONE);
+        assert!(h.state().ui.canvas_tool_menu.as_ref().is_some_and(|m| m.crop.is_some()), "the crop menu opens");
+    }
+
+    /// Nor does a right-click open a menu over a Straighten line the left button still draws.
+    #[test]
+    fn no_crop_menu_while_the_left_button_draws_a_straighten_line() {
+        let mut app = crop_app();
+        draw_crop(&mut app);
+        crate::crop_straighten::toggle(&mut app);
+        let mut h = harness(app);
+        let center = h.state().last_canvas_rect.center();
+        let left = |pos, pressed| egui::Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE };
+        h.event(egui::Event::PointerMoved(center));
+        h.run_steps(1);
+        h.event(left(center, true));
+        h.run_steps(1);
+        for k in 1..=4 {
+            h.event(egui::Event::PointerMoved(center + vec2(8.0 * k as f32, 4.0)));
+            h.run_steps(1);
+        }
+        assert!(h.state().crop.straighten.line.is_some() && h.state().crop.drag.is_none(), "the left button draws a Straighten line");
+        right_click(&mut h, center + vec2(32.0, 4.0), Modifiers::NONE);
+        assert!(h.state().ui.canvas_tool_menu.is_none(), "no menu over the line");
+    }
+
+    /// A finger held still on a pending crop (a touch screen's press-and-hold right-click) opens
+    /// the crop menu, though the touch counts as the primary button down.
+    #[test]
+    fn a_finger_held_on_a_pending_crop_opens_the_crop_menu() {
+        let mut app = crop_app();
+        let frame = draw_crop(&mut app);
+        let mut h = harness(app);
+        let at = h.state().last_canvas_rect.center();
+        let touch = |phase| egui::Event::Touch { device_id: egui::TouchDeviceId(1), id: egui::TouchId(1), phase, pos: at, force: None };
+        let button = |pressed| egui::Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE };
+        h.input_mut().events.extend([egui::Event::PointerMoved(at), touch(egui::TouchPhase::Start), button(true)]);
+        h.step();
+        // Held past egui's max_click_duration (0.8 s) without moving.
+        for _ in 0..120 {
+            if h.state().ui.canvas_tool_menu.is_some() {
+                break;
+            }
+            h.step();
+        }
+        assert!(h.state().ui.canvas_tool_menu.as_ref().is_some_and(|m| m.crop.is_some()), "the held finger opens the crop menu");
+        h.input_mut().events.extend([touch(egui::TouchPhase::End), button(false)]);
+        h.run_steps(2);
+        assert_eq!(h.state().ui.crop_rect, Some(frame), "the hold leaves the frame alone");
+    }
+
+    #[test]
+    fn crop_menu_rows_act_like_the_options_bar() {
+        use crate::crop_overlay::{CropOverlay, OverlayShow};
+        let ctx = Context::default();
+        let mut app = crop_app();
+        draw_crop(&mut app);
+        // Space's Hand held over the Crop tool keeps its own right-click.
+        assert!(!open_crop(&mut app, &ctx, Tool::Hand, [10.0, 10.0]));
+        let reopen = |app: &mut PhotocraftApp| {
+            assert!(open_crop(app, &Context::default(), Tool::Crop, [10.0, 10.0]));
+            app.ui.canvas_tool_menu.clone().unwrap()
+        };
+        // Nothing to save with a free ratio, nothing to delete without saved presets.
+        let menu = reopen(&mut app);
+        assert!(!entry_enabled(&app, &menu, CROP_NEW) && !entry_enabled(&app, &menu, CROP_DELETE));
+        assert!(mode_checked(&app, &menu, "crop.ratio."), "free Ratio is checked, as in the dropdown");
+        // A size preset fills W x H x Resolution, which the menu checks, as the dropdown does.
+        choose(&mut app, &ctx, "crop.ratio.preset:4x5in");
+        let menu = reopen(&mut app);
+        assert!(mode_checked(&app, &menu, "crop.ratio.whr") && !mode_checked(&app, &menu, "crop.ratio.preset:4x5in"));
+        assert!((aspect(app.ui.crop_rect.unwrap()) - 0.8).abs() < 1e-9);
+        assert!(entry_enabled(&app, &menu, CROP_NEW));
+        // Clear empties W x H x Resolution, as the bar's Clear.
+        choose(&mut app, &ctx, CROP_CLEAR);
+        assert_eq!(app.ui.tool_options.crop_width, "");
+        // Overlays: another overlay starts at its first orientation; when it shows.
+        app.ui.tool_options.crop_overlay = CropOverlay::GoldenSpiral;
+        app.ui.tool_options.crop_overlay_orientation = 2;
+        reopen(&mut app);
+        choose(&mut app, &ctx, "crop.overlay.triangle");
+        assert_eq!((app.ui.tool_options.crop_overlay, app.ui.tool_options.crop_overlay_orientation), (CropOverlay::Triangle, 0));
+        reopen(&mut app);
+        choose(&mut app, &ctx, "crop.overlayShow.never");
+        assert_eq!(app.ui.tool_options.crop_overlay_show, OverlayShow::Never);
+        let menu = reopen(&mut app);
+        assert!(mode_checked(&app, &menu, "crop.overlay.triangle") && mode_checked(&app, &menu, "crop.overlayShow.never"));
+        // A saved preset is listed by name; picking it refits the frame to its W x H, though the
+        // ratio key is "whr" before and after.
+        app.ui.canvas_tool_menu = None;
+        app.ui.tool_options.crop_ratio = crate::crop_size::WHR.into();
+        let saved = json!({"crop_ratio": "whr", "crop_width": "300 px", "crop_height": "100 px", "crop_resolution": "72", "crop_resolution_unit": "px/in"});
+        app.run("tool.presets.new", json!({"name": "Banner", "tool": "crop", "options": {"toolOptions": saved}})).unwrap();
+        let menu = reopen(&mut app);
+        let banner = crop_rows(&menu).into_iter().flatten().find(|(l, _)| l == "Banner").expect("the saved preset is a row").1;
+        assert!(entry_enabled(&app, &menu, CROP_DELETE));
+        choose(&mut app, &ctx, &banner);
+        assert_eq!(app.ui.tool_options.crop_width, "300 px");
+        assert!((aspect(app.ui.crop_rect.unwrap()) - 3.0).abs() < 1e-9, "the frame follows the preset: {:?}", app.ui.crop_rect);
+        let menu = reopen(&mut app);
+        assert!(mode_checked(&app, &menu, &banner));
+        // Crop commits as ↵ does: the preset's size.
+        choose(&mut app, &ctx, CROP_COMMIT);
+        let size = app.session.active().unwrap().doc.size;
+        assert_eq!((size.width, size.height), (300, 100));
+        // Cancel drops a pending crop.
+        draw_crop(&mut app);
+        reopen(&mut app);
+        choose(&mut app, &ctx, CROP_CANCEL);
+        assert!(!crate::crop_ui::pending(&app));
+    }
 }
diff --git a/crates/ui-egui/src/cas_transform.rs b/crates/ui-egui/src/cas_transform.rs
index d5b263d6e8..0a1fa7d5b5 100644
--- a/crates/ui-egui/src/cas_transform.rs
+++ b/crates/ui-egui/src/cas_transform.rs
@@ -206,7 +206,8 @@ pub fn fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, t: &TransformSession)
     let Some(o) = t.content_aware.clone() else { return };
     let tk = crate::theme::Tokens::get(ui.ctx());
     let lbl = |ui: &mut egui::Ui, s: &str| {
-        ui.label(egui::RichText::new(s).color(tk.text_dim).size(12.0));
+        let label = ui.label(egui::RichText::new(s).color(tk.text_dim).size(12.0));
+        crate::widgets::scrub_option_label(ui, &label);
     };
     crate::transform_tool::position_size_fields(app, ui, t);
     crate::widgets::vline(ui, 22.0);
@@ -218,7 +219,7 @@ pub fn fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, t: &TransformSession)
     let channels: Vec<String> = app.session.active().map(|st| st.doc.channels.iter().map(|c| c.name.clone()).collect()).unwrap_or_default();
     let mut options: Vec<(Option<String>, &str)> = vec![(None, tl!("None"))];
     options.extend(channels.iter().map(|n| (Some(n.clone()), n.as_str())));
-    crate::widgets::dropdown(ui, "content-aware-scale-protect", &mut next.protect, &options, 120.0);
+    crate::widgets::dropdown(ui, "content-aware-scale-protect", tl!("Protect:"), &mut next.protect, &options, 120.0);
     crate::widgets::checkbox(ui, &mut next.protect_skin_tones, tl!("Protect skin tones"));
     if next != o
         && let Some(s) = app.ui.transform.as_mut()
diff --git a/crates/ui-egui/src/channel_options_ui.rs b/crates/ui-egui/src/channel_options_ui.rs
index 7ff77d1146..d35ed2ff07 100644
--- a/crates/ui-egui/src/channel_options_ui.rs
+++ b/crates/ui-egui/src/channel_options_ui.rs
@@ -110,7 +110,7 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
     if let Some(mut name) = f.get("name").and_then(Value::as_str).map(str::to_string) {
         ui.horizontal(|ui| {
             label(ui, tl!("Name:"));
-            if ui.add(egui::TextEdit::singleline(&mut name).desired_width(200.0)).changed() {
+            if ui.add(egui::TextEdit::singleline(&mut name).desired_width(200.0)).accessible_name(tl!("Name")).changed() {
                 f.insert("name".into(), json!(name));
             }
         });
@@ -143,9 +143,10 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
             crate::color_picker_ui::request(f, &crate::color_picker_ui::title_for(what));
         }
         ui.add_space(12.0);
-        ui.label(if spot { tl!("Solidity:") } else { tl!("Opacity:") });
+        let caption = if spot { tl!("Solidity:") } else { tl!("Opacity:") };
+        ui.label(caption);
         let mut pct = f.get("opacity").and_then(Value::as_f64).unwrap_or(50.0) as f32;
-        if crate::widgets::value_field(ui, &mut pct, 0.0..=100.0, "%", 64.0).changed() {
+        if crate::widgets::value_field(ui, &mut pct, 0.0..=100.0, "%", 64.0).accessible_name(caption).changed() {
             f.insert("opacity".into(), json!(pct.round()));
         }
     });
@@ -163,7 +164,7 @@ fn mask_body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
         ui.add_space(12.0);
         ui.label(tl!("Opacity:"));
         let mut pct = f.get("opacity").and_then(Value::as_f64).unwrap_or(50.0) as f32;
-        if crate::widgets::value_field(ui, &mut pct, 0.0..=100.0, "%", 64.0).changed() {
+        if crate::widgets::value_field(ui, &mut pct, 0.0..=100.0, "%", 64.0).accessible_name(tl!("Opacity:")).changed() {
             f.insert("opacity".into(), json!(pct.round()));
         }
     });
@@ -228,7 +229,7 @@ pub fn new_spot_body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
     let mut name = f.get("name").and_then(Value::as_str).unwrap_or_default().to_string();
     ui.horizontal(|ui| {
         label(ui, tl!("Name:"));
-        if ui.add(egui::TextEdit::singleline(&mut name).desired_width(200.0)).changed() {
+        if ui.add(egui::TextEdit::singleline(&mut name).desired_width(200.0)).accessible_name(tl!("Name")).changed() {
             f.insert("name".into(), json!(name));
         }
     });
@@ -244,7 +245,7 @@ pub fn new_spot_body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
         ui.add_space(12.0);
         ui.label(tl!("Solidity:"));
         let mut pct = f.get("solidity").and_then(Value::as_f64).unwrap_or(0.0) as f32;
-        if crate::widgets::value_field(ui, &mut pct, 0.0..=100.0, "%", 64.0).changed() {
+        if crate::widgets::value_field(ui, &mut pct, 0.0..=100.0, "%", 64.0).accessible_name(tl!("Solidity:")).changed() {
             f.insert("solidity".into(), json!(pct.round()));
         }
     });
diff --git a/crates/ui-egui/src/channels_panel.rs b/crates/ui-egui/src/channels_panel.rs
index 0b233633a4..5768ae0850 100644
--- a/crates/ui-egui/src/channels_panel.rs
+++ b/crates/ui-egui/src/channels_panel.rs
@@ -92,6 +92,18 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let rows_h = if fill { ui.available_height() - footer } else { f32::INFINITY };
     let mut mask_click = None;
     let mut drawn = Vec::new();
+    // An alpha or spot channel dragged over the rows reorders like Photoshop's (#9163): a line marks
+    // where it lands, above the colour channels it lands first, and colour channels don't move.
+    let dragged_alpha = ctx.data(|d| d.get_temp::<(Row, String)>(drag_id())).and_then(|(row, _)| match row {
+        Row::Alpha(i) => Some(i),
+        _ => None,
+    });
+    let pointer = ctx.input(|i| i.pointer.interact_pos());
+    let released = ctx.input(|i| i.pointer.any_released());
+    let alpha_count = doc.channels.len();
+    // The slot the dragged channel would take (0 = first alpha) and where its line goes.
+    let mut insertion: Option<(usize, f32)> = None;
+    let mut alphas_top: Option<f32> = None;
     egui::ScrollArea::vertical().max_height(rows_h).min_scrolled_height(if fill { rows_h } else { 0.0 }).auto_shrink([false, !fill]).show(ui, |ui| {
         for row in rows {
             let (name, thumb_idx, slot, visible, selected) = match row {
@@ -125,6 +137,20 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             };
             let row_h = if t.pro { 36.0 } else { 40.0 };
             let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), row_h), Sense::click_and_drag());
+            if let Row::Alpha(0) = row {
+                alphas_top = Some(rect.top());
+            }
+            if dragged_alpha.is_some()
+                && let Some(p) = pointer.filter(|p| rect.contains(*p))
+            {
+                insertion = match row {
+                    Row::Alpha(j) if p.y < rect.center().y => Some((j, rect.top())),
+                    Row::Alpha(j) => Some((j + 1, rect.bottom())),
+                    Row::QuickMask => Some((alpha_count, rect.top())),
+                    // Above the alpha channels: Photoshop puts it first among them.
+                    Row::Composite | Row::Color(_) | Row::LayerMask => Some((0, f32::NAN)),
+                };
+            }
             if resp.drag_started() {
                 ctx.data_mut(|d| d.insert_temp(drag_id(), (row, name.clone())));
             }
@@ -139,13 +165,13 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 painter.line_segment([rect.left_bottom(), rect.right_bottom()], Stroke::new(1.0, t.separator));
             }
             let eye = Rect::from_min_size(pos2(rect.left() + 6.0, rect.center().y - 11.0), vec2(22.0, 22.0));
-            let eye_resp = ui.interact(eye, ui.id().with(("chan-eye", format!("{:?}", row.reference()))), Sense::click());
+            let eye_resp = ui.interact(eye, ui.scope_id().with(("chan-eye", format!("{:?}", row.reference()))), Sense::click());
             // Like Photoshop, the temporary mask row's eye is empty until the mask is shown.
             if row != Row::LayerMask || visible || eye_resp.hovered() {
                 icons::paint(ui, eye, if visible { "eye" } else { "eye-off" }, 14.0, if visible { t.icon } else { t.text_faint });
             }
             let eye_resp = eye_resp.on_hover_text(if row == Row::LayerMask { tl!("Show the layer mask as an overlay") } else { tl!("Toggle visibility") });
-            eye_resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, format!("Visibility {name}")));
+            eye_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, format!("Visibility {name}")));
             let layer_id = masked.as_ref().map(|l| l.id.0);
             if eye_resp.clicked() {
                 let view_cmd = photocraft_engine::mask_view_cmds::ID.to_string();
@@ -167,7 +193,7 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             }
             drawn.push((name.clone(), thumb));
             // Rows are painted: name them for screen readers and UI tests.
-            resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, selected, &name));
+            resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected, &name));
             // Spot channels: a swatch of the ink on the thumbnail corner.
             if let Row::Alpha(i) = row
                 && let Some((ink, _)) = doc.channels[i].spot
@@ -197,7 +223,7 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                     t.text_faint,
                 );
             }
-            let rename_id = egui::Id::new(("chan-rename", doc.id.0, format!("{:?}", row.reference())));
+            let rename_id = egui::Id::unique(("chan-rename", doc.id.0, format!("{:?}", row.reference())));
             if resp.clicked() && !eye_resp.clicked() {
                 let m = ui.input(|i| i.modifiers);
                 if m.command && row == Row::LayerMask {
@@ -235,7 +261,7 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 }
                 if let Some(mut text) = ctx.data(|d| d.get_temp::<String>(rename_id)) {
                     let edit_rect = Rect::from_min_max(pos2(text_pos.x - 3.0, rect.center().y - 11.0), pos2(rect.right() - 36.0, rect.center().y + 11.0));
-                    let te = ui.put(edit_rect, egui::TextEdit::singleline(&mut text).font(egui::FontId::proportional(12.5)));
+                    let te = ui.put(edit_rect, egui::TextEdit::singleline(&mut text).font(egui::FontId::proportional(12.5))).accessible_name(tl!("Name"));
                     if !te.has_focus() && !te.lost_focus() {
                         te.request_focus();
                     }
@@ -297,6 +323,18 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 });
             });
         }
+        if let (Some(from), Some((slot, y))) = (dragged_alpha, insertion) {
+            let y = if y.is_nan() { alphas_top.unwrap_or(y) } else { y };
+            if y.is_finite() {
+                let r = ui.min_rect();
+                ui.painter().hline(r.x_range(), y, Stroke::new(2.0, t.accent));
+            }
+            // `channel.move` takes the channel's final index: a slot below it is one less.
+            let to = if slot > from { slot - 1 } else { slot };
+            if released && to != from {
+                actions.push(("channel.move".into(), json!({ "channel": from, "to": to })));
+            }
+        }
     });
     // A row being dragged: its name follows the pointer until it is dropped.
     let dragged = ctx.data(|d| d.get_temp::<(Row, String)>(drag_id()));
@@ -352,7 +390,7 @@ pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         if id == "ui.renameChannel" {
             if let Some(i) = p.as_u64().and_then(|i| doc.channels.get(i as usize)) {
                 let row = Row::Alpha(p.as_u64().unwrap_or(0) as usize);
-                ctx.data_mut(|d| d.insert_temp(egui::Id::new(("chan-rename", doc.id.0, format!("{:?}", row.reference()))), i.name.clone()));
+                ctx.data_mut(|d| d.insert_temp(egui::Id::unique(("chan-rename", doc.id.0, format!("{:?}", row.reference()))), i.name.clone()));
             }
             continue;
         }
@@ -398,11 +436,11 @@ fn drop_action(row: Row, name: &str, mask_layer: Option<u64>, on: Footer) -> Opt
 }
 
 fn drag_id() -> egui::Id {
-    egui::Id::new("channel-row-drag")
+    egui::Id::unique("channel-row-drag")
 }
 
 fn thumbs_id() -> egui::Id {
-    egui::Id::new("channel-thumb-rects")
+    egui::Id::unique("channel-thumb-rects")
 }
 
 /// The Channels rows drawn last frame: (name, thumbnail rect).
@@ -485,7 +523,7 @@ mod tests {
         ctx.run_ui(Default::default(), |_| {}).textures_delta.clear();
         let doc = app.session.active().unwrap().doc.id.0;
         let name = app.session.active().unwrap().doc.channels[0].name.clone();
-        ctx.data_mut(|d| d.insert_temp(egui::Id::new(("chan-rename", doc, format!("{:?}", Row::Alpha(0).reference()))), name));
+        ctx.data_mut(|d| d.insert_temp(egui::Id::unique(("chan-rename", doc, format!("{:?}", Row::Alpha(0).reference()))), name));
         // The field takes focus on the first pass and owns the IME from the second on (#585).
         let interrupts: Vec<Option<bool>> = (0..4)
             .map(|_| {
@@ -597,6 +635,39 @@ mod tests {
         h.state().session.active().unwrap().doc.channels.iter().map(|c| c.name.clone()).collect()
     }
 
+    /// #9163: alpha channels reorder by dragging, as in Photoshop: a drop in a row's upper half
+    /// lands above it, over the colour channels it lands first among the alphas, colour channels
+    /// don't move, and each reorder is one history step.
+    #[test]
+    fn alpha_channels_reorder_by_dragging() {
+        let (mut h, _) = channels_harness();
+        h.state_mut().run("channel.new", json!({"name": "Alpha 2"})).unwrap();
+        h.state_mut().run("channel.new", json!({"name": "Alpha 3"})).unwrap();
+        h.run_steps(3);
+        assert_eq!(alphas(&h), ["Alpha 1", "Alpha 2", "Alpha 3"]);
+        let steps = h.state().session.active().unwrap().history.past_len();
+
+        let (from, onto) = (at(&h, "Alpha 3"), at(&h, "Alpha 1"));
+        drag(&mut h, from, onto - vec2(0.0, 8.0));
+        assert_eq!(alphas(&h), ["Alpha 3", "Alpha 1", "Alpha 2"]);
+        assert_eq!(h.state().session.active().unwrap().history.past_len(), steps + 1, "one history step");
+
+        // The lower half of a row: below it.
+        let (from, onto) = (at(&h, "Alpha 3"), at(&h, "Alpha 1"));
+        drag(&mut h, from, onto + vec2(0.0, 8.0));
+        assert_eq!(alphas(&h), ["Alpha 1", "Alpha 3", "Alpha 2"]);
+
+        // Dropped on a colour channel: first among the alphas.
+        drag_to(&mut h, "Alpha 2", "Red");
+        assert_eq!(alphas(&h), ["Alpha 2", "Alpha 1", "Alpha 3"]);
+
+        // A colour channel dragged onto the alphas stays where it is.
+        let before = h.state().session.active().unwrap().history.past_len();
+        drag_to(&mut h, "Green", "Alpha 3");
+        assert_eq!(alphas(&h), ["Alpha 2", "Alpha 1", "Alpha 3"]);
+        assert_eq!(h.state().session.active().unwrap().history.past_len(), before);
+    }
+
     /// #4689: as in Photoshop, a channel dropped on New is duplicated, on Delete deleted, and on
     /// Load Channel as Selection loaded.
     #[test]
diff --git a/crates/ui-egui/src/chrome_ui.rs b/crates/ui-egui/src/chrome_ui.rs
index 51b043a21e..7822d13860 100644
--- a/crates/ui-egui/src/chrome_ui.rs
+++ b/crates/ui-egui/src/chrome_ui.rs
@@ -156,7 +156,10 @@ pub fn status_bar_pro(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     );
     let mut pct = app.ui.views[i].zoom * 100.0;
     let control_h = crate::panels::status_bar_heights(&t).1;
-    if widgets::compact_wrapping_value_field(ui, &mut pct, crate::zoom_levels::percent_range(&app.ui.views[i]), "%", vec2(64.0, control_h)).changed() {
+    if widgets::compact_wrapping_value_field(ui, &mut pct, crate::zoom_levels::percent_range(&app.ui.views[i]), "%", vec2(64.0, control_h))
+        .accessible_name(tl!("Zoom"))
+        .changed()
+    {
         app.ui.views[i].zoom = crate::zoom_levels::clamp(pct / 100.0, app.ui.views[i].doc_size);
         app.ui.views[i].zoom_animating = false;
         app.ui.views[i].zoom_anchor = None;
diff --git a/crates/ui-egui/src/cjk_fonts.rs b/crates/ui-egui/src/cjk_fonts.rs
index e4c2739fb4..6d3279d1ea 100644
--- a/crates/ui-egui/src/cjk_fonts.rs
+++ b/crates/ui-egui/src/cjk_fonts.rs
@@ -50,6 +50,9 @@ pub struct Sources {
     pub covers: fn(&[u8], char) -> Option<u32>,
     /// Embedded fonts tried before `files` for a script (craft-fonts' Japanese fonts).
     pub embedded: fn(CjkScript) -> Vec<&'static CraftFont>,
+    /// Register every craft-fonts face up front, so a headless frame can shape CJK and other
+    /// scripts before the lazy loader gets a second pass (tests panic on a missing glyph).
+    pub eager_craft_fonts: bool,
 }
 
 /// craft-fonts' Japanese fonts for the Japanese script, UI face first (empty without craft-fonts).
@@ -76,6 +79,7 @@ impl Sources {
             scripts: scripts::system_candidates,
             covers: scripts::covering_face,
             embedded: craft_embedded,
+            eager_craft_fonts: true,
         }
     }
     #[cfg(target_arch = "wasm32")]
@@ -87,6 +91,8 @@ impl Sources {
             scripts: |_| Vec::new(),
             covers: scripts::covering_face,
             embedded: craft_embedded,
+            // The web build embeds no craft fonts; keep its font stack as it was.
+            eager_craft_fonts: false,
         }
     }
 }
@@ -351,11 +357,11 @@ fn baseline_offset(face: (f32, f32, f32), primary: (f32, f32, f32)) -> f32 {
 /// Registers `name` at the lowest priority in every font family.
 fn add_to_all_families(ctx: &egui::Context, name: String, mut data: FontData) {
     // Align to Inter, the primary of every UI family; JetBrains Mono differs by under 0.005em.
-    let primary = ctx.fonts(|f| f.definitions().font_data.get("Inter").and_then(|p| vertical_metrics(&p.font, p.index)));
-    if let (Some(face), Some(primary)) = (vertical_metrics(&data.font, data.index), primary) {
+    let primary = ctx.fonts(|f| f.definitions().font_data.get("Inter").and_then(|p| vertical_metrics(p.bytes(), p.index)));
+    if let (Some(face), Some(primary)) = (vertical_metrics(data.bytes(), data.index), primary) {
         data.tweak.y_offset_factor = baseline_offset(face, primary);
     }
-    if let Some(weight) = regular_weight(&data.font, data.index) {
+    if let Some(weight) = regular_weight(data.bytes(), data.index) {
         data.tweak.coords = egui::epaint::text::VariationCoords::new([(b"wght", weight)]);
     }
     let mut families: Vec<FontFamily> = ctx.fonts(|f| f.definitions().families.keys().cloned().collect());
@@ -571,6 +577,7 @@ mod tests {
             scripts: |_| Vec::new(),
             covers: scripts::covering_face,
             embedded: no_embedded,
+            eager_craft_fonts: false,
         }
     }
 
@@ -607,6 +614,7 @@ mod tests {
                 scripts: |_| Vec::new(),
                 covers: scripts::covering_face,
                 embedded: no_embedded,
+                eager_craft_fonts: false,
             });
             fb.order = Some(cjk::script_order(Some(loc)));
             assert!(fb.next_font(CjkChar::Han).is_none());
@@ -728,6 +736,7 @@ mod tests {
             },
             covers: scripts::covering_face,
             embedded: no_embedded,
+            eager_craft_fonts: false,
         }
     }
 
@@ -859,7 +868,15 @@ mod tests {
 
     /// No system fonts at all: craft-fonts alone draws Japanese.
     fn craft_only(locale: fn() -> Option<String>) -> Sources {
-        Sources { locale, files: |_| vec![], last_resort: Vec::new, scripts: |_| Vec::new(), covers: scripts::covering_face, embedded: craft_embedded }
+        Sources {
+            locale,
+            files: |_| vec![],
+            last_resort: Vec::new,
+            scripts: |_| Vec::new(),
+            covers: scripts::covering_face,
+            embedded: craft_embedded,
+            eager_craft_fonts: false,
+        }
     }
 
     #[test]
@@ -876,7 +893,7 @@ mod tests {
             assert!(render(&ctx, "レイヤー 1"), "tofu in kana");
             let fonts = ctx.fonts(|f| f.definitions().clone());
             let name = format!("{FONT_PREFIX}-0");
-            assert!(fonts.font_data.get(&name).is_some_and(|d| std::ptr::eq(d.font.as_ref().as_ptr(), ui_font.bytes.as_ptr())), "BIZ UDPGothic Regular first");
+            assert!(fonts.font_data.get(&name).is_some_and(|d| std::ptr::eq(d.bytes().as_ptr(), ui_font.bytes.as_ptr())), "BIZ UDPGothic Regular first");
             for (fam, stack) in &fonts.families {
                 assert_eq!(stack.last(), Some(&name), "{fam:?}: appended last so Latin keeps Inter");
                 assert!(stack.first().is_some_and(|f| f != &name), "{fam:?}");
@@ -898,6 +915,7 @@ mod tests {
                 scripts: |_| Vec::new(),
                 covers: scripts::covering_face,
                 embedded: no_embedded,
+                eager_craft_fonts: false,
             },
         );
         assert!(render(&ctx, "Layer 1 – café"));
diff --git a/crates/ui-egui/src/clip_line_ui.rs b/crates/ui-egui/src/clip_line_ui.rs
index 2efcb73297..f879edb179 100644
--- a/crates/ui-egui/src/clip_line_ui.rs
+++ b/crates/ui-egui/src/clip_line_ui.rs
@@ -105,9 +105,9 @@ pub fn show(ui: &mut egui::Ui, doc: &Document, actions: &mut Vec<(String, Value)
     let Some(p) = hover.filter(|_| alt && ctx.dragged_id().is_none()) else { return };
     let Some(line) = at(doc, &crate::layer_row_ui::recorded(&ctx), p).filter(|l| ui.rect_contains_pointer(l.rect)) else { return };
     // Registered after the rows, so it is on top of them and gets the click.
-    let resp = ui.interact(line.rect, ui.id().with("clip-line"), Sense::click());
+    let resp = ui.interact(line.rect, ui.scope_id().with("clip-line"), Sense::click());
     let label = if line.release { "Release Clipping Mask" } else { "Create Clipping Mask" };
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, label));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, label));
     // PhotoCraft's own cursors: a hooked arrow onto the layer below, and the same arrow with a
     // small "no" badge to release. The arrow's tip, (15, 16) of the 24-unit box, is the hot spot.
     let icon = if line.release { "clip-release" } else { "clip-below" };
diff --git a/crates/ui-egui/src/clipping_indicator_tests.rs b/crates/ui-egui/src/clipping_indicator_tests.rs
index d95bdedf27..99c22ecf10 100644
--- a/crates/ui-egui/src/clipping_indicator_tests.rs
+++ b/crates/ui-egui/src/clipping_indicator_tests.rs
@@ -129,7 +129,13 @@ fn scroll_to_adjustment_control(h: &mut Harness<'_, PhotocraftApp>, label: &str)
         }
         // The label column stays clear of the Color Lookup picker, which consumes wheel input.
         h.hover_at(pos2(16.0, 80.0));
-        h.event(Event::MouseWheel { unit: egui::MouseWheelUnit::Point, delta: vec2(0.0, -80.0), phase: egui::TouchPhase::Move, modifiers: Modifiers::NONE });
+        h.event(Event::MouseWheel {
+            source: egui::MouseWheelSource::Trackpad,
+            unit: egui::MouseWheelUnit::Point,
+            delta: vec2(0.0, -80.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: Modifiers::NONE,
+        });
         h.run_steps(4);
     }
     panic!("adjustment control {label:?} was not reachable in the compact viewport");
@@ -199,18 +205,17 @@ fn write_adjustment_scope_preview() {
     std::fs::create_dir_all(&output).unwrap();
     for theme in [crate::theme::ThemeKind::Pro, crate::theme::ThemeKind::Studio] {
         let mut h = adjustment_harness("Hue/Saturation", 8, theme, 2.0, true);
-        h.ctx.send_viewport_cmd(egui::ViewportCommand::Screenshot(Default::default()));
+        // egui 0.37 completes screenshots through a one-shot callback.
+        let captured = std::sync::Arc::new(std::sync::Mutex::new(None));
+        let slot = captured.clone();
+        h.ctx.send_viewport_cmd(egui::ViewportCommand::Screenshot(egui::ScreenshotCallback::new(move |image| {
+            if let Ok(mut slot) = slot.lock() {
+                *slot = Some(image);
+            }
+        })));
         h.step();
         h.step();
-        let image = h
-            .ctx
-            .input(|input| {
-                input.events.iter().find_map(|event| match event {
-                    Event::Screenshot { image, .. } => Some(image.clone()),
-                    _ => None,
-                })
-            })
-            .unwrap();
+        let image = captured.lock().ok().and_then(|mut c| c.take()).expect("the kittest renderer completes the screenshot callback");
         let rgba = image.pixels.iter().flat_map(|pixel| pixel.to_array()).collect();
         let image = photocraft_codecs::Image::from_u8(image.size[0] as u32, image.size[1] as u32, photocraft_codecs::ChannelLayout::Rgba, rgba).unwrap();
         let png = photocraft_codecs::encode(&image, photocraft_codecs::Format::Png, &Default::default()).unwrap();
@@ -229,13 +234,17 @@ fn write_clipping_indicator_preview() {
             for scale in [1.0, 2.0] {
                 let mut h = harness(theme, width, scale, true);
                 alt_click_line(&mut h);
-                h.ctx.send_viewport_cmd(egui::ViewportCommand::Screenshot(Default::default()));
+                // egui 0.37 completes screenshots through a one-shot callback.
+                let captured = std::sync::Arc::new(std::sync::Mutex::new(None));
+                let slot = captured.clone();
+                h.ctx.send_viewport_cmd(egui::ViewportCommand::Screenshot(egui::ScreenshotCallback::new(move |image| {
+                    if let Ok(mut slot) = slot.lock() {
+                        *slot = Some(image);
+                    }
+                })));
                 h.step();
                 h.step();
-                let image = h
-                    .ctx
-                    .input(|input| input.events.iter().find_map(|event| if let Event::Screenshot { image, .. } = event { Some(image.clone()) } else { None }))
-                    .unwrap();
+                let image = captured.lock().ok().and_then(|mut c| c.take()).expect("the kittest renderer completes the screenshot callback");
                 let rgba = image.pixels.iter().flat_map(|pixel| pixel.to_array()).collect();
                 let image =
                     photocraft_codecs::Image::from_u8(image.size[0] as u32, image.size[1] as u32, photocraft_codecs::ChannelLayout::Rgba, rgba).unwrap();
diff --git a/crates/ui-egui/src/color_panel_ui.rs b/crates/ui-egui/src/color_panel_ui.rs
index 88028502e8..19f223b8a2 100644
--- a/crates/ui-egui/src/color_panel_ui.rs
+++ b/crates/ui-egui/src/color_panel_ui.rs
@@ -129,12 +129,12 @@ pub(crate) fn set_color(app: &mut PhotocraftApp, ctx: &egui::Context, background
 /// The key of the slider values last shown for `model`, kept while they still give the colour:
 /// a grey has no hue, and CMYK or Lab values don't survive an sRGB round trip (#3228).
 fn values_key(model: Model, background: bool) -> egui::Id {
-    egui::Id::new(("color-panel-values", model, background))
+    egui::Id::unique(("color-panel-values", model, background))
 }
 
 /// The key of the Hue Cube's remembered hue and saturation (see [`field_hsva`]).
 fn field_key(background: bool) -> egui::Id {
-    egui::Id::new(("color-field-hue", background))
+    egui::Id::unique(("color-field-hue", background))
 }
 
 /// Slider values for the colour the panel edits: the ones last shown while they still give it.
@@ -192,7 +192,7 @@ pub(crate) fn rgb32(c: [f32; 3]) -> Color32 {
 fn slider_rows(ui: &mut egui::Ui, model: Model, v: [f32; 4], background: bool, dynamic: bool) -> Option<[f32; 4]> {
     let t = Tokens::get(ui.ctx());
     // Dynamic Color Sliders off: the tracks keep the colours they had when a drag began.
-    let stops_key = egui::Id::new(("color-panel-stops", model, background));
+    let stops_key = egui::Id::unique(("color-panel-stops", model, background));
     let dragging = ui.input(|i| i.pointer.any_down());
     let stops_from = if dynamic || !dragging { v } else { ui.data(|d| d.get_temp::<[f32; 4]>(stops_key)).unwrap_or(v) };
     if !dragging {
@@ -215,7 +215,7 @@ fn slider_rows(ui: &mut egui::Ui, model: Model, v: [f32; 4], background: bool, d
             changed |= track(ui, tr, &resp, &mut x, lo, hi, &stops, model == Model::Web);
             resp.widget_info(|| egui::WidgetInfo::slider(ui.is_enabled(), f64::from(x), label));
             if model == Model::Web {
-                changed |= hex_pair(ui, ui.id().with(("web-field", i, background)), &mut x);
+                changed |= hex_pair(ui, ui.scope_id().with(("web-field", i, background)), &mut x);
             } else if widgets::value_field(ui, &mut x, lo..=hi, "", FIELD_W).changed() {
                 changed = true;
             }
@@ -366,8 +366,8 @@ fn alerts(app: &mut PhotocraftApp, ui: &mut egui::Ui, col: Rect, rgb: [f32; 3],
         }
         ui.painter().rect_filled(chip, 0.0, rgb32(near));
         ui.painter().rect_stroke(chip, 0.0, Stroke::new(1.0, t.text_dim), StrokeKind::Outside);
-        let resp = ui.interact(icon.union(chip), ui.id().with(("color-panel-alert", slot)), Sense::click());
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), tip));
+        let resp = ui.interact(icon.union(chip), ui.scope_id().with(("color-panel-alert", slot)), Sense::click());
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tip));
         if resp.on_hover_text(tl!(tip)).clicked() {
             set_color(app, ui.ctx(), background, near);
         }
@@ -411,7 +411,7 @@ fn ramp_colors(ui: &egui::Ui, ramp: ColorRamp, web_safe: bool, fg: [f32; 3], bg:
         convert::active_cmyk_space().map(|s| Arc::as_ptr(&s) as usize).hash(&mut h);
     }
     let sig = h.finish();
-    let key = egui::Id::new("color-panel-ramp-cache");
+    let key = egui::Id::unique("color-panel-ramp-cache");
     if let Some((s, colors)) = ui.data(|d| d.get_temp::<(u64, Arc<Vec<Color32>>)>(key))
         && s == sig
     {
@@ -475,7 +475,7 @@ fn ramp(app: &mut PhotocraftApp, ui: &mut egui::Ui, height: f32) {
     let bar = Rect::from_min_max(all.min, pos2(all.right() - BOXES_W - 2.0, all.bottom()));
     let boxes = Rect::from_min_max(pos2(all.right() - BOXES_W, all.top()), all.max);
     let cp = app.ui.color_panel;
-    let ramp_id = ui.id().with("color-panel-ramp");
+    let ramp_id = ui.scope_id().with("color-panel-ramp");
     // A pick changes the foreground or background, so a drag keeps the Current Colors ends it began
     // with; otherwise the ramp would slide under the pointer and a held pick would drift.
     let ends_id = ramp_id.with("ends");
@@ -495,7 +495,7 @@ fn ramp(app: &mut PhotocraftApp, ui: &mut egui::Ui, height: f32) {
     ui.painter().rect_filled(black, 0.0, Color32::BLACK);
     ui.painter().rect_stroke(boxes, 0.0, Stroke::new(1.0, t.field_border), StrokeKind::Outside);
     let resp = ui.interact(bar, ramp_id, Sense::click_and_drag());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Other, ui.is_enabled(), "Color Ramp"));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Unknown, ui.is_enabled(), "Color Ramp"));
     let mods = ui.input(|i| i.modifiers);
     let target = cp.background != mods.alt;
     if resp.clicked() && mods.shift {
@@ -520,8 +520,8 @@ fn ramp(app: &mut PhotocraftApp, ui: &mut egui::Ui, height: f32) {
         ramp_menu(app, ui);
     });
     for (r, c, name) in [(white, [1.0; 3], "White"), (black, [0.0; 3], "Black")] {
-        let b = ui.interact(r, ui.id().with(("color-panel-box", name)), Sense::click());
-        b.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), name));
+        let b = ui.interact(r, ui.scope_id().with(("color-panel-box", name)), Sense::click());
+        b.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), name));
         if b.clicked() {
             set_color(app, ui.ctx(), target, c);
         }
@@ -560,7 +560,7 @@ fn wheel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let w = ui.available_width();
     let side = fill.filter(|f| f.is_finite()).map_or(w.min(220.0), |f| (f - top_h - gaps).min(w)).max(80.0);
     let (area, resp) = ui.allocate_exact_size(vec2(w, side), Sense::click_and_drag());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Other, ui.is_enabled(), "Color Wheel"));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Unknown, ui.is_enabled(), "Color Wheel"));
     let (center, inner, outer) = wheel_geometry(area);
     let ring_w = outer - inner;
     let (h, s, b) = (v[0] / 360.0, v[1] / 100.0, v[2] / 100.0);
@@ -570,7 +570,7 @@ fn wheel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     // Which part a drag began on: the ring sets the hue, the triangle saturation and brightness.
     // The ring or the triangle, from where the press began (kept for frames without a press
     // origin), so a drag that leaves the ring keeps turning the hue.
-    let drag_key = ui.id().with("color-wheel-drag");
+    let drag_key = ui.scope_id().with("color-wheel-drag");
     if (resp.dragged() || resp.clicked())
         && let Some(p) = resp.interact_pointer_pos()
     {
@@ -616,8 +616,8 @@ fn wheel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     ui.painter().rect_stroke(add, 1.0, Stroke::new(1.0, t.text_dim), StrokeKind::Inside);
     ui.painter().line_segment([pos2(add.center().x, add.top() + 3.5), pos2(add.center().x, add.bottom() - 3.5)], Stroke::new(1.0, t.text_dim));
     ui.painter().line_segment([pos2(add.left() + 3.5, add.center().y), pos2(add.right() - 3.5, add.center().y)], Stroke::new(1.0, t.text_dim));
-    let add_resp = ui.interact(add, ui.id().with("color-wheel-add"), Sense::click());
-    add_resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), "Add to Swatches"));
+    let add_resp = ui.interact(add, ui.scope_id().with("color-wheel-add"), Sense::click());
+    add_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), "Add to Swatches"));
     if add_resp.on_hover_text(tl!("Create new swatch")).clicked()
         && let Err(e) = app.run("swatches.add", json!({"color": hex(rgb)}))
     {
diff --git a/crates/ui-egui/src/color_picker_ui.rs b/crates/ui-egui/src/color_picker_ui.rs
index ece2fbafb3..2c0286a4c9 100644
--- a/crates/ui-egui/src/color_picker_ui.rs
+++ b/crates/ui-egui/src/color_picker_ui.rs
@@ -431,7 +431,7 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) -> Option<bool> {
             // Under the colour field, not in the action column: the dialog must still fit a
             // 760 x 480 window.
             ui.add_space(4.0);
-            if let Some(rgb) = crate::screen_picker::button(ui, ui.id().with("screen-color")) {
+            if let Some(rgb) = crate::screen_picker::button(ui, ui.scope_id().with("screen-color")) {
                 set_rgb(f, rgb, Keep::Nothing);
             }
         });
@@ -536,8 +536,8 @@ fn swatches(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
     let cur = Rect::from_min_size(sw.min + vec2(0.0, 32.0), vec2(56.0, 32.0));
     p.rect_filled(cur, 0.0, c32(orig));
     p.rect_stroke(sw, 0.0, Stroke::new(1.0, t.field_border), StrokeKind::Outside);
-    let click_cur = ui.interact(cur, ui.id().with("cp-current"), Sense::click());
-    click_cur.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), tl!("Click to restore the current colour")));
+    let click_cur = ui.interact(cur, ui.scope_id().with("cp-current"), Sense::click());
+    click_cur.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tl!("Click to restore the current colour")));
     if click_cur.on_hover_text(tl!("Click to restore the current colour")).clicked() {
         set_rgb(f, orig, Keep::Nothing);
     }
@@ -558,8 +558,8 @@ fn swatches(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
         }
         p.rect_filled(chip, 0.0, c32(near));
         p.rect_stroke(chip, 0.0, Stroke::new(1.0, t.text_dim), StrokeKind::Outside);
-        let resp = ui.interact(icon.union(chip), ui.id().with(("cp-warning", slot as i32)), Sense::click());
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), tip));
+        let resp = ui.interact(icon.union(chip), ui.scope_id().with(("cp-warning", slot as i32)), Sense::click());
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tip));
         if resp.on_hover_text(tip).clicked() {
             set_rgb(f, near, Keep::Nothing);
         }
@@ -598,7 +598,7 @@ fn radio(ui: &mut egui::Ui, on: bool, label: &str) -> bool {
     if on {
         ui.painter().circle_filled(r.center(), 3.0, t.accent);
     }
-    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::RadioButton, ui.is_enabled(), on, label));
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::RadioButton, ui.is_enabled(), on, label));
     resp.clicked()
 }
 
@@ -623,7 +623,7 @@ fn fields(ui: &mut egui::Ui, f: &mut Map<String, Value>, mode: &str, now: &Compo
                     }
                     ui.label(egui::RichText::new(tl!(&label)).color(t.text_dim));
                     let mut v = vals[i].round();
-                    if widgets::value_field(ui, &mut v, ranges[i].clone(), "", VALUE_W).changed() {
+                    if widgets::value_field(ui, &mut v, ranges[i].clone(), "", VALUE_W).accessible_name(tl!(&label)).changed() {
                         let (mut h, mut c) = (hsv, rgb);
                         if i < 3 {
                             h[i] = if i == 0 { v } else { v / 100.0 };
@@ -647,7 +647,7 @@ fn fields(ui: &mut egui::Ui, f: &mut Map<String, Value>, mode: &str, now: &Compo
                 ui.label(egui::RichText::new("#").color(t.text_dim));
                 // While the field has focus it shows what is being typed, not the colour: rebuilding it from
                 // the colour every frame would throw away every keystroke until six valid digits were in.
-                let id = ui.id().with("cp-hex");
+                let id = ui.scope_id().with("cp-hex");
                 crate::field_tab::register(ui.ctx(), id);
                 if !f.contains_key("__focused") {
                     f.insert("__focused".into(), json!(true));
@@ -668,7 +668,7 @@ fn fields(ui: &mut egui::Ui, f: &mut Map<String, Value>, mode: &str, now: &Compo
                         _ => shown.trim_start_matches('#').to_ascii_uppercase(),
                     },
                 };
-                let r = crate::widgets::text_field_ex(ui, id, &mut h, "", 64.0, true, Some(6));
+                let r = crate::widgets::text_field_ex(ui, id, &mut h, "", 64.0, true, Some(6)).accessible_name(tl!("Color"));
                 if let Some(c) = pasted {
                     edit = Some((c, Keep::Nothing));
                 }
@@ -695,7 +695,7 @@ fn fields(ui: &mut egui::Ui, f: &mut Map<String, Value>, mode: &str, now: &Compo
                 }
                 ui.label(egui::RichText::new(tl!(&label)).color(t.text_dim));
                 let mut x = v.round();
-                if widgets::value_field(ui, &mut x, range, "", VALUE_W).changed() {
+                if widgets::value_field(ui, &mut x, range, "", VALUE_W).accessible_name(tl!(&label)).changed() {
                     let mut l = lab;
                     l[i] = x;
                     edit = Some((photocraft_color::convert::lab_to_srgb(l).map(|c| c.clamp(0.0, 1.0)), Keep::Lab(l)));
@@ -709,7 +709,7 @@ fn fields(ui: &mut egui::Ui, f: &mut Map<String, Value>, mode: &str, now: &Compo
                 ui.allocate_exact_size(vec2(14.0, 14.0), Sense::hover());
                 ui.label(egui::RichText::new(tl!(&label)).color(t.text_dim));
                 let mut x = (cmyk[i] * 100.0).round();
-                if widgets::value_field(ui, &mut x, 0.0..=100.0, "", VALUE_W).changed() {
+                if widgets::value_field(ui, &mut x, 0.0..=100.0, "", VALUE_W).accessible_name(tl!(&label)).changed() {
                     let mut k = cmyk;
                     k[i] = x / 100.0;
                     edit = Some((photocraft_color::convert::cmyk_to_rgb(k).map(|c| c.clamp(0.0, 1.0)), Keep::Cmyk(k)));
@@ -886,14 +886,14 @@ mod tests {
                 ui.horizontal(|ui| {
                     let o = ui.cursor().min;
                     let gap = ui.spacing().item_spacing.x;
-                    ui.data_mut(|d| d.insert_temp(egui::Id::new("test-origin"), (o, gap)));
+                    ui.data_mut(|d| d.insert_temp(egui::Id::unique("test-origin"), (o, gap)));
                     color_field(ui, f);
                 });
             },
             f,
         );
         h.run_steps(2);
-        let (o, gap) = h.ctx.data(|d| d.get_temp::<(egui::Pos2, f32)>(egui::Id::new("test-origin"))).unwrap();
+        let (o, gap) = h.ctx.data(|d| d.get_temp::<(egui::Pos2, f32)>(egui::Id::unique("test-origin"))).unwrap();
         // Field: saturation across, brightness down (hue mode).
         let at = o + vec2(FIELD * 0.5, FIELD * 0.5);
         press(&mut h, at);
@@ -931,14 +931,14 @@ mod tests {
                 ui.horizontal(|ui| {
                     let o = ui.cursor().min;
                     let gap = ui.spacing().item_spacing.x;
-                    ui.data_mut(|d| d.insert_temp(egui::Id::new("test-origin"), (o, gap)));
+                    ui.data_mut(|d| d.insert_temp(egui::Id::unique("test-origin"), (o, gap)));
                     color_field(ui, f);
                 });
             },
             f,
         );
         h.run_steps(2);
-        let (o, gap) = h.ctx.data(|d| d.get_temp::<(egui::Pos2, f32)>(egui::Id::new("test-origin"))).unwrap();
+        let (o, gap) = h.ctx.data(|d| d.get_temp::<(egui::Pos2, f32)>(egui::Id::unique("test-origin"))).unwrap();
         for at in [o + vec2(FIELD * 0.5, FIELD * 0.5), o + vec2(FIELD + gap + 9.0, FIELD * 0.95)] {
             for button in [egui::PointerButton::Secondary, egui::PointerButton::Middle] {
                 press_button(&mut h, at, button, true);
@@ -1115,7 +1115,7 @@ mod tests {
         h.run_steps(4);
         let id = open(h.state_mut(), "foreground");
         h.run_steps(6);
-        let rect = h.ctx.memory(|m| m.area_rect(egui::Id::new(("dialog", id)))).expect("the picker window");
+        let rect = h.ctx.memory(|m| m.area_rect(egui::Id::unique(("dialog", id)))).expect("the picker window");
         assert!(rect.width() <= 534.0 && rect.height() <= 376.0, "Color Picker window {} x {} points, Photoshop's 534 x 376", rect.width(), rect.height());
         // Everything still shows: the three actions and all 13 component fields.
         for label in ["OK", "Cancel", "Add to Swatches", "Only Web Colors"] {
diff --git a/crates/ui-egui/src/color_range_ui.rs b/crates/ui-egui/src/color_range_ui.rs
index 59b3bfeb2f..a21d3ef71f 100644
--- a/crates/ui-egui/src/color_range_ui.rs
+++ b/crates/ui-egui/src/color_range_ui.rs
@@ -408,7 +408,7 @@ fn eyedropper(ui: &mut egui::Ui, badge: &str, selected: bool, label: &str) -> eg
         let at = r.rect.right_bottom() - vec2(5.0, 6.0);
         ui.painter().text(at, egui::Align2::CENTER_CENTER, badge, crate::theme::semibold(12.0), if selected { t.accent_text } else { t.text });
     }
-    r.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, ui.is_enabled(), selected, label));
+    r.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, ui.is_enabled(), selected, label));
     r
 }
 
@@ -424,7 +424,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(tl!("Select:")).color(t.text_dim));
         let mut cur: &str = &select;
-        if widgets::dropdown(ui, "color-range-select", &mut cur, SELECTS, 170.0) {
+        if widgets::dropdown(ui, "color-range-select", tl!("Select"), &mut cur, SELECTS, 170.0) {
             f.insert("select".into(), json!(cur));
         }
     });
@@ -512,7 +512,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
             Some(e) => format!("Color Range preview unavailable: {e}"),
             None => tl!("Color Range preview").to_string(),
         };
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Image, ui.is_enabled(), &label));
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Image, ui.is_enabled(), &label));
         ui.add_space(10.0);
         ui.vertical(|ui| {
             ui.add_enabled_ui(c.sampling, |ui| {
@@ -566,7 +566,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
         ui.label(egui::RichText::new(tl!("Selection Preview:")).color(t.text_dim));
         let mode = s(f, "__selectionPreview", "none").to_string();
         let mut chosen = mode.as_str();
-        if widgets::dropdown(ui, "color-range-selection-preview", &mut chosen, PREVIEWS, 170.0) {
+        if widgets::dropdown(ui, "color-range-selection-preview", tl!("Preview"), &mut chosen, PREVIEWS, 170.0) {
             f.insert("__selectionPreview".into(), json!(chosen));
         }
     });
@@ -685,7 +685,7 @@ pub fn canvas_eyedropper(app: &mut PhotocraftApp, ctx: &egui::Context, over: egu
         _ => "",
     };
     if !badge.is_empty() {
-        let p = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("pc-color-range-badge")));
+        let p = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("pc-color-range-badge")));
         let at = over + vec2(20.0, -4.0);
         p.text(at + vec2(1.0, 1.0), egui::Align2::CENTER_CENTER, badge, crate::theme::semibold(13.0), Color32::from_black_alpha(200));
         p.text(at, egui::Align2::CENTER_CENTER, badge, crate::theme::semibold(13.0), Color32::WHITE);
@@ -807,7 +807,8 @@ mod tests {
     }
 
     fn disabled(h: &Harness<'static, PhotocraftApp>, label: &str) -> bool {
-        h.get_by_label(label).accesskit_node().is_disabled()
+        // A slider row names both its number and its slider with the caption; either reports it.
+        h.query_all_by_label(label).next().unwrap_or_else(|| panic!("`{label}`")).accesskit_node().is_disabled()
     }
 
     #[test]
@@ -906,7 +907,7 @@ mod tests {
         h.run_steps(3);
         assert!(h.state().ui.dialogs.iter().any(|d| owns(&d.fields)), "Select › Color Range… must open the dialog");
         for label in ["Color Range", "Fuzziness:", "Localized Color Clusters", "Invert", "Selection", "Color Range preview", "Add to Sample"] {
-            assert!(h.query_by_label(label).is_some(), "missing {label}");
+            assert!(h.query_all_by_label(label).next().is_some(), "missing {label}");
         }
         assert_eq!(h.query_all_by_label("Image").count(), 2, "the Image menu and the Image preview radio");
         assert_eq!(h.state().session.active().unwrap().revision, rev, "opening must not edit the document");
@@ -923,23 +924,23 @@ mod tests {
         h.run_steps(4);
         // Sampled Colors: Fuzziness, eyedroppers and Localized Color Clusters; Range only when localized.
         assert!(!disabled(&h, "Fuzziness:") && !disabled(&h, "Localized Color Clusters") && !disabled(&h, "Add to Sample"));
-        assert!(h.query_by_label("Range:").is_none());
+        assert!(h.query_all_by_label("Range:").next().is_none());
         h.get_by_label("Localized Color Clusters").click();
         h.run_steps(2);
-        assert!(h.query_by_label("Range:").is_some(), "Range shows with Localized Color Clusters");
+        assert!(h.query_all_by_label("Range:").next().is_some(), "Range shows with Localized Color Clusters");
         // A hue family: no Fuzziness, eyedroppers or clusters (Photoshop disables them).
         set(&mut h, "select", json!("reds"));
         assert!(disabled(&h, "Fuzziness:") && disabled(&h, "Localized Color Clusters") && disabled(&h, "Add to Sample"));
-        assert!(h.query_by_label("Range:").is_none());
+        assert!(h.query_all_by_label("Range:").next().is_none());
         assert!(!disabled(&h, "Invert"));
         // Tones: Fuzziness and the tonal range.
         set(&mut h, "select", json!("shadows"));
         assert!(!disabled(&h, "Fuzziness:") && disabled(&h, "Localized Color Clusters"));
-        assert!(h.query_by_label("Shadows up to:").is_some());
+        assert!(h.query_all_by_label("Shadows up to:").next().is_some());
         set(&mut h, "select", json!("midtones"));
-        assert!(h.query_by_label("Midtones from:").is_some() && h.query_by_label("Midtones to:").is_some());
+        assert!(h.query_all_by_label("Midtones from:").next().is_some() && h.query_all_by_label("Midtones to:").next().is_some());
         set(&mut h, "select", json!("outOfGamut"));
-        assert!(disabled(&h, "Fuzziness:") && h.query_by_label("Midtones from:").is_none());
+        assert!(disabled(&h, "Fuzziness:") && h.query_all_by_label("Midtones from:").next().is_none());
         // Skin Tones: Fuzziness (the colour one), no eyedroppers or clusters.
         set(&mut h, "select", json!("skinTones"));
         assert!(!disabled(&h, "Fuzziness:") && disabled(&h, "Localized Color Clusters") && disabled(&h, "Add to Sample"));
@@ -956,7 +957,7 @@ mod tests {
         let mut h = harness(app_with_doc());
         open(h.state_mut());
         h.run_steps(4);
-        let area = egui::Id::new(("dialog", dialog_id(h.state())));
+        let area = egui::Id::unique(("dialog", dialog_id(h.state())));
         let rect = |h: &Harness<'static, PhotocraftApp>| h.ctx.memory(|m| m.area_rect(area)).unwrap_or(egui::Rect::NOTHING);
         set(&mut h, "select", json!("outOfGamut"));
         let short = rect(&h);
@@ -1273,7 +1274,7 @@ mod tests {
         h.get_by_label("Color Range…").click();
         h.run_steps(6);
         let id = dialog_id(h.state());
-        let area = h.ctx.memory(|m| m.area_rect(egui::Id::new(("dialog", id)))).expect("the dialog is drawn");
+        let area = h.ctx.memory(|m| m.area_rect(egui::Id::unique(("dialog", id)))).expect("the dialog is drawn");
         assert!(h.ctx.content_rect().contains_rect(area), "the dialog is on screen: {area:?}");
         assert!(h.query_by_label("Color Range preview").is_some());
         let p = h.state().color_range.as_ref().expect("the preview is cached");
diff --git a/crates/ui-egui/src/color_tab_theme_tests.rs b/crates/ui-egui/src/color_tab_theme_tests.rs
index 7996284d94..8fdfb0b48f 100644
--- a/crates/ui-egui/src/color_tab_theme_tests.rs
+++ b/crates/ui-egui/src/color_tab_theme_tests.rs
@@ -9,7 +9,7 @@ use crate::dock::Group;
 use crate::theme::{ThemeKind, Tokens};
 
 fn left_top() -> egui::Id {
-    egui::Id::new("color-tab-test-origin")
+    egui::Id::unique("color-tab-test-origin")
 }
 
 /// The Color tab of `kind`, alone in a 300 pt wide panel, starting from a red foreground. `fill`
@@ -59,7 +59,7 @@ fn every_theme_shows_the_same_spectrum_field() {
         assert!((r - g).abs() < 0.02 && (g - b).abs() < 0.02 && (0.3..0.7).contains(&r), "{kind:?}: the field picks a mid grey, got {r} {g} {b}");
         // No theme swaps the field for sliders or adds them under it (#6000).
         for slider in ["Hue", "Saturation", "Brightness"] {
-            assert!(h.query_by_label(slider).is_none(), "{kind:?}: no {slider} slider");
+            assert!(h.query_all_by_label(slider).next().is_none(), "{kind:?}: no {slider} slider");
         }
     }
 }
diff --git a/crates/ui-egui/src/comps_ui.rs b/crates/ui-egui/src/comps_ui.rs
index 29f5286024..bcff54de4a 100644
--- a/crates/ui-egui/src/comps_ui.rs
+++ b/crates/ui-egui/src/comps_ui.rs
@@ -36,7 +36,7 @@ struct RenameComp {
 fn rename_field(ui: &mut egui::Ui, id: egui::Id, rect: Rect) -> Option<String> {
     let mut r = ui.data(|d| d.get_temp::<RenameComp>(id))?;
     ui.data_mut(|d| d.remove::<RenameComp>(id));
-    let te = ui.put(rect, egui::TextEdit::singleline(&mut r.text).id(id).font(egui::FontId::proportional(12.0)));
+    let te = ui.put(rect, egui::TextEdit::singleline(&mut r.text).id(id).font(egui::FontId::proportional(12.0))).accessible_name(tl!("Name"));
     if !r.focused {
         te.request_focus();
         // Like Photoshop, the whole name starts selected so typing replaces it.
@@ -126,7 +126,7 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         }
         for (index, c) in doc.layer_comps.iter().enumerate() {
             let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), row_h), Sense::click_and_drag());
-            resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, selected == Some(c.id), &c.name));
+            resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected == Some(c.id), &c.name));
             resp.dnd_set_drag_payload(DragComp { document: doc.id, comp: c.id });
             if let Some(source) = resp.dnd_hover_payload::<DragComp>()
                 && source.document == doc.id
@@ -213,7 +213,7 @@ pub fn panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             let name = ui.painter().layout(c.name.clone(), egui::FontId::proportional(12.0), t.text, galley_w);
             let name_rect = Rect::from_min_size(pos2(name_x, rect.center().y - name.size().y / 2.0), name.size());
             // Comp ids restart in every document, so the pending name is keyed by the document too.
-            let rename_id = egui::Id::new(("comp-rename", doc.id.0, c.id));
+            let rename_id = egui::Id::unique(("comp-rename", doc.id.0, c.id));
             if ui.data(|d| d.get_temp::<RenameComp>(rename_id)).is_some() {
                 let field = Rect::from_min_max(pos2(name_x - 3.0, rect.top() + 3.0), pos2((x + 10.0).max(name_x + 60.0), rect.bottom() - 3.0));
                 if let Some(text) = rename_field(ui, rename_id, field) {
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index b85427c6fa..550c121827 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -8,7 +8,7 @@
 //! - `engine.commands`: list commands with enablement
 //! - `ui.inspect`: full UI state (tool, panels, views, dialogs, windows, window size); the menu
 //!   tree is `ui.menu.list`
-//! - `ui.set {tool?, panels?, dock?, dockTabs?, dockWidth?, colorPanel?, maskTarget?, vectorMaskTarget?, selectionMode?, zoom?, center?, rotation?, fit?, theme?, brushSection?, brushTab?, brushesView?, brushPicker?, brushPickerName?, brushPickerStroke?, brushPickerTip?, brushPickerScale?, brushSize?}`:
+//! - `ui.set {tool?, panels?, dock?, dockTabs?, dockWidth?, colorPanel?, maskTarget?, vectorMaskTarget?, filterMaskTarget?, selectionMode?, zoom?, center?, rotation?, fit?, theme?, brushSection?, brushTab?, brushesView?, brushPicker?, brushPickerName?, brushPickerStroke?, brushPickerTip?, brushPickerScale?, brushSize?}`:
 //!   change UI state; any other field is an error ([`UI_SET_FIELDS`])
 //! - `ui.dialog.open {kind, fields?}` (kinds: newDocument, about, layerStyle {effect?}, colorPicker {target: foreground|background}, command {command}) / `ui.dialog.set {dialog, field, value}` / `ui.dialog.confirm {dialog, wait?}` / `ui.dialog.cancel {dialog}`
 //! - `ui.dialog.apply {dialog}`: commit Preferences changes without closing the dialog
@@ -133,7 +133,7 @@ pub enum Outcome {
 /// field's value is validated before the first one is applied, so a typo, an unknown field, a
 /// bad value or a bad nested key can't reply with success while nothing — or only half of it —
 /// changed (#412).
-pub const UI_SET_FIELDS: [&str; 39] = [
+pub const UI_SET_FIELDS: [&str; 43] = [
     "updatesOpen",
     "tool",
     "strokeTrace",
@@ -144,6 +144,7 @@ pub const UI_SET_FIELDS: [&str; 39] = [
     "colorPanel",
     "maskTarget",
     "vectorMaskTarget",
+    "filterMaskTarget",
     "selectionMode",
     "zoom",
     "center",
@@ -173,6 +174,9 @@ pub const UI_SET_FIELDS: [&str; 39] = [
     "camTransformOnDrop",
     "tileGrid",
     "layerFilter",
+    "histogramPanel",
+    "histogramRange",
+    "histogramRefresh",
 ];
 
 /// Most clicks one `ui.click` may queue (#982). Each click is a press and a release that the app
@@ -389,12 +393,16 @@ pub fn handle(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest
 /// The open canvas context menu's rows for `ui.state`: the spelling suggestions first (type edit
 /// menu over a misspelled word), then the menu's own rows.
 fn context_entries(app: &PhotocraftApp, menu: &crate::canvas_tool_menu::CanvasToolMenu) -> Vec<Value> {
-    use crate::canvas_tool_menu::{entry_enabled, rows, spelling_rows};
+    use crate::canvas_tool_menu::{crop_rows, entry_enabled, rows, spelling_rows};
     let spelling = spelling_rows(menu);
     let mut entries: Vec<Value> = spelling.iter().map(|(label, id)| json!({"label": label, "id": id, "enabled": entry_enabled(app, menu, id)})).collect();
     if !spelling.is_empty() {
         entries.push(json!({"separator": true}));
     }
+    entries.extend(crop_rows(menu).iter().map(|row| match row {
+        Some((label, id)) => json!({"label": label, "id": id, "enabled": entry_enabled(app, menu, id)}),
+        None => json!({"separator": true}),
+    }));
     entries.extend(rows(menu).iter().map(|row| match row {
         Some((label, id)) => json!({"label": label, "id": id, "enabled": entry_enabled(app, menu, id)}),
         None => json!({"separator": true}),
@@ -428,16 +436,16 @@ fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest)
             let Some(id) = s("command").or(s("id")) else { return err("missing `command`") };
             let params = p.get("params").cloned().unwrap_or(json!({}));
             // A control-channel menu click must respect the same modal gate as the native menu.
-            // Camera Raw's documented `ui` requests operate its already-open dialog rather
-            // than click a menu. Only that continuation may pass its own modal gate.
-            // engine.execute is deliberately not subject to the UI's menu-click semantics.
-            let camera_raw_continuation = id == "filter.cameraRaw"
-                && app.camera_raw.is_some()
+            // The documented `ui` requests of Camera Raw and the full-window workspaces operate
+            // the already-open one rather than click a menu. Only that continuation may pass its
+            // own modal gate. engine.execute is deliberately not subject to the UI's menu-click semantics.
+            let open_modal = if app.camera_raw.is_some() { Some("filter.cameraRaw") } else { crate::distort_ui::modal_workspace(app) };
+            let continuation = open_modal == Some(id)
                 && params.as_object().is_some_and(|fields| fields.len() == 1 && fields.get("ui").is_some_and(Value::is_object))
                 && app.ui.dialogs.is_empty()
                 && app.discard.is_none()
                 && !crate::crop_ui::blocks(app, id);
-            if req.method == "ui.menu.invoke" && !camera_raw_continuation && !crate::menus::modal_allows(app, id) {
+            if req.method == "ui.menu.invoke" && !continuation && !crate::menus::modal_allows(app, id) {
                 return err("menu command is unavailable while a modal dialog is open");
             }
             if let Some(authorize) = app.services.automation_command.as_ref()
@@ -472,7 +480,14 @@ fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest)
                 None => err("`job` must be a job id"),
             }
         }
-        "ui.menu.list" => ok(serde_json::to_value(crate::menus::menu_items(app)).unwrap_or_default()),
+        "ui.menu.list" => {
+            // Report the same enablement the native menu shows, so a listed item is invokable.
+            let mut items = crate::menus::menu_items(app);
+            for item in &mut items {
+                item.enabled &= crate::menus::modal_allows(app, &item.id);
+            }
+            ok(serde_json::to_value(items).unwrap_or_default())
+        }
         "ui.inspect" => ok(inspect(app, ctx)),
         "ui.set" => {
             if let Some(field) = p.as_object().and_then(|o| o.keys().find(|k| !UI_SET_FIELDS.contains(&k.as_str()))) {
@@ -580,10 +595,35 @@ fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest)
                 if crop_shield.as_ref().is_some_and(|s| !(0.0..=100.0).contains(&s.opacity)) {
                     return Err("cropShield.opacity must be 0..100".into());
                 }
+                // The Histogram panel: its options, the dragged tonal range ([from, to] levels or
+                // null) and Uncached Refresh.
+                let histogram_panel = merged_object(&app.ui.histogram_panel, p.get("histogramPanel"), "histogramPanel")?;
+                let histogram_range = match p.get("histogramRange") {
+                    Some(v) => Some(
+                        serde_json::from_value::<Option<[u8; 2]>>(v.clone())
+                            .map_err(|_| "histogramRange must be [from, to] levels 0..255, or null".to_string())?,
+                    ),
+                    None => None,
+                };
+                let histogram_refresh = bool_field(p, "histogramRefresh")?;
                 let panels = merged_object(&app.ui.panels, p.get("panels"), "panels")?;
                 let mask_target = bool_field(p, "maskTarget")?;
                 let updates_open = bool_field(p, "updatesOpen")?;
                 let vector_mask_target = bool_field(p, "vectorMaskTarget")?;
+                // Target the active smart object's filter mask (FILE-215-3): it needs smart filters.
+                let filter_mask_target = bool_field(p, "filterMaskTarget")?;
+                if filter_mask_target == Some(true) {
+                    let st = app.session.active().ok_or("filterMaskTarget needs an open document")?;
+                    let l = st.active_layer.and_then(|id| st.doc.layer(id)).ok_or("filterMaskTarget needs an active layer")?;
+                    if !matches!(&l.content, photocraft_doc::LayerContent::Smart(sm) if !sm.smart_filters.is_empty()) {
+                        return Err("filterMaskTarget needs an active smart object with smart filters".into());
+                    }
+                    use photocraft_engine::channel_cmds::ChannelTarget;
+                    let composite = matches!(st.channel_view.target, ChannelTarget::Composite | ChannelTarget::LayerMask | ChannelTarget::VectorMask);
+                    if !composite || st.doc.quick_mask.is_some() {
+                        return Err("filterMaskTarget can't be set while a single channel or Quick Mask is targeted".into());
+                    }
+                }
                 let selection_mode = uint_field(p, "selectionMode")?;
                 let dock_tabs = merged_object(&app.ui.dock_tabs, p.get("dockTabs"), "dockTabs")?;
                 let dock = whole_object(&app.ui.dock, p.get("dock"), "dock")?;
@@ -725,6 +765,16 @@ fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest)
                 if let Some(f) = layer_filter {
                     crate::layer_filter_ui::apply(&mut app.ui, f);
                 }
+                if let Some(h) = histogram_panel {
+                    app.ui.histogram_panel = h;
+                    crate::histogram_panel::persist_options(app);
+                }
+                if let Some(r) = histogram_range {
+                    app.ui.histogram_range = r;
+                }
+                if histogram_refresh == Some(true) {
+                    crate::histogram_panel::uncached_refresh(app);
+                }
                 if let Some(k) = crop_overlay {
                     app.ui.tool_options.crop_overlay = k;
                 }
@@ -744,6 +794,8 @@ fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest)
                     app.ui.panels = v;
                 }
                 if let Some(m) = mask_target {
+                    app.end_filter_mask_view();
+                    app.ui.filter_mask_target = None;
                     app.ui.mask_target = m;
                     app.ui.properties_layer = None;
                     app.ui.vector_mask_target &= !m;
@@ -753,10 +805,16 @@ fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest)
                     app.ui.updates_open = open;
                 }
                 if let Some(m) = vector_mask_target {
+                    app.end_filter_mask_view();
+                    app.ui.filter_mask_target = None;
                     app.ui.vector_mask_target = m;
                     app.ui.mask_target &= !m;
                     app.sync_mask_targets();
                 }
+                if let Some(m) = filter_mask_target {
+                    let layer = if m { app.session.active().and_then(|st| st.active_layer).map(|id| id.0) } else { None };
+                    app.select_filter_mask_target(layer);
+                }
                 // Selection tools' options-bar mode: 0 New, 1 Add, 2 Subtract, 3 Intersect.
                 if let Some(m) = selection_mode {
                     app.ui.selection_mode = m.min(3) as u8;
@@ -1126,6 +1184,17 @@ fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest)
                         }
                         continue;
                     }
+                    // No menu over the agent's own crop frame or Straighten line still being
+                    // dragged, also the first one on the default frame (nothing pending yet).
+                    if app.ui.tool == crate::state::Tool::Crop && (app.crop.drag.is_some() || app.crop.straighten.line.is_some()) {
+                        continue;
+                    }
+                    if app.ui.tool == crate::state::Tool::Crop && crate::crop_ui::pending(app) {
+                        if down {
+                            crate::canvas_tool_menu::open_crop(app, ctx, app.ui.tool, screen_point(app, x, y));
+                        }
+                        continue;
+                    }
                     if crate::canvas_tool_menu::pasteboard_at(app, app.ui.tool, [x, y]) {
                         if down {
                             crate::canvas_tool_menu::open_pasteboard(app, ctx, app.ui.tool, screen_point(app, x, y));
@@ -1278,8 +1347,9 @@ fn dispatch(app: &mut PhotocraftApp, ctx: &egui::Context, req: &ControlRequest)
             if focus.unwrap_or(true) {
                 ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
             }
-            // The capture itself is issued by `PhotocraftApp::issue_screenshots` once open/close
-            // animations (modals, popups) have settled.
+            // The capture itself is admitted by `PhotocraftApp::drain_control` (budget and
+            // geometry) and issued from a later `App::ui` pass once open/close animations
+            // (modals, popups) have settled (see `screenshot.rs`).
             let token = app.ui.alloc_id();
             ctx.request_repaint();
             Outcome::Screenshot { token, path }
@@ -1382,6 +1452,7 @@ pub fn inspect(app: &PhotocraftApp, ctx: &egui::Context) -> Value {
                 "tool": menu.tool,
                 "pasteboard": menu.pasteboard,
                 "guide": menu.guide,
+                "crop": menu.crop.is_some(),
                 "entries": context_entries(app, menu)
             })
         }),
@@ -1389,7 +1460,7 @@ pub fn inspect(app: &PhotocraftApp, ctx: &egui::Context) -> Value {
         "dockTabs": app.ui.dock_tabs,
         "dock": app.ui.dock,
         "docking": app.ui.docking,
-        "dockingHidden": app.ui.docking_hidden,
+        "dockingReturns": app.ui.docking_returns,
         "dockingCollapsed": app.ui.docking_collapsed,
         "view": app.ui.view,
         "views": app.ui.views,
@@ -1410,6 +1481,7 @@ pub fn inspect(app: &PhotocraftApp, ctx: &egui::Context) -> Value {
         "brush": {"size": app.session.tools.brush.size, "hardness": app.session.tools.brush.hardness, "opacity": app.session.tools.brush.opacity},
         "distort": app.distort.describe(),
         "jobs": crate::jobs_ui::inspect(app),
+        "histogram": crate::histogram_panel::inspect(app),
         "cameraRaw": app.camera_raw.as_ref().map(|d| d.describe(&app.ui.camera_raw_scope, &app.ui.camera_raw_preview)),
     })
 }
@@ -1417,8 +1489,15 @@ pub fn inspect(app: &PhotocraftApp, ctx: &egui::Context) -> Value {
 pub fn save_screenshot(app: &mut PhotocraftApp, image: &egui::ColorImage, path: Option<&str>) -> Value {
     let [w, h] = image.size;
     let rgba: Vec<u8> = image.pixels.iter().flat_map(|c| c.to_array()).collect();
+    save_screenshot_rgba(app, w, h, &rgba, path)
+}
+
+/// Encode already-flattened RGBA pixels. The capture lifecycle uses this after dropping the
+/// retained [`egui::ColorImage`], so the encoder's input copy and the retained image do not
+/// overlap in memory (see `PhotocraftApp::finish_captures`).
+pub fn save_screenshot_rgba(app: &mut PhotocraftApp, w: usize, h: usize, rgba: &[u8], path: Option<&str>) -> Value {
     let png = match app.services.encode_png.as_ref() {
-        Some(enc) => enc(w as u32, h as u32, &rgba),
+        Some(enc) => enc(w as u32, h as u32, rgba),
         None => Err("no PNG encoder configured".into()),
     };
     let Some(path) = path else {
@@ -1574,6 +1653,57 @@ mod tests {
         assert!(app.camera_raw.is_none());
     }
 
+    #[test]
+    fn full_window_workspaces_are_modal_for_menu_invocations() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        let ctx = egui::Context::default();
+        app.run("file.new", json!({"width":32,"height":32})).unwrap();
+        app.run("file.new", json!({"width":32,"height":32})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("edit.fill", json!({"color":"#808080"})).unwrap();
+        app.run("select.rect", json!({"x":8,"y":8,"width":8,"height":8})).unwrap();
+        for workspace in ["filter.liquify", "edit.contentAwareFill", "filter.filterGallery", "filter.adaptiveWideAngle"] {
+            let opened = call(&mut app, &ctx, "ui.menu.invoke", json!({"id":workspace}));
+            assert_eq!(opened["ok"], true, "{workspace}: {opened}");
+            assert_eq!(crate::distort_ui::modal_workspace(&app), Some(workspace));
+            let doc = app.session.active().unwrap().doc.id;
+            for request in [
+                json!({"id":"window.document.0"}),
+                json!({"id":"select.all"}),
+                json!({"id":"view.zoomIn"}),
+                json!({"id":"filter.cameraRaw"}),
+                json!({"id":workspace,"params":{"ui":null}}),
+            ] {
+                let blocked = call(&mut app, &ctx, "ui.menu.invoke", request.clone());
+                assert_eq!(blocked["ok"], false, "{workspace}: {request} → {blocked}");
+                assert!(!crate::menus::modal_allows(&app, request["id"].as_str().unwrap()), "{workspace}: native menu greys {request}");
+            }
+            let listed = call(&mut app, &ctx, "ui.menu.list", json!({}));
+            let enabled = |id: &str| listed["result"].as_array().unwrap().iter().find(|it| it["id"] == id).map(|it| it["enabled"].clone());
+            assert_eq!(enabled("select.all"), Some(json!(false)), "{workspace}: ui.menu.list greys what invoke refuses");
+            assert_eq!(crate::distort_ui::modal_workspace(&app), Some(workspace), "{workspace} stays open with its work");
+            assert_eq!(app.session.active().unwrap().doc.id, doc);
+            // An open dialog still takes precedence over the workspace's own requests.
+            app.ui.open_dialog(DialogKind::About, Default::default());
+            let cancel = json!({"id":workspace,"params":{"ui":{"cancel":true}}});
+            assert_eq!(call(&mut app, &ctx, "ui.menu.invoke", cancel.clone())["ok"], false);
+            app.ui.dialogs.clear();
+            let cancelled = call(&mut app, &ctx, "ui.menu.invoke", cancel);
+            assert_eq!(cancelled["ok"], true, "{workspace}: {cancelled}");
+            assert_eq!(crate::distort_ui::modal_workspace(&app), None);
+            assert!(crate::menus::modal_allows(&app, "select.all"), "{workspace}: menus are free again");
+            let listed = call(&mut app, &ctx, "ui.menu.list", json!({}));
+            assert!(
+                listed["result"].as_array().unwrap().iter().any(|it| it["id"] == "select.all" && it["enabled"] == true),
+                "{workspace}: listed as enabled again"
+            );
+        }
+        // engine.execute stays programmatic: it is not a menu click.
+        assert_eq!(call(&mut app, &ctx, "ui.menu.invoke", json!({"id":"filter.liquify"}))["ok"], true);
+        let executed = call(&mut app, &ctx, "engine.execute", json!({"command":"select.all"}));
+        assert_eq!(executed["ok"], true, "{executed}");
+    }
+
     #[test]
     fn layer_style_picker_control_binds_previews_confirms_and_cancels() {
         let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
@@ -1916,6 +2046,78 @@ mod tests {
         assert!(app.ui.canvas_tool_menu.is_none());
     }
 
+    /// #6561: an agent's right-click on a pending crop opens the crop menu, as on the canvas.
+    #[test]
+    fn agent_right_click_on_a_pending_crop_opens_and_runs_the_crop_menu() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        let ctx = egui::Context::default();
+        app.run("file.new", json!({"width": 32, "height": 32})).unwrap();
+        app.sync_views();
+        app.ui.tool = crate::state::Tool::Crop;
+        app.ui.tool_options.crop_shield.classic_mode = true;
+        app.ui.extras.snap = false;
+        crate::crop_ui::ensure_frame(&mut app);
+        tool_event(&mut app, ToolEvent::Down { x: 4.0, y: 4.0, pressure: 1.0 }, egui::Modifiers::NONE);
+        tool_event(&mut app, ToolEvent::Move { x: 16.0, y: 12.0, pressure: 1.0 }, egui::Modifiers::NONE);
+        tool_event(&mut app, ToolEvent::Move { x: 28.0, y: 20.0, pressure: 1.0 }, egui::Modifiers::NONE);
+        tool_event(&mut app, ToolEvent::Up { x: 28.0, y: 20.0 }, egui::Modifiers::NONE);
+        let frame = app.ui.crop_rect.unwrap();
+        let result = call(
+            &mut app,
+            &ctx,
+            "ui.pointer",
+            json!({"tool": "Crop", "button": "secondary", "events": [{"kind":"down","x":16,"y":12},{"kind":"up","x":16,"y":12}]}),
+        );
+        assert_eq!(result["ok"], true);
+        let inspected = call(&mut app, &ctx, "ui.inspect", json!({}));
+        assert_eq!(inspected.pointer("/result/canvasToolMenu/crop"), Some(&json!(true)));
+        let entries = inspected.pointer("/result/canvasToolMenu/entries").and_then(Value::as_array).unwrap();
+        assert!(entries.iter().any(|row| row.get("id") == Some(&json!("crop.commit")) && row.get("enabled") == Some(&json!(true))));
+        assert_eq!(app.ui.crop_rect, Some(frame), "the right-click leaves the frame alone");
+        assert_eq!(call(&mut app, &ctx, "ui.context.choose", json!({"id":"crop.commit"}))["ok"], true);
+        let size = app.session.active().unwrap().doc.size;
+        assert_eq!([f64::from(size.width), f64::from(size.height)], [frame[2] - frame[0], frame[3] - frame[1]], "cropped to the frame");
+    }
+
+    /// An agent's right-click while its own crop frame drag is still down opens no menu over it;
+    /// after the drag's release it does.
+    #[test]
+    fn agent_right_click_during_its_crop_drag_opens_no_menu() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        let ctx = egui::Context::default();
+        app.run("file.new", json!({"width": 32, "height": 32})).unwrap();
+        app.sync_views();
+        app.ui.tool = crate::state::Tool::Crop;
+        app.ui.tool_options.crop_shield.classic_mode = true;
+        app.ui.extras.snap = false;
+        crate::crop_ui::ensure_frame(&mut app);
+        let pointer = |app: &mut PhotocraftApp, button: &str, events: Value| {
+            assert_eq!(call(app, &ctx, "ui.pointer", json!({"tool": "Crop", "button": button, "events": events}))["ok"], true);
+        };
+        // The first drag on the default frame (nothing pending yet): no pasteboard menu outside the image.
+        pointer(&mut app, "left", json!([{"kind":"down","x":4,"y":4},{"kind":"move","x":16,"y":12},{"kind":"move","x":28,"y":20}]));
+        assert!(app.crop.drag.is_some() && !crate::crop_ui::pending(&app), "the first frame is still being drawn");
+        pointer(&mut app, "secondary", json!([{"kind":"down","x":-8,"y":-8},{"kind":"up","x":-8,"y":-8}]));
+        assert!(app.ui.canvas_tool_menu.is_none(), "no pasteboard menu over the first drag");
+        pointer(&mut app, "left", json!([{"kind":"up","x":28,"y":20}]));
+        // A second drag, on the drawn frame, still down.
+        pointer(&mut app, "left", json!([{"kind":"down","x":16,"y":12},{"kind":"move","x":18,"y":14}]));
+        assert!(app.crop.drag.is_some() && crate::crop_ui::pending(&app), "the frame drag is still down");
+        let right_click = json!([{"kind":"down","x":16,"y":12},{"kind":"up","x":16,"y":12}]);
+        pointer(&mut app, "secondary", right_click.clone());
+        assert!(app.ui.canvas_tool_menu.is_none(), "no menu over the drag");
+        pointer(&mut app, "left", json!([{"kind":"up","x":18,"y":14}]));
+        pointer(&mut app, "secondary", right_click.clone());
+        assert!(app.ui.canvas_tool_menu.as_ref().is_some_and(|m| m.crop.is_some()), "after the release it opens");
+        // Nor over a Straighten line still being drawn.
+        app.ui.canvas_tool_menu = None;
+        crate::crop_straighten::toggle(&mut app);
+        pointer(&mut app, "left", json!([{"kind":"down","x":6,"y":6},{"kind":"move","x":20,"y":8}]));
+        assert!(app.crop.straighten.line.is_some(), "the Straighten line is still down");
+        pointer(&mut app, "secondary", right_click);
+        assert!(app.ui.canvas_tool_menu.is_none(), "no menu over the Straighten line");
+    }
+
     #[test]
     fn agent_can_inspect_and_choose_pen_make_selection_from_full_context_menu() {
         let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
@@ -3328,4 +3530,71 @@ mod tests {
         let shift_alt = key_modifiers(&mut app, &ctx, json!({"key":"N","shift":true,"alt":true}));
         assert!(shift_alt.shift && shift_alt.alt && !shift_alt.command && !shift_alt.ctrl, "{shift_alt:?}");
     }
+
+    /// FILE-215-3: `filterMaskTarget` on a layer without a filter mask is refused before anything
+    /// changes, so the layer mask stays targeted.
+    #[test]
+    fn ui_set_filter_mask_target_needs_a_smart_object_with_filters() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        let ctx = egui::Context::default();
+        app.run("file.new", json!({"width": 32, "height": 32})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("edit.fill", json!({"contents": "color", "color": "#ff0000"})).unwrap();
+        app.run("layer.layerMask.revealAll", json!({})).unwrap();
+        assert_eq!(call(&mut app, &ctx, "ui.set", json!({"maskTarget": true}))["ok"], true);
+        let bad = call(&mut app, &ctx, "ui.set", json!({"filterMaskTarget": true}));
+        assert_eq!(bad["ok"], false, "{bad}");
+        assert!(app.ui.mask_target, "the layer mask stays targeted");
+        assert_eq!(app.ui.filter_mask_target, None);
+        // A smart object with smart filters takes it.
+        app.run("layer.smartObjects.convertToSmartObject", json!({})).unwrap();
+        app.run("filter.blur.gaussianBlur", json!({"radius": 2})).unwrap();
+        // Not while a single colour channel is targeted: nothing would end up targeted.
+        app.session.active_mut().unwrap().channel_view.target = photocraft_engine::channel_cmds::ChannelTarget::Color(0);
+        assert_eq!(call(&mut app, &ctx, "ui.set", json!({"filterMaskTarget": true}))["ok"], false);
+        app.session.active_mut().unwrap().channel_view.target = photocraft_engine::channel_cmds::ChannelTarget::Composite;
+        assert_eq!(call(&mut app, &ctx, "ui.set", json!({"filterMaskTarget": true}))["ok"], true);
+        assert!(app.filter_mask_targeted());
+        // Untargeting it ends its view, which would otherwise keep it targeted.
+        app.run("paint.stroke", json!({"points": [[4, 4]], "size": 4, "hardness": 1, "color": "#000000", "target": "filterMask"})).unwrap();
+        app.run("view.layerMask", json!({"mode": "gray", "mask": "filter"})).unwrap();
+        assert_eq!(call(&mut app, &ctx, "ui.set", json!({"filterMaskTarget": false}))["ok"], true);
+        assert!(!app.filter_mask_targeted());
+        assert!(photocraft_engine::mask_view_cmds::current(app.session.active().unwrap()).is_none());
+        // Targeting the pixels untargets it too.
+        assert_eq!(call(&mut app, &ctx, "ui.set", json!({"filterMaskTarget": true}))["ok"], true);
+        assert_eq!(call(&mut app, &ctx, "ui.set", json!({"maskTarget": false}))["ok"], true);
+        assert!(!app.filter_mask_targeted());
+        assert_eq!(crate::canvas::paint_target(&app), json!("pixels"));
+    }
+
+    /// FILE-215-3: with the filter mask shown (⌥-click its thumbnail), targeting the layer mask
+    /// ends that view, and the brush paints the layer mask.
+    #[test]
+    fn ui_set_mask_target_ends_a_filter_mask_view() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        let ctx = egui::Context::default();
+        app.run("file.new", json!({"width": 32, "height": 32})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("edit.fill", json!({"contents": "color", "color": "#ff0000"})).unwrap();
+        app.run("layer.smartObjects.convertToSmartObject", json!({})).unwrap();
+        app.run("filter.blur.gaussianBlur", json!({"radius": 2})).unwrap();
+        app.run("layer.layerMask.revealAll", json!({})).unwrap();
+        app.run("paint.stroke", json!({"points": [[4, 4]], "size": 4, "hardness": 1, "color": "#000000", "target": "filterMask"})).unwrap();
+        app.run("view.layerMask", json!({"mode": "gray", "mask": "filter"})).unwrap();
+        app.sync_mask_targets();
+        assert!(app.filter_mask_targeted());
+        assert_eq!(call(&mut app, &ctx, "ui.set", json!({"maskTarget": true}))["ok"], true);
+        assert!(photocraft_engine::mask_view_cmds::current(app.session.active().unwrap()).is_none(), "the filter mask view ends");
+        assert!(app.layer_mask_targeted());
+        assert!(!app.filter_mask_targeted());
+        assert_eq!(crate::canvas::paint_target(&app), json!("mask"));
+        let target = crate::canvas::paint_target(&app);
+        app.run("paint.stroke", json!({"points": [[20, 20]], "size": 4, "hardness": 1, "color": "#000000", "target": target})).unwrap();
+        let st = app.session.active().unwrap();
+        let l = st.doc.layer(st.active_layer.unwrap()).unwrap();
+        assert_eq!(l.mask.as_ref().unwrap().value(20, 20), 0.0, "the stroke went into the layer mask");
+        let photocraft_doc::LayerContent::Smart(sm) = &l.content else { panic!("smart object") };
+        assert_eq!(sm.filter_mask.as_ref().unwrap().value(20, 20), 1.0, "not into the filter mask");
+    }
 }
diff --git a/crates/ui-egui/src/credits.rs b/crates/ui-egui/src/credits.rs
index b31aa40578..eef2612379 100644
--- a/crates/ui-egui/src/credits.rs
+++ b/crates/ui-egui/src/credits.rs
@@ -254,7 +254,7 @@ pub fn contributors_ui(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
 
 /// [`contributors_ui`] over a given list (tests pass their own).
 fn contributors_in(app: &mut PhotocraftApp, ui: &mut egui::Ui, contributors: &[Contributor], total_commits: u64) {
-    let id = egui::Id::new("credits_view");
+    let id = egui::Id::unique("credits_view");
     let mut v = ui.data_mut(|d| d.get_temp::<View>(id)).unwrap_or_default();
     ui.horizontal_wrapped(|ui| {
         ui.label(tl!("Show"));
@@ -276,6 +276,7 @@ fn contributors_in(app: &mut PhotocraftApp, ui: &mut egui::Ui, contributors: &[C
             }
         });
         press.after(&sort.response);
+        let _ = sort.response.accessible_name(tl!("Sort"));
         if ui.button(if v.ascending { "▲" } else { "▼" }).on_hover_text(tl!("Reverse the order")).clicked() {
             v.ascending = !v.ascending;
         }
@@ -453,7 +454,7 @@ fn cell(ui: &mut egui::Ui, numeric: bool, text: &str) {
 fn header_cell(ui: &mut egui::Ui, t: &crate::theme::Tokens, label: &str, numeric: bool, sort: Option<Option<bool>>) -> egui::Response {
     let rect = ui.max_rect();
     let resp = ui.allocate_rect(rect, if sort.is_some() { egui::Sense::click() } else { egui::Sense::hover() });
-    let kind = if sort.is_some() { egui::WidgetType::Button } else { egui::WidgetType::Label };
+    let kind = if sort.is_some() { egui::Role::Button } else { egui::Role::Label };
     resp.widget_info(|| egui::WidgetInfo::labeled(kind, true, label));
     let resp = if sort.is_some() { resp.on_hover_cursor(egui::CursorIcon::PointingHand) } else { resp };
     let current = sort.flatten();
diff --git a/crates/ui-egui/src/credits_tests.rs b/crates/ui-egui/src/credits_tests.rs
index 4ac3f3e41f..8201c1960b 100644
--- a/crates/ui-egui/src/credits_tests.rs
+++ b/crates/ui-egui/src/credits_tests.rs
@@ -40,7 +40,7 @@ fn harness(list: Vec<Contributor>, table: bool) -> Harness<'static> {
         if !ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("semibold".into()))) {
             return;
         }
-        let id = egui::Id::new("credits_view");
+        let id = egui::Id::unique("credits_view");
         if ui.data(|d| d.get_temp::<View>(id)).is_none() {
             ui.data_mut(|d| d.insert_temp(id, View { table, ..View::default() }));
         }
@@ -71,7 +71,7 @@ fn text_rect(h: &Harness<'_>, text: &str) -> Option<Rect> {
 }
 
 fn view(h: &Harness<'_>) -> View {
-    h.ctx.data(|d| d.get_temp::<View>(egui::Id::new("credits_view"))).unwrap_or_default()
+    h.ctx.data(|d| d.get_temp::<View>(egui::Id::unique("credits_view"))).unwrap_or_default()
 }
 
 #[test]
@@ -83,6 +83,7 @@ fn the_table_header_stays_put_while_the_rows_scroll() {
     h.event(egui::Event::PointerMoved(over));
     for _ in 0..6 {
         h.event(egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
             unit: egui::MouseWheelUnit::Point,
             delta: vec2(0.0, -200.0),
             modifiers: egui::Modifiers::NONE,
@@ -210,7 +211,7 @@ fn about_window(tab: &str, table: bool) -> (f32, f32, f32) {
     let mut fields = serde_json::Map::new();
     fields.insert("tab".into(), serde_json::json!(tab));
     h.state_mut().ui.open_dialog(crate::state::DialogKind::About, fields);
-    h.ctx.data_mut(|d| d.insert_temp(egui::Id::new("credits_view"), View { table, ..View::default() }));
+    h.ctx.data_mut(|d| d.insert_temp(egui::Id::unique("credits_view"), View { table, ..View::default() }));
     h.run_steps(6);
     let ok = h.query_all_by_role(Role::Button).find(|n| n.accesskit_node().label().as_deref() == Some("OK")).map(|n| n.rect()).expect("the OK button");
     // The dialog's contents: everything between its title and the OK button.
diff --git a/crates/ui-egui/src/crop_overlay.rs b/crates/ui-egui/src/crop_overlay.rs
index b0be59f2b1..c93f5e12e1 100644
--- a/crates/ui-egui/src/crop_overlay.rs
+++ b/crates/ui-egui/src/crop_overlay.rs
@@ -249,6 +249,14 @@ pub fn cycle(o: &mut ToolOptions) {
     o.crop_overlay_orientation = 0;
 }
 
+/// Picks overlay `k`; another overlay starts at its first orientation.
+pub fn set_overlay(o: &mut ToolOptions, k: CropOverlay) {
+    if o.crop_overlay != k {
+        o.crop_overlay_orientation = 0;
+    }
+    o.crop_overlay = k;
+}
+
 /// ⇧O: the overlay's next orientation (nothing for a symmetric one).
 pub fn cycle_orientation(o: &mut ToolOptions) {
     let n = o.crop_overlay.orientations().max(1);
@@ -288,10 +296,7 @@ pub fn options_button(o: &mut ToolOptions, ui: &mut egui::Ui) {
         };
         for k in CropOverlay::ALL {
             if item(ui, o.crop_overlay == k, tl!(k.label()), None) {
-                if o.crop_overlay != k {
-                    o.crop_overlay_orientation = 0;
-                }
-                o.crop_overlay = k;
+                set_overlay(o, k);
                 ui.close();
             }
         }
diff --git a/crates/ui-egui/src/crop_presets.rs b/crates/ui-egui/src/crop_presets.rs
index 9b919c3b5e..992fff05a7 100644
--- a/crates/ui-egui/src/crop_presets.rs
+++ b/crates/ui-egui/src/crop_presets.rs
@@ -34,9 +34,9 @@ pub const MAX_NAME: usize = 255;
 /// The `ToolOptions` fields a crop preset saves.
 const KEYS: [&str; 5] = ["crop_ratio", "crop_width", "crop_height", "crop_resolution", "crop_resolution_unit"];
 
-/// One entry of the preset dropdown.
+/// One entry of the preset dropdown (and of the Crop tool's canvas menu).
 #[derive(Clone, Debug, PartialEq)]
-enum Choice {
+pub(crate) enum Choice {
     /// A built-in key (`crop_ratio` value, size preset or Front Image), see [`crop_size::chosen`].
     Builtin(String),
     /// A saved crop preset, by name.
@@ -139,57 +139,72 @@ pub fn dropdown(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let users = user_presets(app);
     let o = &app.ui.tool_options;
     let label = button_label(o, &builtin, &users);
-    let current_user = users.iter().rev().find(|(_, f)| matches(o, f)).map(|(n, _)| n.clone());
+    let current_user = current_user(app);
     let can_new = savable(o).is_some();
     let mut chosen: Option<Choice> = None;
     let parent_layer = ui.layer_id();
-    egui::ComboBox::from_id_salt("crop-ratio").selected_text(label).width(140.0).height(420.0).icon(crate::widgets::chevron_icon).show_ui(ui, |ui| {
-        crate::press_menu::above_parent_ui(parent_layer, ui);
-        let (before, after): (Vec<_>, Vec<_>) = builtin.iter().partition(|(k, _)| k != crop_size::FRONT);
-        for (k, l) in &before {
-            if ui.selectable_label(current_user.is_none() && *k == o.crop_ratio, tl!(l)).clicked() {
-                chosen = Some(Choice::Builtin(k.clone()));
+    let combo =
+        egui::ComboBox::from_id_salt("crop-ratio").selected_text(label).width(140.0).height(420.0).icon(crate::widgets::chevron_icon).show_ui(ui, |ui| {
+            crate::press_menu::above_parent_ui(parent_layer, ui);
+            let (before, after): (Vec<_>, Vec<_>) = builtin.iter().partition(|(k, _)| k != crop_size::FRONT);
+            for (k, l) in &before {
+                if ui.selectable_label(current_user.is_none() && *k == o.crop_ratio, tl!(l)).clicked() {
+                    chosen = Some(Choice::Builtin(k.clone()));
+                }
             }
-        }
-        for (name, _) in &users {
-            if ui.selectable_label(current_user.as_deref() == Some(name), name.as_str()).clicked() {
-                chosen = Some(Choice::User(name.clone()));
+            for (name, _) in &users {
+                if ui.selectable_label(current_user.as_deref() == Some(name), name.as_str()).clicked() {
+                    chosen = Some(Choice::User(name.clone()));
+                }
             }
-        }
-        for (k, l) in &after {
-            if ui.selectable_label(false, tl!(l)).clicked() {
-                chosen = Some(Choice::Builtin(k.clone()));
+            for (k, l) in &after {
+                if ui.selectable_label(false, tl!(l)).clicked() {
+                    chosen = Some(Choice::Builtin(k.clone()));
+                }
             }
-        }
-        ui.separator();
-        if ui.add_enabled(can_new, egui::Button::selectable(false, tl!("New Crop Preset…"))).clicked() {
-            chosen = Some(Choice::New);
-        }
-        if ui.add_enabled(!users.is_empty(), egui::Button::selectable(false, tl!("Delete Crop Preset…"))).clicked() {
-            chosen = Some(Choice::Delete);
-        }
-    });
-    match chosen {
-        Some(Choice::Builtin(k)) => {
+            ui.separator();
+            if ui.add_enabled(can_new, egui::Button::selectable(false, tl!("New Crop Preset…"))).clicked() {
+                chosen = Some(Choice::New);
+            }
+            if ui.add_enabled(!users.is_empty(), egui::Button::selectable(false, tl!("Delete Crop Preset…"))).clicked() {
+                chosen = Some(Choice::Delete);
+            }
+        });
+    let _ = combo.response.accessible_name(tl!("Aspect Ratio"));
+    if let Some(c) = chosen {
+        apply_choice(app, c);
+    }
+}
+
+/// What picking a dropdown entry does; the Crop tool's canvas menu picks through it too.
+pub(crate) fn apply_choice(app: &mut PhotocraftApp, choice: Choice) {
+    match choice {
+        Choice::Builtin(k) => {
             app.ui.tool_options.crop_ratio = k;
             // A size preset or Front Image fills W x H x Resolution (#2443).
             crop_size::chosen(app);
             sync_custom_ratio_fields(app);
         }
-        Some(Choice::User(name)) => {
+        Choice::User(name) => {
             select(app, &name);
             sync_custom_ratio_fields(app);
         }
-        Some(Choice::New) => {
+        Choice::New => {
             open_new(app);
         }
-        Some(Choice::Delete) => {
+        Choice::Delete => {
             open_delete(app);
         }
-        None => {}
     }
 }
 
+/// The saved crop preset whose values the fields hold (the latest saved one first), as the
+/// dropdown shows it.
+pub(crate) fn current_user(app: &PhotocraftApp) -> Option<String> {
+    let o = &app.ui.tool_options;
+    user_presets(app).into_iter().rev().find(|(_, f)| matches(o, f)).map(|(n, _)| n)
+}
+
 /// A newly chosen ratio fills the editable custom W/H fields (free Ratio clears them, #3188).
 fn sync_custom_ratio_fields(app: &mut PhotocraftApp) {
     if app.ui.tool_options.crop_ratio != crop_size::WHR {
@@ -265,10 +280,10 @@ pub fn body(app: &PhotocraftApp, ui: &mut egui::Ui, fields: &mut Map<String, Val
 
 fn new_body(ui: &mut egui::Ui, fields: &mut Map<String, Value>) {
     let mut name = fields.get("name").and_then(Value::as_str).unwrap_or_default().to_string();
-    let id = ui.id().with("crop-preset-name");
+    let id = ui.scope_id().with("crop-preset-name");
     ui.horizontal(|ui| {
-        ui.label(tl!("Name:"));
-        let r = ui.add(egui::TextEdit::singleline(&mut name).id(id).char_limit(MAX_NAME).desired_width(260.0));
+        let name_label = ui.label(tl!("Name:"));
+        let r = ui.add(egui::TextEdit::singleline(&mut name).id(id).char_limit(MAX_NAME).desired_width(260.0)).labelled_by(name_label.id);
         // Photoshop focuses the name with all of it selected, so typing replaces it.
         let once = id.with("focused");
         if !ui.ctx().data(|d| d.get_temp::<bool>(once).unwrap_or(false)) {
diff --git a/crates/ui-egui/src/crop_shield.rs b/crates/ui-egui/src/crop_shield.rs
index aef70e5afb..4ffaf19062 100644
--- a/crates/ui-egui/src/crop_shield.rs
+++ b/crates/ui-egui/src/crop_shield.rs
@@ -104,9 +104,10 @@ pub fn fill(s: &CropShield, canvas: Color32, editing: bool) -> Option<Color32> {
     (a > 0).then(|| Color32::from_rgba_unmultiplied(r, g, b, a))
 }
 
-/// The pasteboard colour the shield matches: Preferences › Interface's, else the theme's canvas.
+/// The pasteboard colour the shield matches: Preferences › Interface's, else black in Full Screen
+/// Mode (the backdrop there) and the theme's canvas otherwise.
 pub fn canvas_color(app: &PhotocraftApp, ctx: &egui::Context) -> Color32 {
-    crate::prefs_ui::pasteboard_color(app).unwrap_or_else(|| crate::theme::Tokens::get(ctx).canvas)
+    crate::prefs_ui::pasteboard_color(app).unwrap_or_else(|| if app.ui.view.hides_chrome() { Color32::BLACK } else { crate::theme::Tokens::get(ctx).canvas })
 }
 
 /// The shield over the pending crop box now ([`fill`]).
@@ -307,6 +308,32 @@ mod tests {
         app
     }
 
+    #[test]
+    fn match_canvas_is_the_black_full_screen_pasteboard() {
+        let mut app = crop_app();
+        let ctx = egui::Context::default();
+        let theme_canvas = crate::theme::Tokens::get(&ctx).canvas;
+        assert_ne!(theme_canvas, Color32::BLACK);
+        app.ui.tool_options.crop_shield.show_cropped_area = false;
+        assert!(hides_outside(&app));
+        // Full Screen Mode shows the document on black (lib.rs backdrop); the opaque shield
+        // over the cropped area matches it.
+        for (mode, want) in [
+            ("view.screenMode.fullScreen", Color32::BLACK),
+            ("view.screenMode.fullScreenWithMenuBar", theme_canvas),
+            ("view.screenMode.standard", theme_canvas),
+        ] {
+            crate::menus::invoke(&mut app, &ctx, mode, serde_json::json!({})).unwrap();
+            assert_eq!(current(&app, &ctx), Some(want), "{mode}");
+        }
+        // A chosen pasteboard colour is painted in every screen mode, and the shield follows it.
+        app.run("prefs.set", serde_json::json!({"values": {"interface.canvasColor": "custom", "interface.canvasCustomColor": "#123456"}})).unwrap();
+        for mode in ["view.screenMode.fullScreen", "view.screenMode.standard"] {
+            crate::menus::invoke(&mut app, &ctx, mode, serde_json::json!({})).unwrap();
+            assert_eq!(current(&app, &ctx), Some(Color32::from_rgb(0x12, 0x34, 0x56)), "{mode}");
+        }
+    }
+
     #[test]
     fn h_toggles_show_cropped_area_while_the_crop_tool_shows_a_box() {
         let mut app = crop_app();
diff --git a/crates/ui-egui/src/crop_size.rs b/crates/ui-egui/src/crop_size.rs
index 71fc57f495..ee1b939e15 100644
--- a/crates/ui-egui/src/crop_size.rs
+++ b/crates/ui-egui/src/crop_size.rs
@@ -226,6 +226,15 @@ pub fn clear(o: &mut ToolOptions) {
     o.crop_resolution.clear();
 }
 
+/// The options bar's Clear: W, H and the resolution in W x H x Resolution mode, else the ratio.
+pub fn clear_ratio(o: &mut ToolOptions) {
+    if o.crop_ratio == WHR {
+        clear(o);
+    } else {
+        o.crop_ratio.clear();
+    }
+}
+
 /// Swaps W and H for the Crop tool's X. False outside W x H x Resolution mode.
 pub fn swap(o: &mut ToolOptions) -> bool {
     if o.crop_ratio != WHR {
@@ -277,7 +286,7 @@ pub fn keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
 /// normalised into `value` (by `normalize(typed, previous)`) when it loses it. Returns true then.
 fn text_field(ui: &mut egui::Ui, id: &str, value: &mut String, hint: &str, width: f32, normalize: fn(&str, &str) -> String) -> bool {
     let t = Tokens::get(ui.ctx());
-    let id = ui.id().with(id);
+    let id = ui.scope_id().with(id);
     let mut buf = ui.data(|d| d.get_temp::<String>(id)).unwrap_or_else(|| value.clone());
     let (rect, _) = ui.allocate_exact_size(vec2(width, 24.0), egui::Sense::hover());
     crate::widgets::surface(ui, rect, t.field, false);
@@ -285,7 +294,10 @@ fn text_field(ui: &mut egui::Ui, id: &str, value: &mut String, hint: &str, width
         ui.painter().rect_stroke(rect, t.radius_sm, Stroke::new(1.0, t.field_border), StrokeKind::Inside);
     }
     let inner = rect.shrink2(vec2(4.0, 2.0));
-    let r = ui.put(inner, egui::TextEdit::singleline(&mut buf).id(id).char_limit(32).hint_text(hint).frame(egui::Frame::NONE).font(crate::theme::mono(12.0)));
+    let r = ui.put(
+        inner,
+        egui::TextEdit::singleline(&mut buf).id(id).char_limit(32).hint_text(hint.to_owned()).frame(egui::Frame::NONE).font(crate::theme::mono(12.0)),
+    );
     if r.has_focus() {
         ui.data_mut(|d| d.insert_temp(id, buf));
         return false;
@@ -310,7 +322,7 @@ pub fn fields(o: &mut ToolOptions, ui: &mut egui::Ui) {
     text_field(ui, "crop-resolution", &mut o.crop_resolution, tl!("Resolution"), 64.0, normalize_resolution);
     let units = [(PX_PER_IN.to_string(), "px/in"), (PX_PER_CM.to_string(), "px/cm")];
     let before = o.crop_resolution_unit.clone();
-    if crate::widgets::dropdown(ui, "crop-resolution-unit", &mut o.crop_resolution_unit, &units, 64.0) && before != o.crop_resolution_unit {
+    if crate::widgets::dropdown(ui, "crop-resolution-unit", tl!("Resolution"), &mut o.crop_resolution_unit, &units, 64.0) && before != o.crop_resolution_unit {
         // The same resolution in the other unit, as in Photoshop.
         if let Some(v) = crate::widgets::parse_num(&o.crop_resolution.trim().replace(',', ".")).filter(|v| v.is_finite() && *v > 0.0) {
             let v = if o.crop_resolution_unit == PX_PER_CM { v / 2.54 } else { v * 2.54 };
diff --git a/crates/ui-egui/src/crop_ui.rs b/crates/ui-egui/src/crop_ui.rs
index 73e9ce5642..d922aa3290 100644
--- a/crates/ui-egui/src/crop_ui.rs
+++ b/crates/ui-egui/src/crop_ui.rs
@@ -1006,7 +1006,7 @@ pub fn draw_turn_cursor(ctx: &egui::Context, p: egui::Pos2, toward: egui::Vec2)
     }
     let u = toward / len;
     let tokens = crate::theme::Tokens::get(ctx);
-    let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("crop-turn-cursor")));
+    let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("crop-turn-cursor")));
     const R: f32 = 12.0;
     const HALF: f32 = 0.75;
     let c = p + u * R;
diff --git a/crates/ui-egui/src/dds_options_ui.rs b/crates/ui-egui/src/dds_options_ui.rs
index 3216b51a30..6864e098c6 100644
--- a/crates/ui-egui/src/dds_options_ui.rs
+++ b/crates/ui-egui/src/dds_options_ui.rs
@@ -69,7 +69,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let Some(p) = &mut app.dds_options else { return };
     let (mut ok, mut cancel) = (false, false);
     let mut options = p.options;
-    let modal = egui::Modal::new(egui::Id::new("dds-options")).show(ctx, |ui| {
+    let modal = egui::Modal::new(egui::Id::unique("dds-options")).show(ctx, |ui| {
         ui.set_max_width(340.0);
         ui.label(egui::RichText::new(tl!("DDS Options")).font(crate::theme::semibold(15.0)));
         ui.add_space(4.0);
diff --git a/crates/ui-egui/src/dialog_blend_ui.rs b/crates/ui-egui/src/dialog_blend_ui.rs
index 0eb8207eb5..8ff086cebe 100644
--- a/crates/ui-egui/src/dialog_blend_ui.rs
+++ b/crates/ui-egui/src/dialog_blend_ui.rs
@@ -27,14 +27,14 @@ pub fn body(ui: &mut egui::Ui, fields: &mut Map<String, Value>, prefix: &str) {
         label(ui, tl!("Mode:"));
         let mut mode = fields.get("mode").and_then(Value::as_str).unwrap_or("normal").to_string();
         let opts: Vec<(String, &str)> = photocraft_color::BlendMode::LAYER_MODES.iter().map(|m| (mode_key(*m), m.label())).collect();
-        if crate::widgets::dropdown(ui, &format!("{prefix}-mode"), &mut mode, &opts, 170.0) {
+        if crate::widgets::dropdown(ui, &format!("{prefix}-mode"), tl!("Blend Mode"), &mut mode, &opts, 170.0) {
             fields.insert("mode".into(), json!(mode));
         }
     });
     ui.horizontal(|ui| {
         label(ui, tl!("Opacity:"));
         let mut opacity = fields.get("opacity").and_then(Value::as_f64).unwrap_or(100.0) as f32;
-        if crate::widgets::value_field(ui, &mut opacity, 0.0..=100.0, "%", 70.0).changed() {
+        if crate::widgets::value_field(ui, &mut opacity, 0.0..=100.0, "%", 70.0).accessible_name(tl!("Opacity:")).changed() {
             fields.insert("opacity".into(), json!(opacity.round()));
         }
     });
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index bc658783cd..6dfa4f70d1 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -11,11 +11,18 @@ use crate::widgets::{ButtonRole, DialogButton, dialog_buttons};
 /// [`show`] takes it out again and opens the matching file or folder dialog.
 pub(crate) const BROWSE_FIELD: &str = "__browse";
 
-/// Browse… beside a path field of dialog `id`: a folder picker for `dir` fields, a `.wasm` picker
-/// for Install Plug-in…'s `path`. The answer fills the field.
+/// A text field that names a folder: an export's `dir`, and the source (`input`) and destination
+/// (`output`) folders of Image Processor, Batch, Lens Correction, Contact Sheet and Create
+/// Droplet, which Photoshop picks with Select Folder… / Choose… (#9357).
+pub(crate) fn is_folder_field(key: &str) -> bool {
+    matches!(key, "dir" | "input" | "output")
+}
+
+/// Browse… beside a path field of dialog `id`: a folder picker for folder fields
+/// ([`is_folder_field`]), a `.wasm` picker for Install Plug-in…'s `path`. The answer fills the field.
 fn browse_field(app: &mut PhotocraftApp, id: u64, fields: &serde_json::Map<String, Value>, key: &str) {
     let key = key.to_string();
-    let r = if key == "dir" {
+    let r = if is_folder_field(&key) {
         app.ask_folder(move |app, path| fill_field(app, id, &key, path))
     } else if fields.get("__command").and_then(Value::as_str) == Some("plugin.install") {
         let initial_dir = crate::file_dialog::last_used_dir(&app.ui.recent_files);
@@ -42,7 +49,7 @@ fn fill_field(app: &mut PhotocraftApp, id: u64, key: &str, path: String) -> Resu
 const RECTS: &str = "pc-dialog-rects";
 
 fn rects(ctx: &egui::Context) -> Vec<egui::Rect> {
-    ctx.data(|m| m.get_temp(egui::Id::new(RECTS))).unwrap_or_default()
+    ctx.data(|m| m.get_temp(egui::Id::unique(RECTS))).unwrap_or_default()
 }
 
 /// The window drag target must not cover a dialog which has been moved into the title bar.
@@ -55,7 +62,7 @@ pub(crate) fn titlebar_drag_area_is_clear(ctx: &egui::Context, area: egui::Rect)
 /// check against the dialog rects alone would take the drag for a canvas drag. Remembered from the
 /// frame of the press, which is the only frame that carries the press event.
 fn press_began_on_dialog(ctx: &egui::Context, rects: &[egui::Rect]) -> bool {
-    let key = egui::Id::new("pc-dialog-press-grabbed");
+    let key = egui::Id::unique("pc-dialog-press-grabbed");
     let pressed = ctx.input(|i| {
         i.events.iter().rev().find_map(|e| match e {
             egui::Event::PointerButton { pos, pressed: true, .. } => Some(*pos),
@@ -99,7 +106,7 @@ pub fn pan_delta(ctx: &egui::Context, canvas: egui::Rect, hand: bool) -> Option<
 /// response would report them if it weren't inert: for the held Zoom (⌘Space / ⌥Space, #6460).
 /// A drag counts from egui's drag threshold, like `drag_started`.
 pub fn free_buttons(ctx: &egui::Context, canvas: egui::Rect) -> crate::paint_mouse::Buttons {
-    let id = egui::Id::new("pc-dialog-free-drag");
+    let id = egui::Id::unique("pc-dialog-free-drag");
     let was = ctx.data(|d| d.get_temp::<bool>(id)).unwrap_or(false);
     let rects = rects(ctx);
     let open_popup = egui::Popup::is_any_open(ctx);
@@ -163,15 +170,15 @@ fn first_field_focused<R>(ui: &mut egui::Ui, id: egui::Id, body: impl FnOnce(&mu
 /// its own), per kind for the rest.
 fn place_id(d: &Dialog) -> egui::Id {
     match d.fields.get("__command").and_then(Value::as_str) {
-        Some(cmd) => egui::Id::new(("dialog-place", cmd)),
-        None => egui::Id::new(("dialog-place", format!("{:?}", d.kind))),
+        Some(cmd) => egui::Id::unique(("dialog-place", cmd)),
+        None => egui::Id::unique(("dialog-place", format!("{:?}", d.kind))),
     }
 }
 
 /// Whether another dialog is drawn above `live` (egui's layer order, back to front).
 fn older_dialog_above(ctx: &egui::Context, live: egui::LayerId, dialogs: &[Dialog]) -> bool {
     let others: Vec<egui::LayerId> =
-        dialogs.iter().map(|d| egui::LayerId::new(egui::Order::Foreground, egui::Id::new(("dialog", d.id)))).filter(|l| *l != live).collect();
+        dialogs.iter().map(|d| egui::LayerId::new(egui::Order::Foreground, egui::Id::unique(("dialog", d.id)))).filter(|l| *l != live).collect();
     ctx.memory(|m| m.layer_ids().skip_while(|l| *l != live).skip(1).any(|l| others.contains(&l)))
 }
 
@@ -279,7 +286,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         let mut outcome: Option<bool> = None; // Some(true)=OK, Some(false)=Cancel
         let mut apply_requested = false;
         let title = display_title(&d);
-        let id = egui::Id::new(("dialog", d.id));
+        let id = egui::Id::unique(("dialog", d.id));
         // Opens where the same dialog was last left (centred the first time), then its top-left
         // stays put (offset from the window's top-left, moved by dragging the title bar; view
         // state only, so egui memory): a dialog whose body grows, like Layer Style switching
@@ -434,6 +441,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 DialogKind::Command if crate::fill_ui::owns(&fields) => crate::fill_ui::body(app, ui, &mut fields),
                 DialogKind::Command if crate::pattern_fill_ui::owns(&fields) => crate::pattern_fill_ui::body(app, ui, &mut fields),
                 DialogKind::Command if crate::stroke_ui::owns(&fields) => crate::stroke_ui::body(ui, &mut fields),
+                DialogKind::Command if crate::snapshot_dialog::owns(&fields) => crate::snapshot_dialog::body(ui, &mut fields),
                 DialogKind::Command if crate::channel_options_ui::owns(&fields) => crate::channel_options_ui::body(ui, &mut fields),
                 DialogKind::Command if crate::channel_options_ui::owns_new_spot(&fields) => crate::channel_options_ui::new_spot_body(ui, &mut fields),
                 DialogKind::Command if crate::shape_dialog::owns(&fields) => crate::shape_dialog::body(app, ui, &mut fields),
@@ -674,7 +682,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
             }
         }
     }
-    ctx.data_mut(|m| m.insert_temp(egui::Id::new(RECTS), shown));
+    ctx.data_mut(|m| m.insert_temp(egui::Id::unique(RECTS), shown));
 }
 
 /// The About window's tabs, as stored in its `tab` field.
@@ -836,6 +844,7 @@ pub fn confirm(app: &mut PhotocraftApp, id: u64) -> Result<Value, String> {
         DialogKind::Command if crate::fill_ui::owns(&d.fields) => crate::fill_ui::confirm(app, &d.fields),
         DialogKind::Command if crate::pattern_fill_ui::owns(&d.fields) => crate::pattern_fill_ui::confirm(app, &d.fields),
         DialogKind::Command if crate::stroke_ui::owns(&d.fields) => crate::stroke_ui::confirm(app, &d.fields),
+        DialogKind::Command if crate::snapshot_dialog::owns(&d.fields) => crate::snapshot_dialog::confirm(app, &d.fields),
         DialogKind::Command if crate::channel_options_ui::owns(&d.fields) => crate::channel_options_ui::confirm(app, &d.fields),
         DialogKind::Command if crate::channel_options_ui::owns_new_spot(&d.fields) => crate::channel_options_ui::confirm_new_spot(app, &d.fields),
         DialogKind::Command if crate::shape_dialog::owns(&d.fields) => crate::shape_dialog::confirm(app, &d.fields),
@@ -1115,7 +1124,7 @@ mod tests {
         let at_press = egui::Rect::from_min_max(egui::pos2(100.0, 100.0), egui::pos2(300.0, 200.0));
         let moved = egui::Rect::from_min_max(egui::pos2(550.0, 480.0), egui::pos2(750.0, 580.0));
         let run = |rect: egui::Rect, events: Vec<egui::Event>| {
-            ctx.data_mut(|m| m.insert_temp(egui::Id::new(RECTS), vec![rect]));
+            ctx.data_mut(|m| m.insert_temp(egui::Id::unique(RECTS), vec![rect]));
             ctx.begin_pass(egui::RawInput { events, ..Default::default() });
             let out = (pan_delta(&ctx, canvas, true), free_press(&ctx, canvas));
             ctx.end_pass().textures_delta.clear();
@@ -1271,7 +1280,8 @@ mod tests {
         assert_eq!(angle(&h), Some(0.0));
         // The dial's field is the dialog's first number, so it opens focused (#1757).
         let first = h.get_all_by_role(egui::accesskit::Role::SpinButton).next().unwrap();
-        assert!(first.is_focused() && first.rect().center().y < h.get_by_label("Distance").rect().center().y, "the Angle field has focus");
+        let distance = h.query_all_by_label("Distance").next().expect("the Distance field").rect();
+        assert!(first.is_focused() && first.rect().center().y < distance.center().y, "the Angle field has focus");
         // Click above the centre: straight up is 90°.
         let up = centre(&h) + egui::vec2(0.0, -15.0);
         h.event(egui::Event::PointerMoved(up));
@@ -1394,10 +1404,12 @@ mod tests {
         let ctx = h.ctx.clone();
         let d = crate::menus::invoke(h.state_mut(), &ctx, "file.automate.fitImage", json!({})).unwrap()["dialog"].as_u64().unwrap();
         h.run_steps(4);
-        let window = h.ctx.memory(|m| m.area_rect(egui::Id::new(("dialog", d)))).expect("the Fit Image window");
+        let window = h.ctx.memory(|m| m.area_rect(egui::Id::unique(("dialog", d)))).expect("the Fit Image window");
         assert!(window.width() < 300.0, "Fit Image is {} points wide", window.width());
         for label in ["Fit Image", "Width", "Height", "OK", "Cancel"] {
-            assert!(window.contains_rect(h.get_by_label(label).rect()), "{label} inside the window");
+            // A caption and the field it names share the label; either sits inside the window.
+            let node = h.query_all_by_label(label).next().unwrap_or_else(|| panic!("{label} in the dialog"));
+            assert!(window.contains_rect(node.rect()), "{label} inside the window");
         }
     }
 }
@@ -1433,7 +1445,7 @@ mod preference_resize_tests {
     }
 
     fn frame(h: &egui_kittest::Harness<'_, PhotocraftApp>) -> egui::Rect {
-        let rects: Vec<egui::Rect> = h.ctx.data(|m| m.get_temp(egui::Id::new(RECTS))).unwrap();
+        let rects: Vec<egui::Rect> = h.ctx.data(|m| m.get_temp(egui::Id::unique(RECTS))).unwrap();
         rects[0]
     }
 
diff --git a/crates/ui-egui/src/direction.rs b/crates/ui-egui/src/direction.rs
index ab54a2ed62..6eabbb73ef 100644
--- a/crates/ui-egui/src/direction.rs
+++ b/crates/ui-egui/src/direction.rs
@@ -68,12 +68,12 @@ fn parse_dir(value: &str) -> Option<Dir> {
 }
 
 /// A side panel on the reading-start side: left, or right in a right-to-left UI (the toolbox).
-pub fn start_panel(id: impl Into<egui::Id>) -> egui::Panel {
+pub fn start_panel(id: impl egui::AsIdSalt) -> egui::Panel {
     if is_rtl() { egui::Panel::right(id) } else { egui::Panel::left(id) }
 }
 
 /// A side panel on the reading-end side: right, or left in a right-to-left UI (the dock).
-pub fn end_panel(id: impl Into<egui::Id>) -> egui::Panel {
+pub fn end_panel(id: impl egui::AsIdSalt) -> egui::Panel {
     if is_rtl() { egui::Panel::left(id) } else { egui::Panel::right(id) }
 }
 
diff --git a/crates/ui-egui/src/direction_tests.rs b/crates/ui-egui/src/direction_tests.rs
index 4575017a09..f8ddafc2c4 100644
--- a/crates/ui-egui/src/direction_tests.rs
+++ b/crates/ui-egui/src/direction_tests.rs
@@ -89,9 +89,7 @@ fn text_x(h: &Harness<'static, PhotocraftApp>, text: &str) -> f32 {
 }
 
 fn dock_x(h: &Harness<'static, PhotocraftApp>) -> f32 {
-    let rects = crate::dock::last_rects(&h.ctx);
-    let (_, layers) = rects.iter().find(|(g, _)| *g == crate::dock::Group::Layers).expect("Layers docked");
-    layers.center().x
+    crate::panel_docking::probe::panel_rect(&h.ctx, "layers").expect("Layers docked").center().x
 }
 
 #[test]
diff --git a/crates/ui-egui/src/discard_ui.rs b/crates/ui-egui/src/discard_ui.rs
index a6a65f29fe..2570e9041c 100644
--- a/crates/ui-egui/src/discard_ui.rs
+++ b/crates/ui-egui/src/discard_ui.rs
@@ -312,7 +312,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let labels = button_labels(mac, &buttons.iter().map(|b| (b.1, b.2)).collect::<Vec<_>>());
     let row: Vec<DialogButton> =
         buttons.iter().zip(&labels).map(|(b, label)| DialogButton::new(b.0, label, b.3).focus(focus && b.0 == ButtonRole::Default)).collect();
-    let modal = egui::Modal::new(egui::Id::new("discard-prompt")).show(ctx, |ui| {
+    let modal = egui::Modal::new(egui::Id::unique("discard-prompt")).show(ctx, |ui| {
         ui.set_max_width(420.0);
         ui.label(egui::RichText::new(tl!(&title)).font(crate::theme::semibold(15.0)));
         ui.add_space(4.0);
diff --git a/crates/ui-egui/src/distort_ui.rs b/crates/ui-egui/src/distort_ui.rs
index be1c0ddbc8..3a5c765da6 100644
--- a/crates/ui-egui/src/distort_ui.rs
+++ b/crates/ui-egui/src/distort_ui.rs
@@ -91,6 +91,23 @@ pub(crate) fn surface_image(surf: &Surface, r: Rect, max_side: usize) -> ColorIm
     ColorImage::new([tw, th], px)
 }
 
+/// The menu id of the open full-window workspace (Liquify, Content-Aware Fill, Filter Gallery,
+/// Adaptive Wide Angle). These are modal: other menu commands wait for OK or Cancel
+/// (`menus::modal_allows`).
+pub(crate) fn modal_workspace(app: &PhotocraftApp) -> Option<&'static str> {
+    if app.distort.liquify.is_some() {
+        Some("filter.liquify")
+    } else if app.distort.caf.is_some() {
+        Some("edit.contentAwareFill")
+    } else if app.distort.gallery.is_some() {
+        Some("filter.filterGallery")
+    } else if app.wide_angle.is_some() {
+        Some(photocraft_engine::lens_cmds::WIDE)
+    } else {
+        None
+    }
+}
+
 fn active_doc(app: &PhotocraftApp) -> Option<DocId> {
     app.session.active().map(|st| st.doc.id)
 }
@@ -121,12 +138,13 @@ pub fn cancel_stale(app: &mut PhotocraftApp) {
     }
 }
 
-/// The document shown on the canvas while Puppet or Perspective Warp previews a layer.
+/// The document shown on the canvas while Puppet or Perspective Warp previews a layer, or
+/// Vanishing Point's Stamp has painted.
 pub fn display_doc(app: &PhotocraftApp, idx: usize) -> Option<(Arc<Document>, u64)> {
     if app.session.active_index() != Some(idx) {
         return None;
     }
-    let id = app.session.documents().get(idx).map(|st| st.doc.id)?;
+    let (id, revision) = app.session.documents().get(idx).map(|st| (st.doc.id, st.revision))?;
     if let Some(p) = &app.distort.puppet
         && p.document == id
     {
@@ -137,7 +155,8 @@ pub fn display_doc(app: &PhotocraftApp, idx: usize) -> Option<(Arc<Document>, u6
     {
         return Some((p.preview_doc.clone(), (1 << 42) + p.key));
     }
-    None
+    // Vanishing Point: the clone strokes painted so far, on the document as they were painted.
+    app.distort.vanishing.as_ref().and_then(|v| v.shown_on(id, revision))
 }
 
 /// Menu / control routing. `Some` when this module handles the invocation.
diff --git a/crates/ui-egui/src/doc_props_ui.rs b/crates/ui-egui/src/doc_props_ui.rs
index 90f70dd77e..3926285b20 100644
--- a/crates/ui-egui/src/doc_props_ui.rs
+++ b/crates/ui-egui/src/doc_props_ui.rs
@@ -70,7 +70,7 @@ pub fn canvas_resize_params(old: (u32, u32), new_w: Option<f32>, new_h: Option<f
 /// Collapsible section header with a chevron, Photoshop Properties style. Returns whether it is open.
 fn section(ui: &mut egui::Ui, id: &str, title: &str) -> bool {
     let t = Tokens::get(ui.ctx());
-    let key = egui::Id::new(("doc-props-section", id));
+    let key = egui::Id::unique(("doc-props-section", id));
     let mut open = ui.data(|d| d.get_temp::<bool>(key)).unwrap_or(true);
     let (r, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 22.0), Sense::click());
     icons::paint(
@@ -96,12 +96,12 @@ fn field_label(ui: &mut egui::Ui, s: &str, w: f32) {
 }
 
 /// A number field that only reports a committed value (drag released, Enter, focus lost).
-fn committed_field(ui: &mut egui::Ui, id: &str, current: f32, u: crate::layer_props_ui::LenUnit) -> Option<f32> {
-    let key = egui::Id::new(("doc-props-field", id));
+fn committed_field(ui: &mut egui::Ui, id: &str, name: &str, current: f32, u: crate::layer_props_ui::LenUnit) -> Option<f32> {
+    let key = egui::Id::unique(("doc-props-field", id));
     // Shown in the ruler unit (cm when the rulers are in centimeters); 100% is the current size.
     let extent = f64::from(current);
     let mut v = ui.data(|d| d.get_temp::<f32>(key)).unwrap_or_else(|| u.shown(extent, extent));
-    let r = widgets::value_field(ui, &mut v, 0.0..=300_000.0, u.unit.suffix(), 74.0);
+    let r = widgets::value_field(ui, &mut v, 0.0..=300_000.0, u.unit.suffix(), 74.0).accessible_name(tl!(name));
     if r.dragged() || r.has_focus() {
         ui.data_mut(|d| d.insert_temp(key, v));
         return None;
@@ -140,7 +140,7 @@ pub fn properties(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     ui.add_space(2.0);
     let label_w = 44.0;
     if section(ui, "canvas", tl!("Canvas")) {
-        let link_key = egui::Id::new("doc-props-link");
+        let link_key = egui::Id::unique("doc-props-link");
         let linked = ui.data(|d| d.get_temp::<bool>(link_key)).unwrap_or(false);
         ui.horizontal(|ui| {
             ui.spacing_mut().item_spacing.x = 4.0;
@@ -153,7 +153,7 @@ pub fn properties(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             ui.vertical(|ui| {
                 ui.horizontal(|ui| {
                     stacked_label(ui, "W", &["W", "H"], 18.0, 4.0);
-                    if let Some(v) = committed_field(ui, "w", w as f32, lu) {
+                    if let Some(v) = committed_field(ui, "w", "Width", w as f32, lu) {
                         run.extend(canvas_resize_params((w, h), Some(v), None, linked).map(|p| ("image.canvasSize".to_string(), p)));
                     }
                     stacked_label(ui, "X", &["X", "Y"], 22.0, 4.0);
@@ -161,7 +161,7 @@ pub fn properties(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 });
                 ui.horizontal(|ui| {
                     stacked_label(ui, "H", &["W", "H"], 18.0, 4.0);
-                    if let Some(v) = committed_field(ui, "h", h as f32, lu) {
+                    if let Some(v) = committed_field(ui, "h", "Height", h as f32, lu) {
                         run.extend(canvas_resize_params((w, h), None, Some(v), linked).map(|p| ("image.canvasSize".to_string(), p)));
                     }
                     stacked_label(ui, "Y", &["X", "Y"], 22.0, 4.0);
@@ -190,7 +190,7 @@ pub fn properties(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             field_label(ui, tl!("Mode"), label_w);
             let mut m = mode;
             let opts: Vec<(ColorMode, &str)> = MODES.iter().map(|(m, l, _)| (*m, *l)).collect();
-            if widgets::dropdown(ui, "doc-props-mode", &mut m, &opts, 150.0)
+            if widgets::dropdown(ui, "doc-props-mode", tl!("Color Mode"), &mut m, &opts, 150.0)
                 && let Some((_, _, id)) = MODES.iter().find(|(x, _, _)| *x == m)
             {
                 run.push(((*id).to_string(), Value::Null));
@@ -201,7 +201,7 @@ pub fn properties(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             let mut d = depth;
             let opts: Vec<(SampleType, &str, &str)> =
                 DEPTHS.iter().map(|(d, l, _)| (*d, *l, if *d == SampleType::F32 { "Floating point" } else { "Integer" })).collect();
-            if widgets::dropdown_with_tooltips(ui, "doc-props-depth", &mut d, &opts, 150.0)
+            if widgets::dropdown_with_tooltips(ui, "doc-props-depth", tl!("Depth"), &mut d, &opts, 150.0)
                 && let Some((_, _, id)) = DEPTHS.iter().find(|(x, _, _)| *x == d)
             {
                 run.push(((*id).to_string(), Value::Null));
@@ -214,7 +214,7 @@ pub fn properties(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             // The canvas fill is only editable for documents without a Background layer.
             ui.add_enabled_ui(!has_bg, |ui| {
                 let mut f = 0u8;
-                widgets::dropdown(ui, "doc-props-fill", &mut f, &[(0u8, tl!("Background Color"))], 124.0);
+                widgets::dropdown(ui, "doc-props-fill", tl!("Background"), &mut f, &[(0u8, tl!("Background Color"))], 124.0);
             });
         });
         ui.add_space(4.0);
@@ -238,7 +238,7 @@ pub fn properties(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             ui.add_space(8.0);
             let mut unit = app.session.prefs().units_and_rulers.rulers.name().to_string();
             let opts: Vec<(String, &str)> = UNITS.iter().map(|(k, l)| (k.to_string(), *l)).collect();
-            if widgets::dropdown(ui, "doc-props-units", &mut unit, &opts, 96.0) {
+            if widgets::dropdown(ui, "doc-props-units", tl!("Units"), &mut unit, &opts, 96.0) {
                 run.push(("prefs.set".into(), json!({"path": "unitsAndRulers.rulers", "value": unit})));
             }
         });
diff --git a/crates/ui-egui/src/dock.rs b/crates/ui-egui/src/dock.rs
index 1e4fa3cf53..91cccc453b 100644
--- a/crates/ui-egui/src/dock.rs
+++ b/crates/ui-egui/src/dock.rs
@@ -1,11 +1,11 @@
-//! Right-dock layout (#88): panel groups with fixed heights, like Photoshop's dock columns.
+//! The native dock's state (#88): the panel groups of the end-side dock column, their order,
+//! tab order, hidden tabs, heights and collapse.
 //!
-//! A group's height never follows its content: content taller than the group scrolls inside
-//! it. The last expanded group (Layers by default) fills what the others leave. Drag the gap
-//! between two groups to resize them, double-click a tab (or use the panel menu) to collapse a
-//! group to its tab strip, drag a tab strip (outside its tabs, or a tab dragged off the strip) to
-//! move the group up or down the column, and drag a tab along its strip to reorder the group's
-//! tabs (#2272), or drop a tab on another group's strip to move only that tab. Window › Workspace › Lock Workspace stops all these moves.
+//! craft-ui's docking draws every layout (`crate::panel_docking`). Until the workspace is
+//! customized, the default layout is built each frame from this state: one dock column of the
+//! shown groups, top to bottom, where a group the user never resized gets its default height and
+//! the last expanded group (Layers by default) fills what the others leave. The Window menu's
+//! panel toggles, the icon rail, collapse and `ui.set` change this state.
 //!
 //! The layout is [`DockLayout`] in `UiState::dock` (serialisable, drivable with `ui.set`), saved
 //! with Window › Workspace › New Workspace…, reset by Reset Workspace, and remembered across
@@ -13,14 +13,11 @@
 
 use std::collections::BTreeMap;
 
-use egui::{Pos2, Rect, Sense, Stroke, pos2, vec2};
 use serde::{Deserialize, Serialize};
 use serde_json::{Value, json};
 
 use crate::PhotocraftApp;
 use crate::state::{DockTabs, Panels};
-use crate::theme::Tokens;
-use crate::widgets;
 
 /// A dock panel group (one tab strip).
 #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
@@ -59,7 +56,7 @@ impl Group {
     }
 
     /// Height (points, tab strip included) a group gets until the user resizes it, when the
-    /// column has room (see [`DockLayout::heights_for`]).
+    /// column has room.
     pub fn default_height(self) -> f32 {
         match self {
             Group::Color => 190.0,
@@ -203,8 +200,6 @@ fn lenient_tab_order<'de, D: serde::Deserializer<'de>>(d: D) -> Result<BTreeMap<
     Ok(out)
 }
 
-/// Gap between groups; it is also the splitter's grab area.
-pub const GAP: f32 = 6.0;
 /// Upper bound on a stored height (guards against absurd values from `ui.set`).
 const MAX_HEIGHT: f32 = 4000.0;
 
@@ -236,24 +231,6 @@ impl DockLayout {
         self.ordered_tabs(group, pro).into_iter().filter(|(_, name)| !hidden.is_some_and(|xs| xs.iter().any(|x| x.as_str() == *name))).collect()
     }
 
-    /// Move tab `tab` (an original index) of `group` so it is drawn just before tab `before`
-    /// (or last when `None` or not a tab of the group). The default order is stored as no entry.
-    pub fn move_tab(&mut self, group: Group, tab: usize, before: Option<usize>, pro: bool) {
-        if before == Some(tab) {
-            return;
-        }
-        let mut order = self.ordered_tabs(group, pro);
-        let Some(at) = order.iter().position(|(i, _)| *i == tab) else { return };
-        let moved = order.remove(at);
-        let to = before.and_then(|b| order.iter().position(|(i, _)| *i == b)).unwrap_or(order.len());
-        order.insert(to, moved);
-        if order.iter().map(|(i, _)| *i).eq(0..order.len()) {
-            self.tab_order.remove(&group);
-        } else {
-            self.tab_order.insert(group, order.into_iter().map(|(_, n)| n.to_owned()).collect());
-        }
-    }
-
     /// Hide one tab; it can be reopened through Window › Panel.
     pub fn hide_tab(&mut self, group: Group, tab: usize, pro: bool) {
         let Some(&name) = group.tabs(pro).get(tab) else { return };
@@ -315,84 +292,6 @@ impl DockLayout {
             _ => g.default_height(),
         }
     }
-
-    /// Move `g` so it is drawn just before `before` (or last when `None`).
-    pub fn move_group(&mut self, g: Group, before: Option<Group>) {
-        if before == Some(g) {
-            return;
-        }
-        let mut order = self.order();
-        order.retain(|x| *x != g);
-        let at = before.and_then(|b| order.iter().position(|x| *x == b)).unwrap_or(order.len());
-        order.insert(at, g);
-        self.order = order;
-    }
-
-    /// Lay out the `shown` groups (in display order) in a column `avail` points tall with
-    /// `strip`-high tab strips. Returns each group's height. The last expanded group fills the
-    /// rest. Groups the user never resized give way first, down to their compact heights, so
-    /// the filler gets its preferred height (Layers: ~10 rows, #147); when the column is still
-    /// too short every group gives way down to its minimum height.
-    pub fn heights_for(&self, shown: &[Group], avail: f32, strip: f32) -> Vec<(Group, f32)> {
-        let avail = if avail.is_finite() { avail.max(0.0) } else { 0.0 };
-        let filler = shown.iter().rposition(|g| !self.is_collapsed(*g));
-        let mut hs: Vec<f32> = shown
-            .iter()
-            .enumerate()
-            .map(|(i, g)| {
-                if self.is_collapsed(*g) {
-                    strip
-                } else if Some(i) == filler {
-                    0.0
-                } else {
-                    self.height(*g)
-                }
-            })
-            .collect();
-        if let Some(f) = filler {
-            let gaps = GAP * shown.len().saturating_sub(1) as f32;
-            let min_fill = shown.get(f).map_or(0.0, |g| g.min_height());
-            let pref_fill = shown.get(f).map_or(0.0, |g| g.preferred_fill());
-            let used: f32 = hs.iter().sum::<f32>() + gaps;
-            let mut deficit = (used + pref_fill - avail).max(0.0);
-            for i in (0..f).rev() {
-                if deficit <= 0.0 {
-                    break;
-                }
-                let Some(g) = shown.get(i) else { continue };
-                if self.is_collapsed(*g) || self.heights.contains_key(g) {
-                    continue;
-                }
-                if let Some(h) = hs.get_mut(i) {
-                    let give = (*h - g.compact_height()).max(0.0).min(deficit);
-                    *h -= give;
-                    deficit -= give;
-                }
-            }
-            let used: f32 = hs.iter().sum::<f32>() + gaps;
-            let mut deficit = (used + min_fill - avail).max(0.0);
-            // Squeeze the expanded groups nearest the filler first.
-            for i in (0..f).rev() {
-                if deficit <= 0.0 {
-                    break;
-                }
-                let Some(g) = shown.get(i) else { continue };
-                if self.is_collapsed(*g) {
-                    continue;
-                }
-                if let Some(h) = hs.get_mut(i) {
-                    let give = (*h - g.min_height()).max(0.0).min(deficit);
-                    *h -= give;
-                    deficit -= give;
-                }
-            }
-            let rest = avail - hs.iter().sum::<f32>() - gaps;
-            if let Some(h) = hs.get_mut(f) {
-                *h = rest.max(min_fill);
-            }
-        }
-        shown.iter().copied().zip(hs).collect()
-    }
 }
 
 /// Show `g` and expand it (Window › <panel>, the icon rail): a panel asked for is always
@@ -438,404 +337,56 @@ pub(crate) fn close_tab(app: &mut PhotocraftApp, g: Group, tab: usize, pro: bool
     }
 }
 
-/// Per-group interactions collected while drawing, applied afterwards.
-enum Action {
-    ToggleCollapse(Group),
-    Close(Group),
-    CloseTab(Group, usize),
-    Move(Group, Option<Group>),
-    MoveTab(Group, usize, Option<usize>),
-}
-
-/// Rects of the groups drawn last frame (screen points), for tests and automation.
-pub fn last_rects(ctx: &egui::Context) -> Vec<(Group, Rect)> {
-    ctx.data(|d| d.get_temp::<Vec<(Group, Rect)>>(rects_id())).unwrap_or_default()
-}
-
-fn rects_id() -> egui::Id {
-    egui::Id::new("dock-group-rects")
-}
-
-/// The group expanded from its collapsed tab strip (see [`show`]), if any: with Preferences ▸
-/// Workspace ▸ Auto-Collapse Iconic Panels on, the first click outside it collapses it again.
-fn peek_id() -> egui::Id {
-    egui::Id::new("dock-peek")
-}
-
-fn auto_collapse_peek(app: &mut PhotocraftApp, ctx: &egui::Context) {
-    let Some(g) = ctx.data(|d| d.get_temp::<Option<Group>>(peek_id())).flatten() else { return };
-    let Some(p) = ctx.input(|i| i.pointer.any_pressed().then(|| i.pointer.press_origin()).flatten()) else {
-        return;
-    };
-    let inside = last_rects(ctx).into_iter().find(|(x, _)| *x == g).is_some_and(|(_, r)| r.contains(p));
-    if !inside {
-        app.ui.dock.set_collapsed(g, true);
-        ctx.data_mut(|d| {
-            d.insert_temp(peek_id(), None::<Group>);
-        });
-    }
-}
-
-/// A group's tab strip as drawn last frame (screen points), for tests and automation.
-#[derive(Clone, Debug, PartialEq)]
-pub struct StripRects {
-    pub group: Group,
-    /// The area accepting a tab drop, excluding the group menu.
-    pub area: Rect,
-    /// `(tab index, rect)` of the tabs on the strip (the others are in the chevron menu).
-    pub tabs: Vec<(usize, Rect)>,
-    /// The panel menu button.
-    pub menu: Rect,
-    /// The » overflow button, when some tabs didn't fit.
-    pub chevron: Option<Rect>,
-}
-
-/// The tab strips drawn last frame.
-pub fn last_strips(ctx: &egui::Context) -> Vec<StripRects> {
-    ctx.data(|d| d.get_temp::<Vec<StripRects>>(strips_id())).unwrap_or_default()
-}
-
-fn strips_id() -> egui::Id {
-    egui::Id::new("dock-strip-rects")
-}
-
-/// Draw the `shown` groups (any order; the layout decides) filling `ui`. `body` draws one
-/// group's tab content.
-pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui, shown: &[Group], mut body: impl FnMut(&mut PhotocraftApp, &mut egui::Ui, Group, usize)) {
-    let t = Tokens::get(ui.ctx());
-    let auto_collapse = app.session.prefs().workspace.auto_collapse_icon_panels;
-    if auto_collapse {
-        auto_collapse_peek(app, ui.ctx());
-    } else {
-        ui.ctx().data_mut(|d| {
-            d.insert_temp(peek_id(), None::<Group>);
-        });
-    }
-    let strip = if t.pro { 28.0 } else { 40.0 };
-    let order: Vec<Group> = app.ui.dock.order().into_iter().filter(|g| shown.contains(g)).collect();
-    let area = ui.available_rect_before_wrap();
-    let heights = app.ui.dock.heights_for(&order, area.height(), strip);
-    let locked = app.session.prefs().workspace_locked;
-    let rects = rects_after_layout(&heights, area);
-    let mut actions: Vec<Action> = Vec::new();
-    let mut peek_after: Option<Group> = None;
-    let mut tab_drops: Vec<(Group, usize, Pos2)> = Vec::new();
-    let mut dragging: Option<Group> = None;
-    let mut strips: Vec<StripRects> = Vec::with_capacity(rects.len());
-    for (i, (g, rect)) in rects.iter().copied().enumerate() {
-        let collapsed = app.ui.dock.is_collapsed(g);
-        let mut child = ui.new_child(egui::UiBuilder::new().id_salt(("dock-group", g.key())).max_rect(rect));
-        child.set_clip_rect(rect.intersect(ui.clip_rect()));
-        child.spacing_mut().item_spacing.y = if t.pro { 0.0 } else { 6.0 };
-        let before = *g.tab_mut(&mut app.ui.dock_tabs);
-        let visible = app.ui.dock.visible_tabs(g, t.pro);
-        if visible.is_empty() {
-            continue;
-        }
-        let indices: Vec<usize> = visible.iter().map(|(i, _)| *i).collect();
-        let tabs: Vec<&str> = visible.iter().map(|(_, name)| *name).collect();
-        let mut sel = indices.iter().position(|i| *i == before).unwrap_or(0);
-        let resp = widgets::card_ex(&mut child, g.key(), &tabs, &mut sel, collapsed, !locked, |ui, shown_tab| {
-            let Some(&tab) = indices.get(shown_tab) else { return };
-            let inner = ui.available_height().max(0.0);
-            if g.scrolls_itself(tab) {
-                ui.set_min_height(inner);
-                body(app, ui, g, tab);
-            } else {
-                crate::panels::offer_color_field_fill(ui, t.pro, g, tab);
-                // No scroll fade: it darkens real colours, swatches and previews at the edge
-                // (#2726); the scroll bar already shows there is more.
-                ui.spacing_mut().scroll.fade.strength = 0.0;
-                egui::ScrollArea::vertical()
-                    .id_salt(("dock-scroll", g.key(), tab))
-                    .max_height(inner)
-                    .auto_shrink([false, false])
-                    .show(ui, |ui| body(app, ui, g, tab));
-            }
-        });
-        for (index, response) in &resp.responses {
-            if let Some(panel) = tabs.get(*index) {
-                crate::panel_docking::legacy_tab(app, &mut child, panel, response);
-            }
-        }
-        strips.push(StripRects {
-            group: g,
-            area: Rect::from_min_max(pos2(rect.left(), resp.menu.rect.top()), pos2(resp.menu.rect.left(), resp.menu.rect.bottom())),
-            tabs: resp.tabs.iter().filter_map(|(i, r)| indices.get(*i).map(|original| (*original, *r))).collect(),
-            menu: resp.menu.rect,
-            chevron: resp.chevron,
-        });
-        // The strip uses visible indices; dockTabs and the panel bodies use original indices.
-        if let Some(&picked) = indices.get(sel)
-            && picked != before
-        {
-            *g.tab_mut(&mut app.ui.dock_tabs) = picked;
-        }
-        if let Some(context) = resp.tab_context {
-            match context {
-                crate::tab_strip::TabContextAction::Close(i) => {
-                    if let Some(&tab) = indices.get(i) {
-                        actions.push(Action::CloseTab(g, tab));
-                    }
-                }
-                crate::tab_strip::TabContextAction::CloseGroup => actions.push(Action::Close(g)),
-            }
-        }
-        if resp.strip.double_clicked() || resp.tab_double_clicked || (collapsed && resp.tab_clicked) {
-            actions.push(Action::ToggleCollapse(g));
-            // A single click on a collapsed strip's tab expands the group as a peek: the next
-            // click outside closes it again, with Auto-Collapse Iconic Panels on.
-            if collapsed && resp.tab_clicked && !resp.tab_double_clicked && auto_collapse {
-                peek_after = Some(g);
-            }
-        }
-        // The strip uses visible indices; reorder in original ones.
-        if !locked
-            && let Some((from, before)) = resp.tab_reorder
-            && let Some(&tab) = indices.get(from)
-        {
-            actions.push(Action::MoveTab(g, tab, before.and_then(|b| indices.get(b).copied())));
-        }
-        // A tab dragged off its strip moves the whole group, as the strip itself does.
-        if !locked && app.ui.docking.is_none() && (resp.strip.dragged() || resp.tab_dragging_out.is_some()) {
-            dragging = Some(g);
-        }
-        if !locked
-            && app.ui.docking.is_none()
-            && resp.strip.drag_stopped()
-            && let Some(p) = ui.ctx().pointer_interact_pos().or_else(|| ui.ctx().pointer_latest_pos())
-        {
-            actions.push(Action::Move(g, drop_before(&order, &rects, g, p.y)));
-        }
-        if !locked
-            && app.ui.docking.is_none()
-            && let Some(shown_tab) = resp.tab_dropped_out
-            // The strip uses visible indices; the drop resolves the panel by its original one.
-            && let Some(&tab) = indices.get(shown_tab)
-            && let Some(p) = ui.ctx().pointer_interact_pos().or_else(|| ui.ctx().pointer_latest_pos())
-        {
-            tab_drops.push((g, tab, p));
-        }
-        if dragging == Some(g) {
-            ui.ctx().set_cursor_icon(egui::CursorIcon::Grabbing);
-        }
-        egui::Popup::menu(&resp.menu).show(|ui| {
-            crate::widgets::style_spectrum_popup_menu(ui);
-            ui.set_min_width(170.0);
-            if tabs.get(sel) == Some(&"Layers") {
-                crate::layer_row_ui::panel_menu(app, ui);
-                ui.separator();
-            }
-            if tabs.get(sel) == Some(&"Color") {
-                crate::color_panel_ui::panel_menu(app, ui);
-                ui.separator();
-            }
-            if tabs.get(sel) == Some(&"Swatches") {
-                crate::swatches_ui::panel_menu(app, ui);
-                ui.separator();
-            }
-            if tabs.get(sel) == Some(&"History") {
-                crate::history_menu_ui::panel_menu(app, ui);
-                ui.separator();
-            }
-            if tabs.get(sel) == Some(&"Brush Settings") {
-                crate::brush_panel::panel_menu(app, ui);
-                ui.separator();
-            }
-            if tabs.get(sel) == Some(&"Actions") {
-                crate::actions::panel_menu(app, ui);
-                ui.separator();
-            }
-            if let Some(label) = tabs.get(sel) {
-                crate::panel_docking::legacy_menu(app, ui, label);
-            }
-            if ui.button(if collapsed { tl!("Expand Panel Group") } else { tl!("Collapse Panel Group") }).clicked() {
-                actions.push(Action::ToggleCollapse(g));
-                ui.close();
-            }
-            let pos = order.iter().position(|x| *x == g).unwrap_or(0);
-            if ui.add_enabled(!locked && pos > 0, egui::Button::new(tl!("Move Group Up"))).clicked() {
-                actions.push(Action::Move(g, order.get(pos.saturating_sub(1)).copied()));
-                ui.close();
-            }
-            if ui.add_enabled(!locked && pos + 1 < order.len(), egui::Button::new(tl!("Move Group Down"))).clicked() {
-                actions.push(Action::Move(g, order.get(pos + 2).copied()));
-                ui.close();
-            }
-            ui.separator();
-            if ui.button(tl!("Close")).clicked() {
-                if let Some(&tab) = indices.get(sel) {
-                    actions.push(Action::CloseTab(g, tab));
-                }
-                ui.close();
-            }
-            if ui.button(tl!("Close Tab Group")).clicked() {
-                actions.push(Action::Close(g));
-                ui.close();
-            }
-        });
-        // Splitter in the gap below this group: resizes it, pushing the neighbouring groups.
-        if i + 1 < rects.len() && !collapsed && rects.iter().skip(i + 1).any(|(n, _)| !app.ui.dock.is_collapsed(*n)) {
-            let gap = Rect::from_min_size(pos2(rect.left(), rect.bottom()), vec2(rect.width(), GAP)).expand2(vec2(0.0, 2.0));
-            let sresp = ui.interact(gap, ui.id().with(("dock-splitter", g.key())), Sense::drag());
-            if sresp.hovered() || sresp.dragged() {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::ResizeVertical);
-                ui.painter().line_segment([gap.left_center(), gap.right_center()], Stroke::new(2.0, t.accent.gamma_multiply(0.7)));
-            }
-            if sresp.dragged() {
-                resize(&mut app.ui.dock, &heights, i, sresp.drag_delta().y);
-            }
-        }
-    }
-    let mut panel_moves = Vec::new();
-    for (from, tab, position) in tab_drops {
-        let target = strips.iter().find(|strip| strip.group != from && strip.area.contains(position));
-        if let Some(target) = target {
-            let pro = t.pro;
-            let source = from.tabs(pro).get(tab).and_then(|label| crate::panel_docking::normalize(label));
-            let slot = crate::tab_strip::drop_slot(&target.tabs, target.area, position);
-            let before = slot.and_then(|slot| target.tabs.get(slot).map(|(index, _)| *index));
-            let anchor = before.or_else(|| target.tabs.first().map(|(index, _)| *index));
-            let destination = anchor.and_then(|index| target.group.tabs(pro).get(index).and_then(|label| crate::panel_docking::normalize(label)));
-            if let (Some(source), Some(destination)) = (source, destination) {
-                panel_moves.push((source, destination, before.is_some()));
-            }
-        } else {
-            actions.push(Action::Move(from, drop_before(&order, &rects, from, position.y)));
-        }
-    }
-    // Drop indicator while a group is dragged by its tab strip.
-    if let (Some(g), Some(p)) = (dragging, ui.ctx().pointer_interact_pos()) {
-        let before = drop_before(&order, &rects, g, p.y);
-        let line_y = match before.and_then(|b| rects.iter().find(|(x, _)| *x == b)) {
-            Some((_, r)) => r.top() - GAP / 2.0,
-            None => rects.last().map_or(area.top(), |(_, r)| r.bottom() + GAP / 2.0),
-        };
-        ui.painter().line_segment([pos2(area.left(), line_y), pos2(area.right(), line_y)], Stroke::new(3.0, t.accent));
-    }
-    ui.ctx().data_mut(|d| {
-        d.insert_temp(rects_id(), rects);
-        d.insert_temp(strips_id(), strips);
-    });
-    ui.advance_cursor_after_rect(area);
-    for a in actions {
-        match a {
-            Action::ToggleCollapse(g) => {
-                let on = !app.ui.dock.is_collapsed(g);
-                app.ui.dock.set_collapsed(g, on);
-            }
-            Action::Close(g) => *g.shown_mut(&mut app.ui.panels) = false,
-            Action::CloseTab(g, tab) => close_tab(app, g, tab, t.pro),
-            Action::MoveTab(g, tab, before) => app.ui.dock.move_tab(g, tab, before, t.pro),
-            Action::Move(g, before) => {
-                if before != Some(g) {
-                    app.ui.dock.move_group(g, before);
-                }
-            }
-        }
-    }
-    if let Some(g) = peek_after
-        && !app.ui.dock.is_collapsed(g)
-    {
-        ui.ctx().data_mut(|d| {
-            d.insert_temp(peek_id(), Some(g));
-        });
-    }
-    for (panel, anchor, before) in panel_moves {
-        let params = if before { json!({"panel":panel,"anchor":anchor,"before":anchor}) } else { json!({"panel":panel,"anchor":anchor}) };
-        if let Err(error) = app.run("window.panel.move", params) {
-            app.ui.status = error;
-        }
-    }
-}
-
-fn rects_after_layout(heights: &[(Group, f32)], area: Rect) -> Vec<(Group, Rect)> {
-    let mut y = area.top();
-    heights
-        .iter()
-        .map(|(g, h)| {
-            let r = Rect::from_min_size(pos2(area.left(), y), vec2(area.width(), h.max(0.0)));
-            y = r.bottom() + GAP;
-            (*g, r)
-        })
-        .collect()
-}
-
-/// The group the dragged one lands before when released at `y` (`None` = last).
-fn drop_before(order: &[Group], rects: &[(Group, Rect)], dragged: Group, y: f32) -> Option<Group> {
-    let hit = rects.iter().find(|(_, r)| y < r.center().y).map(|(g, _)| *g);
-    match hit {
-        // Dropping onto itself, or just below itself, keeps the place.
-        Some(g) if g == dragged => Some(dragged),
-        Some(g) => {
-            let after_self = order.iter().position(|x| *x == dragged).zip(order.iter().position(|x| *x == g)).is_some_and(|(a, b)| b == a + 1);
-            if after_self { Some(dragged) } else { Some(g) }
-        }
-        None => None,
-    }
-}
-
-/// Splitter `i` (below group `i`) dragged by `dy`. Like Photoshop, the groups on the side the
-/// splitter moves into shrink in turn, nearest first, each down to its minimum (#2573), and the
-/// group on the other side grows by what they gave. The filler absorbs its share implicitly,
-/// so the column height stays the same.
-fn resize(layout: &mut DockLayout, heights: &[(Group, f32)], i: usize, dy: f32) {
-    if !dy.is_finite() || dy == 0.0 {
-        return;
-    }
-    let expanded = |k: &usize| heights.get(*k).is_some_and(|(g, _)| !layout.is_collapsed(*g));
-    let filler = (0..heights.len()).rev().find(expanded);
-    let Some(j) = (i + 1..heights.len()).find(expanded) else { return };
-    if !expanded(&i) {
-        return;
-    }
-    // Dragging down grows group `i` at the expense of the groups below; dragging up grows the
-    // next expanded group at the expense of `i` and the groups above it.
-    let (grow, shrink): (usize, Vec<usize>) =
-        if dy > 0.0 { (i, (j..heights.len()).filter(expanded).collect()) } else { (j, (0..=i).rev().filter(expanded).collect()) };
-    // The first drag pins the other groups at the heights they show, so groups still at their
-    // defaults (which give way to the filler) don't shift while this one is resized.
-    for (k, (o, oh)) in heights.iter().enumerate() {
-        if Some(k) != filler && !layout.is_collapsed(*o) {
-            layout.heights.entry(*o).or_insert(*oh);
-        }
-    }
-    let mut left = dy.abs();
-    for k in shrink {
-        if left <= 0.0 {
-            break;
-        }
-        let Some(&(o, oh)) = heights.get(k) else { continue };
-        let give = (oh - o.min_height()).max(0.0).min(left);
-        left -= give;
-        if Some(k) != filler {
-            layout.heights.insert(o, oh - give);
-        }
-    }
-    if let Some(&(o, oh)) = heights.get(grow)
-        && Some(grow) != filler
-    {
-        layout.heights.insert(o, oh + (dy.abs() - left));
-    }
-}
-
 /// What `prefs.panelLayout` holds: the live layout and open panels.
-fn snapshot(app: &PhotocraftApp) -> Value {
-    json!({"workspace": app.ui.workspace, "panels": app.ui.panels, "dockTabs": app.ui.dock_tabs, "dock": app.ui.dock, "timelineOpen": app.ui.timeline.open, "docking": app.ui.docking, "dockingHidden": app.ui.docking_hidden, "dockingCollapsed": app.ui.docking_collapsed})
+pub(crate) fn snapshot(app: &PhotocraftApp) -> Value {
+    let mut layout = json!({"workspace": app.ui.workspace, "panels": app.ui.panels, "dockTabs": app.ui.dock_tabs, "dock": app.ui.dock, "timelineOpen": app.ui.timeline.open, "docking": app.ui.docking, "dockingReturns": app.ui.docking_returns, "dockingCollapsed": app.ui.docking_collapsed});
+    keep_newer(app, &mut layout);
+    layout
+}
+
+/// A saved layout's workspace from a newer version stays as saved while the default layout
+/// shows in its place (craft-ui: keep it on disk, don't overwrite it).
+pub(crate) fn keep_newer(app: &PhotocraftApp, layout: &mut Value) {
+    if let (None, Some(kept), Some(layout)) = (&app.ui.docking, &app.ui.docking_kept, layout.as_object_mut()) {
+        layout.extend(kept.clone());
+    }
 }
 
 /// Remember the layout in the preferences once the user lets go of the mouse (Workspace ›
-/// Remember Workspace Changes). Cheap: a small JSON compare per frame.
+/// Remember Workspace Changes), and once panel windows the OS moves or resizes keep still. Cheap:
+/// a small JSON compare per frame.
 pub fn persist(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    // Once the layout changes, the newer workspace is replaced.
+    if app.ui.docking.is_some() {
+        app.ui.docking_kept = None;
+    }
     if !app.session.prefs().workspace.remember_workspace_changes || ctx.input(|i| i.pointer.any_down()) {
         return;
     }
+    if native_moved(app, ctx) {
+        ctx.request_repaint_after(std::time::Duration::from_millis(100));
+        return;
+    }
     let now = snapshot(app);
     if app.session.prefs().panel_layout != now {
         app.session.prefs.edit(|p| p.panel_layout = now);
     }
 }
 
+/// A floating panel's own window has another place than last frame. A move or resize by its OS
+/// title bar or edges changes the place each frame with no button down in any of the app's
+/// windows.
+fn native_moved(app: &PhotocraftApp, ctx: &egui::Context) -> bool {
+    let places: Vec<(u64, [f32; 4])> =
+        app.ui.docking.iter().flat_map(|workspace| workspace.layout.floating.iter().filter_map(|window| Some((window.id, window.native?)))).collect();
+    let id = egui::Id::unique("dock-native-places");
+    ctx.data_mut(|data| {
+        let moved = data.get_temp::<Vec<(u64, [f32; 4])>>(id).is_some_and(|last| last != places);
+        data.insert_temp(id, places);
+        moved
+    })
+}
+
 /// Restore the remembered layout at launch. Unreadable parts keep their defaults.
 pub fn restore(app: &mut PhotocraftApp) {
     if !app.session.prefs().workspace.remember_workspace_changes {
@@ -855,12 +406,23 @@ pub fn restore(app: &mut PhotocraftApp) {
 /// Apply the `panels`, `dockTabs`, `dock` and `timelineOpen` parts of a saved layout
 /// (a workspace or `panelLayout`). Missing or invalid dock parts are left alone; old
 /// layouts without Timeline visibility restore it closed.
+///
+/// `craft_ui::docking::DockArea` keeps only transient drag/focus data in `ctx.data`; the
+/// split/tab arrangement is the app's own `craft_ui::docking::Layout` JSON stored here. If a
+/// layout saved by a different craft-ui revision no longer deserializes, it is dropped and the
+/// legacy layout is rebuilt (the split/tab arrangement resets). Panel widths are a separate
+/// `egui::PanelState` migration and still carry over.
 pub fn apply(app: &mut PhotocraftApp, v: &Value) {
-    app.ui.docking_collapsed = v.get("dockingCollapsed").and_then(|v| serde_json::from_value(v.clone()).ok()).unwrap_or_default();
     app.ui.docking_reveal = None;
     app.ui.docking_generation = app.ui.docking_generation.wrapping_add(1);
-    app.ui.docking_hidden = v.get("dockingHidden").and_then(|v| serde_json::from_value(v.clone()).ok()).unwrap_or_default();
-    app.ui.docking = v.get("docking").and_then(|d| serde_json::from_value(d.clone()).ok()).filter(crate::panel_docking::valid);
+    (app.ui.docking, app.ui.docking_returns) = crate::panel_docking::load(v).map_or((None, Default::default()), |(w, r)| (Some(w), r));
+    app.ui.docking_kept = (app.ui.docking.is_none() && crate::panel_docking::newer(v))
+        .then(|| ["docking", "dockingReturns", "dockingCollapsed"].into_iter().filter_map(|key| Some((key.to_owned(), v.get(key)?.clone()))).collect());
+    // Collapsed custom groups belong to the workspace; the native dock keeps its own flags.
+    app.ui.docking_collapsed = match app.ui.docking {
+        Some(_) => v.get("dockingCollapsed").and_then(|v| serde_json::from_value(v.clone()).ok()).unwrap_or_default(),
+        None => Vec::new(),
+    };
     if let Some(mut p) = v.get("panels").and_then(|p| serde_json::from_value::<Panels>(p.clone()).ok()) {
         // The embedding host owns these flags, including for layouts that serialize them.
         p.menu_bar = app.ui.panels.menu_bar;
diff --git a/crates/ui-egui/src/dock_tests.rs b/crates/ui-egui/src/dock_tests.rs
index e88bdf10ea..c03c067f6d 100644
--- a/crates/ui-egui/src/dock_tests.rs
+++ b/crates/ui-egui/src/dock_tests.rs
@@ -5,46 +5,9 @@ use egui_kittest::Harness;
 use serde_json::json;
 
 use super::*;
+use crate::panel_docking::probe;
 use crate::theme::ThemeKind;
 
-const ESSENTIALS: [Group; 3] = [Group::Color, Group::Properties, Group::Layers];
-
-#[test]
-fn last_expanded_group_fills_the_column() {
-    let l = DockLayout::default();
-    let hs = l.heights_for(&ESSENTIALS, 1200.0, 28.0);
-    assert_eq!(hs[0], (Group::Color, Group::Color.default_height()));
-    assert_eq!(hs[1], (Group::Properties, Group::Properties.default_height()));
-    let total: f32 = hs.iter().map(|(_, h)| h).sum::<f32>() + 2.0 * GAP;
-    assert!((total - 1200.0).abs() < 1e-3, "{hs:?}");
-    // Collapsed groups shrink to the tab strip; the one above Layers keeps its height.
-    let mut l = DockLayout::default();
-    l.set_collapsed(Group::Color, true);
-    let hs = l.heights_for(&ESSENTIALS, 1000.0, 28.0);
-    assert_eq!(hs[0].1, 28.0);
-    assert_eq!(hs[1].1, Group::Properties.default_height());
-    // Layers collapsed: Properties becomes the filler.
-    l.set_collapsed(Group::Layers, true);
-    let hs = l.heights_for(&ESSENTIALS, 800.0, 28.0);
-    assert_eq!(hs[2].1, 28.0);
-    assert!((hs[1].1 - (800.0 - 56.0 - 2.0 * GAP)).abs() < 1e-3);
-}
-
-#[test]
-fn short_columns_squeeze_groups_down_to_their_minimum_and_never_go_negative() {
-    let l = DockLayout::default();
-    let hs = l.heights_for(&ESSENTIALS, 400.0, 28.0);
-    assert_eq!(hs[2].1, Group::Layers.min_height(), "Layers keeps its minimum: {hs:?}");
-    assert_eq!(hs[0].1, Group::Color.compact_height(), "the group farthest from Layers gives way last");
-    assert!(hs[1].1 < Group::Properties.compact_height());
-    for avail in [0.0, -50.0, 1.0, f32::NAN, f32::INFINITY, 1e9] {
-        for (g, h) in l.heights_for(&ESSENTIALS, avail, 28.0) {
-            assert!(h.is_finite() && h >= 0.0, "{g:?} at {avail}: {h}");
-        }
-    }
-    assert!(l.heights_for(&[], 500.0, 28.0).is_empty());
-}
-
 #[test]
 fn bad_stored_values_are_sanitised() {
     let mut l = DockLayout { order: vec![Group::Layers, Group::Layers, Group::Color], ..Default::default() };
@@ -63,17 +26,6 @@ fn bad_stored_values_are_sanitised() {
     assert_eq!(ui.dock, DockLayout::default());
 }
 
-#[test]
-fn move_group_reorders() {
-    let mut l = DockLayout::default();
-    l.move_group(Group::Layers, Some(Group::Color));
-    assert_eq!(l.order()[0], Group::Layers);
-    l.move_group(Group::Layers, None);
-    assert_eq!(l.order().last(), Some(&Group::Layers));
-    l.move_group(Group::Color, Some(Group::Color));
-    assert_eq!(l.order()[0], Group::Color);
-}
-
 fn app_with_layers() -> (PhotocraftApp, photocraft_doc::LayerId, photocraft_doc::LayerId) {
     let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
     app.run("file.new", json!({"width": 200, "height": 150})).unwrap();
@@ -94,7 +46,7 @@ fn harness(app: PhotocraftApp, size: egui::Vec2, theme: ThemeKind) -> Harness<'s
             if !ctx.fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
                 return;
             }
-            crate::panels::right_dock(app, ui);
+            crate::panels::dock_area(app, ui);
             egui::CentralPanel::default().show(ui, |_| {});
         },
         app,
@@ -105,8 +57,20 @@ fn harness(app: PhotocraftApp, size: egui::Vec2, theme: ThemeKind) -> Harness<'s
     h
 }
 
+/// The panel id of the native `group`'s tab `tab`.
+fn panel_id(g: Group, tab: usize, pro: bool) -> &'static str {
+    crate::panel_docking::normalize(g.tabs(pro)[tab]).unwrap()
+}
+
 fn rect_of(h: &Harness<'static, PhotocraftApp>, g: Group) -> Rect {
-    last_rects(&h.ctx).into_iter().find(|(x, _)| *x == g).map(|(_, r)| r).unwrap_or_else(|| panic!("{g:?} not drawn"))
+    probe::native_group_rect(h.state(), &h.ctx, g).unwrap_or_else(|| panic!("{g:?} not drawn"))
+}
+
+type Drawn = (Vec<(String, Rect)>, Vec<(craft_ui::docking::Hit<String>, Rect)>);
+
+/// Every panel body and docking control drawn last frame.
+fn drawn(h: &Harness<'static, PhotocraftApp>) -> Drawn {
+    (crate::panel_docking::last_bodies(&h.ctx), craft_ui::docking::DockArea::<String>::hit_rects(&h.ctx, egui::Id::unique("photocraft-panel-docking")))
 }
 
 fn drag(h: &mut Harness<'static, PhotocraftApp>, from: Pos2, to: Pos2) {
@@ -127,55 +91,43 @@ fn switching_layer_kinds_keeps_the_layers_panel_still() {
     for theme in [ThemeKind::ProMedium, ThemeKind::Studio] {
         let (app, pixel, adj) = app_with_layers();
         let mut h = harness(app, vec2(1200.0, 800.0), theme);
-        let rects = |h: &Harness<'static, PhotocraftApp>| last_rects(&h.ctx);
-        let with_adj = rects(&h);
-        assert!(with_adj.iter().any(|(g, _)| *g == Group::Layers));
+        assert!(probe::panel_rect(&h.ctx, "layers").is_some(), "{theme:?}: Layers drawn");
+        let with_adj = drawn(&h);
         h.state_mut().run("layer.select", json!({"layer": pixel.0})).unwrap();
         h.run_steps(4);
-        assert_eq!(rects(&h), with_adj, "{theme:?}: selecting a pixel layer moved the dock groups");
+        assert_eq!(drawn(&h), with_adj, "{theme:?}: selecting a pixel layer moved the dock groups");
         h.state_mut().run("layer.select", json!({"layer": adj.0})).unwrap();
         h.run_steps(4);
-        assert_eq!(rects(&h), with_adj, "{theme:?}: selecting an adjustment layer moved the dock groups");
+        assert_eq!(drawn(&h), with_adj, "{theme:?}: selecting an adjustment layer moved the dock groups");
         // Properties ↔ Adjustments tabs don't move anything either.
         h.state_mut().ui.dock_tabs.properties = 1;
         h.run_steps(3);
-        assert_eq!(rects(&h), with_adj);
+        assert_eq!(drawn(&h).0.iter().map(|(_, r)| *r).collect::<Vec<_>>(), with_adj.0.iter().map(|(_, r)| *r).collect::<Vec<_>>());
     }
 }
 
+/// A group height dragged in the dock is part of the UI state and the remembered layout.
 #[test]
 fn dragging_the_splitter_resizes_and_survives_a_ui_state_round_trip() {
     let (app, _, _) = app_with_layers();
     let mut h = harness(app, vec2(1200.0, 800.0), ThemeKind::ProMedium);
     let props = rect_of(&h, Group::Properties);
-    let layers = rect_of(&h, Group::Layers);
-    let split = Pos2::new(props.center().x, props.bottom() + GAP / 2.0);
     let color = rect_of(&h, Group::Color);
-    drag(&mut h, split, split - vec2(0.0, 60.0));
+    let split = probe::hit_rect(&h.ctx, &craft_ui::docking::Hit::Divider(craft_ui::docking::Divider::Group("properties".into())))
+        .expect("divider below Properties")
+        .center();
+    // Less than Properties has above its minimum, so the groups above don't give way.
+    drag(&mut h, split, split - vec2(0.0, 40.0));
     let props2 = rect_of(&h, Group::Properties);
-    let layers2 = rect_of(&h, Group::Layers);
-    assert!((props2.height() - (props.height() - 60.0)).abs() < 2.0, "{props:?} -> {props2:?}");
-    assert!((layers2.top() - (layers.top() - 60.0)).abs() < 2.0, "{layers:?} -> {layers2:?}");
+    assert!((props2.height() - (props.height() - 40.0)).abs() < 2.0, "{props:?} -> {props2:?}");
     assert_eq!(rect_of(&h, Group::Color), color, "the group above keeps its place");
-    assert_eq!(layers2.bottom(), layers.bottom());
-    // Dragging past the minimum pushes the group above down to its minimum too (#2573), then stops.
-    let split = Pos2::new(props2.center().x, props2.bottom() + GAP / 2.0);
-    drag(&mut h, split, split - vec2(0.0, 600.0));
-    assert_eq!(rect_of(&h, Group::Properties).height(), Group::Properties.min_height());
-    assert_eq!(rect_of(&h, Group::Color).height(), Group::Color.min_height());
-    assert_eq!(rect_of(&h, Group::Layers).bottom(), layers.bottom());
-    // Dragging back down grows Properties alone; Color stays where it was pushed.
-    let from = Pos2::new(split.x, rect_of(&h, Group::Properties).bottom() + GAP / 2.0);
-    drag(&mut h, from, split);
-    assert!((rect_of(&h, Group::Properties).bottom() - props2.bottom()).abs() < 2.0);
-    assert_eq!(rect_of(&h, Group::Color).height(), Group::Color.min_height());
 
     // Save and restore the UI state (what `ui.inspect` / `ui.set` and workspaces carry).
     let saved = serde_json::to_value(&h.state().ui).unwrap();
     let (mut app2, _, _) = app_with_layers();
     app2.ui = serde_json::from_value(saved).unwrap();
     let h2 = harness(app2, vec2(1200.0, 800.0), ThemeKind::ProMedium);
-    assert_eq!(last_rects(&h2.ctx), last_rects(&h.ctx));
+    assert_eq!(drawn(&h2).0, drawn(&h).0);
 
     // Remembered in the preferences once the mouse is up, and restored at the next launch.
     let prefs = h.state().session.prefs_to_json();
@@ -183,126 +135,18 @@ fn dragging_the_splitter_resizes_and_survives_a_ui_state_round_trip() {
     s2.load_prefs_json(&prefs).unwrap();
     let mut app3 = PhotocraftApp::new(s2, crate::Services::default());
     restore(&mut app3);
-    assert_eq!(app3.ui.dock, h.state().ui.dock);
+    assert!(app3.ui.docking.is_some());
+    assert_eq!(app3.ui.docking.as_ref().map(|w| &w.layout), h.state().ui.docking.as_ref().map(|w| &w.layout));
     // …unless Remember Workspace Changes is off.
     let mut s3 = photocraft_engine::Session::new();
     s3.load_prefs_json(&prefs).unwrap();
     s3.prefs.edit(|p| p.workspace.remember_workspace_changes = false);
     let mut app4 = PhotocraftApp::new(s3, crate::Services::default());
     restore(&mut app4);
+    assert!(app4.ui.docking.is_none());
     assert_eq!(app4.ui.dock, DockLayout::default());
 }
 
-/// `resize` on `shown` laid out in a column `avail` tall, then the new layout.
-fn resized(l: &mut DockLayout, shown: &[Group], avail: f32, i: usize, dy: f32) -> Vec<(Group, f32)> {
-    let hs = l.heights_for(shown, avail, 28.0);
-    resize(l, &hs, i, dy);
-    l.heights_for(shown, avail, 28.0)
-}
-
-fn total(hs: &[(Group, f32)]) -> f32 {
-    hs.iter().map(|(_, h)| h).sum::<f32>() + GAP * hs.len().saturating_sub(1) as f32
-}
-
-#[test]
-fn dragging_a_splitter_down_pushes_every_group_below_in_turn() {
-    let shown = [Group::Color, Group::Properties, Group::Navigator, Group::Layers];
-    let mut l = DockLayout::default();
-    let before = l.heights_for(&shown, 1200.0, 28.0);
-    // Properties gives way first, then Navigator, then the filler; the column stays 1200.
-    let hs = resized(&mut l, &shown, 1200.0, 0, 300.0);
-    assert_eq!(hs[0].1, before[0].1 + 300.0, "{hs:?}");
-    assert_eq!(hs[1].1, Group::Properties.min_height());
-    assert_eq!(hs[2].1, before[2].1 - (300.0 - (before[1].1 - Group::Properties.min_height())));
-    assert_eq!(hs[3].1, before[3].1, "the filler is untouched until the groups above it are at minimum");
-    assert!((total(&hs) - 1200.0).abs() < 1e-3);
-    // Far past the end: everything below is at its minimum and the drag stops there.
-    let hs = resized(&mut l, &shown, 1200.0, 0, 5000.0);
-    assert_eq!(hs[1].1, Group::Properties.min_height());
-    assert_eq!(hs[2].1, Group::Navigator.min_height());
-    assert_eq!(hs[3].1, Group::Layers.min_height());
-    assert!((total(&hs) - 1200.0).abs() < 1e-3, "{hs:?}");
-    let full = hs[0].1;
-    assert_eq!(resized(&mut l, &shown, 1200.0, 0, 50.0)[0].1, full);
-}
-
-#[test]
-fn dragging_a_splitter_up_pushes_every_group_above_in_turn() {
-    let shown = [Group::Color, Group::Properties, Group::Navigator, Group::Layers];
-    let mut l = DockLayout::default();
-    let before = l.heights_for(&shown, 1200.0, 28.0);
-    // The splitter under Navigator: Navigator shrinks first, then Properties, then Color.
-    let hs = resized(&mut l, &shown, 1200.0, 2, -200.0);
-    assert_eq!(hs[2].1, Group::Navigator.min_height());
-    assert_eq!(hs[1].1, before[1].1 - (200.0 - (before[2].1 - Group::Navigator.min_height())));
-    assert_eq!(hs[0].1, before[0].1);
-    assert_eq!(hs[3].1, before[3].1 + 200.0, "the filler takes the room");
-    let hs = resized(&mut l, &shown, 1200.0, 2, -5000.0);
-    assert!(hs[..3].iter().all(|(g, h)| *h == g.min_height()), "{hs:?}");
-    assert!((total(&hs) - 1200.0).abs() < 1e-3);
-    // The group grown when the filler isn't next: the splitter under Color grows Properties.
-    let mut l = DockLayout::default();
-    let hs = resized(&mut l, &shown, 1200.0, 0, -500.0);
-    assert_eq!(hs[0].1, Group::Color.min_height());
-    assert_eq!(hs[1].1, before[1].1 + (before[0].1 - Group::Color.min_height()));
-    assert_eq!(hs[2].1, before[2].1);
-}
-
-#[test]
-fn pushing_skips_collapsed_groups_and_respects_the_filler() {
-    let shown = [Group::Color, Group::Properties, Group::Navigator, Group::History, Group::Layers];
-    let mut l = DockLayout::default();
-    l.set_collapsed(Group::Properties, true);
-    l.set_collapsed(Group::Layers, true);
-    let before = l.heights_for(&shown, 1200.0, 28.0);
-    // History is the filler now; Properties keeps its strip and Layers stays collapsed.
-    let hs = resized(&mut l, &shown, 1200.0, 0, 5000.0);
-    assert_eq!(hs[1].1, 28.0);
-    assert_eq!(hs[4].1, 28.0);
-    assert_eq!(hs[2].1, Group::Navigator.min_height());
-    assert_eq!(hs[3].1, Group::History.min_height());
-    assert_eq!(hs[0].1, before[0].1 + (before[2].1 - Group::Navigator.min_height()) + (before[3].1 - Group::History.min_height()));
-    assert!((total(&hs) - 1200.0).abs() < 1e-3);
-    assert!(!l.heights.contains_key(&Group::History), "the filler's height is never stored");
-    // Dragging up from Navigator over the collapsed Properties shrinks Color.
-    let hs = resized(&mut l, &shown, 1200.0, 2, -5000.0);
-    assert_eq!(hs[0].1, Group::Color.min_height());
-    assert_eq!(hs[1].1, 28.0);
-    assert_eq!(hs[2].1, Group::Navigator.min_height());
-    assert!((total(&hs) - 1200.0).abs() < 1e-3);
-    // Nothing to resize against, bad deltas and out-of-range splitters are ignored.
-    let snapshot = l.clone();
-    for (i, dy) in [(3, 50.0), (4, 50.0), (9, 50.0), (0, f32::NAN), (0, f32::INFINITY), (0, 0.0)] {
-        let hs = l.heights_for(&shown, 1200.0, 28.0);
-        resize(&mut l, &hs, i, dy);
-        assert_eq!(l, snapshot, "splitter {i} by {dy}");
-    }
-}
-
-#[test]
-fn dragging_swatches_down_pushes_properties_then_layers() {
-    let (app, _, _) = app_with_layers();
-    let mut h = harness(app, vec2(1200.0, 800.0), ThemeKind::ProMedium);
-    let color = rect_of(&h, Group::Color);
-    let props = rect_of(&h, Group::Properties);
-    let layers = rect_of(&h, Group::Layers);
-    let room = (props.height() - Group::Properties.min_height()) + (layers.height() - Group::Layers.min_height());
-    let split = Pos2::new(color.center().x, color.bottom() + GAP / 2.0);
-    // Past Properties' minimum: Layers gives way too instead of the drag hard-stopping.
-    let dy = props.height() - Group::Properties.min_height() + 40.0;
-    drag(&mut h, split, split + vec2(0.0, dy));
-    assert!((rect_of(&h, Group::Color).height() - (color.height() + dy)).abs() < 2.0, "{color:?} -> {:?}", rect_of(&h, Group::Color));
-    assert_eq!(rect_of(&h, Group::Properties).height(), Group::Properties.min_height());
-    assert!((rect_of(&h, Group::Layers).height() - (layers.height() - 40.0)).abs() < 2.0);
-    assert_eq!(rect_of(&h, Group::Layers).bottom(), layers.bottom());
-    // All the way: everything below at its minimum.
-    let split = Pos2::new(color.center().x, rect_of(&h, Group::Color).bottom() + GAP / 2.0);
-    drag(&mut h, split, split + vec2(0.0, 2000.0));
-    assert!((rect_of(&h, Group::Color).height() - (color.height() + room)).abs() < 2.0);
-    assert_eq!(rect_of(&h, Group::Layers).height(), Group::Layers.min_height());
-    assert_eq!(rect_of(&h, Group::Layers).bottom(), layers.bottom());
-}
-
 #[test]
 fn reset_workspace_restores_the_default_layout_and_new_workspaces_keep_theirs() {
     let (app, _, _) = app_with_layers();
@@ -314,12 +158,12 @@ fn reset_workspace_restores_the_default_layout_and_new_workspaces_keep_theirs()
     let mine = h.state().ui.dock.clone();
     crate::menus::invoke(h.state_mut(), &ctx, "window.workspace.essentials", json!({})).unwrap();
     h.run_steps(3);
-    let default = last_rects(&h.ctx);
+    let default = drawn(&h).0;
     assert_eq!(h.state().ui.dock, DockLayout::default());
     h.state_mut().ui.dock.heights.insert(Group::Color, 300.0);
     crate::menus::invoke(h.state_mut(), &ctx, "window.workspace.resetWorkspace", json!({})).unwrap();
     h.run_steps(3);
-    assert_eq!(last_rects(&h.ctx), default);
+    assert_eq!(drawn(&h).0, default);
     crate::menus::invoke(h.state_mut(), &ctx, "window.workspace.select", json!({"name": "Tall Layers"})).unwrap();
     assert_eq!(h.state().ui.dock, mine);
 }
@@ -335,15 +179,8 @@ fn a_single_tab_click_expands_a_collapsed_panel() {
             app.session.prefs.edit(|p| p.workspace_locked = true);
             let mut h = harness(app, vec2(1200.0, 800.0), theme);
             let collapsed_height = rect_of(&h, Group::Color).height();
-            let strips = last_strips(&h.ctx);
-            let strip = strips.iter().find(|s| s.group == Group::Color).unwrap();
-            let tab = strip.tabs.iter().find(|(i, _)| *i == tab_index).unwrap().1.center();
-            h.event(egui::Event::PointerMoved(tab));
-            h.run_steps(1);
-            h.event(egui::Event::PointerButton { pos: tab, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-            h.step();
-            h.event(egui::Event::PointerButton { pos: tab, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-            h.run_steps(3);
+            let tab = probe::tab_rect(&h.ctx, panel_id(Group::Color, tab_index, is_pro(theme))).unwrap().center();
+            click(&mut h, tab);
             assert!(!h.state().ui.dock.is_collapsed(Group::Color), "{theme:?}: tab {tab_index}");
             assert_eq!(h.state().ui.dock_tabs.color, tab_index);
             assert!(rect_of(&h, Group::Color).height() > collapsed_height);
@@ -351,134 +188,26 @@ fn a_single_tab_click_expands_a_collapsed_panel() {
     }
 }
 
-/// Auto-Collapse Iconic Panels: a group expanded by clicking a tab on its collapsed strip
-/// closes again when the next click lands outside it; with the preference off it stays open.
-#[test]
-fn auto_collapse_icon_panels_closes_a_peeked_panel_on_an_outside_click() {
-    for auto in [true, false] {
-        let (mut app, _, _) = app_with_layers();
-        app.session.prefs.edit(|p| p.workspace.auto_collapse_icon_panels = auto);
-        app.ui.dock.set_collapsed(Group::Color, true);
-        let mut h = harness(app, vec2(1200.0, 800.0), ThemeKind::ProMedium);
-        let collapsed_height = rect_of(&h, Group::Color).height();
-        let tab = last_strips(&h.ctx).iter().find(|s| s.group == Group::Color).unwrap().tabs[0].1.center();
-        h.event(egui::Event::PointerMoved(tab));
-        h.run_steps(1);
-        h.event(egui::Event::PointerButton { pos: tab, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-        h.step();
-        h.event(egui::Event::PointerButton { pos: tab, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-        h.run_steps(3);
-        assert!(!h.state().ui.dock.is_collapsed(Group::Color), "auto={auto}: the tab click expands the panel");
-        let rect = rect_of(&h, Group::Color);
-        // A click inside the panel leaves it open; one outside (the canvas) closes it again.
-        for p in [rect.center(), Pos2::new(rect.left() / 2.0, rect.center().y)] {
-            h.event(egui::Event::PointerMoved(p));
-            h.run_steps(1);
-            h.event(egui::Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-            h.step();
-            h.event(egui::Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-            h.run_steps(3);
-        }
-        assert_eq!(h.state().ui.dock.is_collapsed(Group::Color), auto, "auto={auto}: outside closes it when enabled");
-        if auto {
-            assert_eq!(rect_of(&h, Group::Color).height(), collapsed_height);
-        } else {
-            assert!(rect_of(&h, Group::Color).height() > collapsed_height);
-        }
-    }
-}
-
-#[test]
-fn double_clicking_a_tab_collapses_and_dragging_a_strip_reorders() {
-    let (app, _, _) = app_with_layers();
-    let mut h = harness(app, vec2(1200.0, 800.0), ThemeKind::ProMedium);
-    let color = rect_of(&h, Group::Color);
-    let tab = color.left_top() + vec2(20.0, 13.0);
-    h.event(egui::Event::PointerMoved(tab));
-    h.run_steps(1);
-    for _ in 0..2 {
-        h.event(egui::Event::PointerButton { pos: tab, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-        h.step();
-        h.event(egui::Event::PointerButton { pos: tab, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-        h.step();
-    }
-    h.run_steps(2);
-    assert!(h.state().ui.dock.is_collapsed(Group::Color));
-    assert!(rect_of(&h, Group::Color).height() < 40.0);
-    h.state_mut().ui.dock.set_collapsed(Group::Color, false);
-    h.run_steps(3);
-    // Drag the Layers tab strip (right of its tabs) above Color.
-    let layers = rect_of(&h, Group::Layers);
-    let strip = Pos2::new(layers.right() - 60.0, layers.top() + 13.0);
-    let to = rect_of(&h, Group::Color).left_top() + vec2(120.0, 10.0);
-    drag(&mut h, strip, to);
-    assert_eq!(h.state().ui.dock.order().first(), Some(&Group::Layers));
-    // A locked workspace keeps the order.
-    h.state_mut().session.prefs.edit(|p| p.workspace_locked = true);
-    let layers = rect_of(&h, Group::Layers);
-    drag(&mut h, Pos2::new(layers.right() - 60.0, layers.top() + 13.0), Pos2::new(layers.right() - 60.0, 790.0));
-    assert_eq!(h.state().ui.dock.order().first(), Some(&Group::Layers));
-}
-
-#[test]
-fn dragging_a_tab_onto_another_group_moves_only_that_panel() {
-    let (app, _, _) = app_with_layers();
-    let mut h = harness(app, vec2(1200.0, 800.0), ThemeKind::ProMedium);
-    let strips = last_strips(&h.ctx);
-    let source = strips
-        .iter()
-        .find(|strip| strip.group == Group::Color)
-        .and_then(|strip| strip.tabs.iter().find(|(index, _)| *index == 1))
-        .map(|(_, rect)| rect.center())
-        .unwrap();
-    let destination = strips.iter().find(|strip| strip.group == Group::Layers).and_then(|strip| strip.tabs.first()).map(|(_, rect)| rect.center()).unwrap();
-
-    drag(&mut h, source, destination);
-
-    let layout = h.state().ui.docking.as_ref().expect("moving one native tab promotes to the shared layout");
-    fn tabs<'a>(node: &'a craft_ui::docking::Node<String>, panel: &str) -> Option<&'a [String]> {
-        match node {
-            craft_ui::docking::Node::Tabs { panels, .. } if panels.iter().any(|id| id == panel) => Some(panels),
-            craft_ui::docking::Node::Split { first, second, .. } => tabs(first, panel).or_else(|| tabs(second, panel)),
-            _ => None,
-        }
-    }
-    let source_group = tabs(layout.root.as_ref().unwrap(), "swatches").unwrap();
-    assert!(source_group.contains(&"layers".to_owned()), "dropped into the destination tab group");
-    assert!(!source_group.contains(&"color".to_owned()), "the source group remains intact");
-    assert!(crate::panel_docking::valid(layout));
-}
-
-/// The strip shows reordered tabs by position; the drop moves the panel that was dragged, not
-/// the one at that position in the default order.
+/// The strip shows reordered tabs in their order; dragging one onto another group moves the
+/// panel that was dragged, and only that panel.
 #[test]
 fn dragging_a_reordered_tab_onto_another_group_moves_that_panel() {
     let (mut app, _, _) = app_with_layers();
     // Gradients (original tab 2) drawn first: Gradients | Color | Swatches | Patterns.
-    app.ui.dock.move_tab(Group::Color, 2, Some(0), true);
+    app.ui.dock.tab_order.insert(Group::Color, vec!["Gradients".into()]);
     let mut h = harness(app, vec2(1200.0, 800.0), ThemeKind::ProMedium);
-    let strips = last_strips(&h.ctx);
-    let source = strips
-        .iter()
-        .find(|strip| strip.group == Group::Color)
-        .and_then(|strip| strip.tabs.iter().find(|(index, _)| *index == 2))
-        .map(|(_, rect)| rect.center())
-        .unwrap();
-    let destination = strips.iter().find(|strip| strip.group == Group::Layers).and_then(|strip| strip.tabs.first()).map(|(_, rect)| rect.center()).unwrap();
+    let tab = |h: &Harness<'static, PhotocraftApp>, panel: &str| probe::tab_rect(&h.ctx, panel).unwrap_or_else(|| panic!("{panel} tab drawn"));
+    assert!(tab(&h, "gradients").left() < tab(&h, "color").left());
+    let (source, destination) = (tab(&h, "gradients").center(), tab(&h, "layers").center());
 
     drag(&mut h, source, destination);
 
-    let layout = h.state().ui.docking.as_ref().expect("moving one native tab promotes to the shared layout");
-    fn tabs<'a>(node: &'a craft_ui::docking::Node<String>, panel: &str) -> Option<&'a [String]> {
-        match node {
-            craft_ui::docking::Node::Tabs { panels, .. } if panels.iter().any(|id| id == panel) => Some(panels),
-            craft_ui::docking::Node::Split { first, second, .. } => tabs(first, panel).or_else(|| tabs(second, panel)),
-            _ => None,
-        }
-    }
-    let moved = tabs(layout.root.as_ref().unwrap(), "gradients").unwrap();
+    assert!(h.state().ui.docking.is_some(), "moving one tab of the default layout customizes the workspace");
+    let moved = probe::group_of(h.state(), "gradients");
     assert!(moved.contains(&"layers".to_owned()), "the dragged Gradients tab joined Layers: {moved:?}");
     assert!(!moved.contains(&"color".to_owned()), "Color stayed in its group: {moved:?}");
+    assert_eq!(probe::group_of(h.state(), "color"), ["color", "swatches", "patterns"]);
+    assert!(crate::panel_docking::valid(&h.state().ui.docking.as_ref().unwrap().layout));
 }
 
 #[test]
@@ -489,12 +218,14 @@ fn tiny_windows_do_not_panic() {
             app.ui.panels.history = true;
             app.ui.panels.navigator = true;
             let mut h = harness(app, vec2(w, ht), theme);
-            for (_, r) in last_rects(&h.ctx) {
+            let (bodies, hits) = drawn(&h);
+            for (_, r) in bodies {
                 assert!(r.height() >= 0.0 && r.is_finite());
             }
             // Drag a splitter way off-screen.
-            if let Some((_, r)) = last_rects(&h.ctx).first().copied() {
-                let p = Pos2::new(r.center().x, r.bottom() + GAP / 2.0);
+            let divider = hits.iter().find(|(hit, _)| matches!(hit, craft_ui::docking::Hit::Divider(craft_ui::docking::Divider::Group(_))));
+            if let Some((_, r)) = divider {
+                let p = r.center();
                 drag(&mut h, p, p + vec2(0.0, 5000.0));
                 drag(&mut h, p, p - vec2(0.0, 5000.0));
             }
@@ -548,8 +279,8 @@ fn clicking_around_the_ui_keeps_the_panels_put() {
     h.run_steps(8);
     let panels = h.state().ui.panels.clone();
     let tabs = h.state().ui.dock_tabs;
-    let rects = last_rects(&h.ctx);
-    assert!(rects.iter().any(|(g, _)| *g == Group::Layers), "{rects:?}");
+    let rects = drawn(&h);
+    assert!(probe::panel_rect(&h.ctx, "layers").is_some(), "{rects:?}");
     let layers = rect_of(&h, Group::Layers);
     let canvas = h.state().last_canvas_rect;
     let mut points: Vec<Pos2> = Vec::new();
@@ -584,7 +315,7 @@ fn clicking_around_the_ui_keeps_the_panels_put() {
         assert_eq!(app.ui.dock_tabs, tabs, "click at {p:?} switched a dock tab");
         assert!(app.ui.dock.collapsed.is_empty(), "click at {p:?} collapsed a group");
         if app.ui.dialogs.is_empty() && app.ui.shell.dialog.is_none() {
-            assert_eq!(last_rects(&h.ctx), rects, "click at {p:?} moved the dock groups");
+            assert_eq!(drawn(&h), rects, "click at {p:?} moved the dock groups");
         }
         h.state_mut().ui.dialogs.clear();
     }
@@ -608,13 +339,8 @@ fn closing_tabs_keeps_stable_names_across_themes_and_workspace_round_trips() {
     assert_eq!(restored.visible_tabs(Group::Color, false).len(), 4);
 }
 
-fn right_click_tab(h: &mut Harness<'static, PhotocraftApp>, group: Group, original_index: usize) {
-    let p = last_strips(&h.ctx)
-        .into_iter()
-        .find(|s| s.group == group)
-        .and_then(|s| s.tabs.into_iter().find(|(i, _)| *i == original_index))
-        .map(|(_, r)| r.center())
-        .unwrap_or_else(|| panic!("requested dock tab visible: {:?}", last_strips(&h.ctx).iter().map(|s| (s.group, s.tabs.clone())).collect::<Vec<_>>()));
+fn right_click_tab(h: &mut Harness<'static, PhotocraftApp>, panel: &str) {
+    let p = probe::tab_rect(&h.ctx, panel).unwrap_or_else(|| panic!("{panel} tab drawn")).center();
     h.hover_at(p);
     h.run_steps(1);
     h.event(egui::Event::PointerButton { pos: p, button: PointerButton::Secondary, pressed: true, modifiers: Modifiers::NONE });
@@ -634,23 +360,24 @@ fn panel_tab_context_menu_closes_one_tab_or_its_group() {
     {
         let pro = is_pro(theme);
         let names = g.tabs(pro);
+        let ids: Vec<&str> = (0..names.len()).map(|i| panel_id(g, i, pro)).collect();
         let (app, _, _) = app_with_layers();
         let mut h = harness(app, vec2(1300.0, 850.0), theme);
         // Close the first tab: the group stays, showing (and selecting) the next one.
-        right_click_tab(&mut h, g, 0);
-        h.get_by_label("Close").click();
+        right_click_tab(&mut h, ids[0]);
+        h.get_by_label("Close Panel").click();
         h.run_steps(3);
         assert!(g.shown(&h.state().ui.panels), "{theme:?}: closing one tab keeps the group");
         assert_eq!(*g.tab_mut(&mut h.state_mut().ui.dock_tabs), 1);
         let rest: Vec<(usize, &str)> = names.iter().copied().enumerate().skip(1).collect();
         assert_eq!(h.state().ui.dock.visible_tabs(g, pro), rest);
-        let strip: Vec<usize> = last_strips(&h.ctx).iter().find(|s| s.group == g).unwrap().tabs.iter().map(|(i, _)| *i).collect();
-        assert_eq!(strip, rest.iter().map(|(i, _)| *i).collect::<Vec<_>>());
+        assert_eq!(probe::group_of(h.state(), ids[1]), ids[1..]);
+        assert!(probe::tab_rect(&h.ctx, ids[0]).is_none());
 
         // Close the remaining tabs: the last one hides this group, not the other dock groups.
-        for i in 1..names.len() {
-            right_click_tab(&mut h, g, i);
-            h.get_by_label("Close").click();
+        for id in &ids[1..] {
+            right_click_tab(&mut h, id);
+            h.get_by_label("Close Panel").click();
             h.run_steps(3);
         }
         assert!(!g.shown(&h.state().ui.panels), "{theme:?}");
@@ -662,12 +389,16 @@ fn panel_tab_context_menu_closes_one_tab_or_its_group() {
         h.run_steps(3);
         assert!(g.shown(&h.state().ui.panels) && !h.state().ui.dock.is_collapsed(g));
         assert_eq!(h.state().ui.dock.visible_tabs(g, pro), vec![(0, names[0])]);
+        assert_eq!(probe::group_of(h.state(), ids[0]), [ids[0]]);
 
-        // A tab's Close Tab Group closes the entire group without hiding its one tab.
-        right_click_tab(&mut h, g, 0);
+        // A tab's Close Tab Group closes the entire group, which Window brings back with its one tab.
+        right_click_tab(&mut h, ids[0]);
         h.get_by_label("Close Tab Group").click();
         h.run_steps(3);
         assert!(!g.shown(&h.state().ui.panels));
+        crate::menus::invoke(h.state_mut(), &ctx, window, json!({})).unwrap();
+        h.run_steps(3);
+        assert_eq!(probe::group_of(h.state(), ids[0]), [ids[0]]);
         assert_eq!(h.state().ui.dock.visible_tabs(g, pro), vec![(0, names[0])]);
     }
 }
@@ -739,7 +470,7 @@ fn theme_switch_keeps_the_selected_color_group_panel() {
             if *name == "Color" {
                 // The spectrum field's hex readout, the same in every theme (#6000).
                 assert!(h.query_by_label("#").is_some(), "{theme:?}: Color field missing");
-                assert!(h.query_by_label("Hue").is_none(), "{theme:?}: no HSB sliders");
+                assert!(h.query_all_by_label("Hue").next().is_none(), "{theme:?}: no HSB sliders");
             }
             h.state_mut().set_theme(&ctx, ThemeKind::Pro);
             h.run_steps(4);
@@ -785,7 +516,7 @@ fn default_layout_shows_ten_layer_rows_at_900pt() {
     for (size, want) in [(vec2(1440.0, 900.0), 10), (vec2(1280.0, 720.0), 4)] {
         let h = app_harness_rows(size, ThemeKind::ProMedium, 40);
         let rows = rows_in_view(&h, 40);
-        let groups = last_rects(&h.ctx);
+        let groups = crate::panel_docking::last_bodies(&h.ctx);
         assert!(rows >= want, "{size:?}: {rows} rows visible, want ≥ {want}: {groups:?}");
         // Color and Properties stay open, just not at the expense of Layers.
         for g in [Group::Color, Group::Properties] {
@@ -794,24 +525,24 @@ fn default_layout_shows_ten_layer_rows_at_900pt() {
     }
 }
 
+/// #147: in a tall column the groups above Layers keep their default heights, and heights the
+/// user set stay as they are in a shorter one.
 #[test]
 fn defaults_give_way_to_layers_but_user_sizes_stay() {
-    let l = DockLayout::default();
-    // A tall column: everyone at their defaults, Layers takes the rest.
-    let hs = l.heights_for(&ESSENTIALS, 1200.0, 28.0);
-    assert_eq!(hs[0].1, Group::Color.default_height());
-    assert_eq!(hs[1].1, Group::Properties.default_height());
-    // A short one: default-sized groups shrink toward their compact heights so Layers keeps
-    // its preferred height, the one nearest Layers first.
-    let hs = l.heights_for(&ESSENTIALS, 820.0, 28.0);
-    assert!(hs[2].1 >= Group::Layers.preferred_fill() - 0.5, "{hs:?}");
-    assert!(hs[1].1 < Group::Properties.default_height() && hs[1].1 >= Group::Properties.compact_height(), "{hs:?}");
-    // Heights the user dragged to (saved in prefs) are kept as they are.
-    let mut mine = DockLayout::default();
-    mine.heights.insert(Group::Properties, 340.0);
-    mine.heights.insert(Group::Color, 200.0);
-    let hs = mine.heights_for(&ESSENTIALS, 800.0, 28.0);
-    assert_eq!((hs[0].1, hs[1].1), (200.0, 340.0), "{hs:?}");
+    let (app, _, _) = app_with_layers();
+    let h = harness(app, vec2(1440.0, 1400.0), ThemeKind::ProMedium);
+    for g in [Group::Color, Group::Properties] {
+        let height = rect_of(&h, g).height();
+        assert!((height - g.default_height()).abs() < 2.0, "{g:?}: {height}");
+    }
+    let (mut app, _, _) = app_with_layers();
+    app.ui.dock.heights.insert(Group::Properties, 340.0);
+    app.ui.dock.heights.insert(Group::Color, 200.0);
+    let h = harness(app, vec2(1440.0, 800.0), ThemeKind::ProMedium);
+    for (g, want) in [(Group::Color, 200.0), (Group::Properties, 340.0)] {
+        let height = rect_of(&h, g).height();
+        assert!((height - want).abs() < 2.0, "{g:?}: {height}");
+    }
 }
 
 /// #150: Window › Character opens a Character | Paragraph group next to Properties (which
@@ -832,7 +563,7 @@ fn window_character_opens_its_own_group_and_keeps_properties() {
             let props = rect_of(&h, Group::Properties);
             assert!(props.height() > 60.0 && props.bottom() <= ch.top(), "{theme:?}: Properties visible above Character");
         }
-        assert!(rect_of(&h, Group::Layers).top() > ch.bottom(), "{theme:?}: Layers stays the filler at the bottom");
+        assert!(rect_of(&h, Group::Layers).top() >= ch.bottom(), "{theme:?}: Layers stays the filler at the bottom");
         assert_eq!(crate::view_cmds::checked(h.state(), "window.panel.character"), Some(true));
         // Paragraph is the group's second tab; choosing it again on its tab closes the group.
         crate::menus::invoke(h.state_mut(), &ctx, "window.panel.paragraph", json!({})).unwrap();
@@ -840,7 +571,7 @@ fn window_character_opens_its_own_group_and_keeps_properties() {
         crate::menus::invoke(h.state_mut(), &ctx, "window.panel.paragraph", json!({})).unwrap();
         h.run_steps(3);
         assert!(!h.state().ui.panels.character && h.state().ui.panels.properties, "{theme:?}");
-        assert!(!last_rects(&h.ctx).iter().any(|(g, _)| *g == Group::Character));
+        assert!(probe::native_group_rect(h.state(), &h.ctx, Group::Character).is_none());
         // Type › Panels › Character Panel always shows it; Reset Workspace closes it.
         crate::menus::invoke(h.state_mut(), &ctx, "type.panels.character", json!({})).unwrap();
         crate::menus::invoke(h.state_mut(), &ctx, "type.panels.character", json!({})).unwrap();
@@ -855,111 +586,6 @@ fn window_character_opens_its_own_group_and_keeps_properties() {
     assert_eq!(moved.order(), vec![Group::Layers, Group::Brushes, Group::Color, Group::Properties, Group::Character, Group::Navigator, Group::History]);
 }
 
-type StripProbe = Option<(Vec<(usize, Rect)>, Rect, Option<Rect>, Rect)>;
-
-/// #151: at narrow widths and 2× scale, in every theme, tabs elide or overflow into a chevron
-/// and never run under the panel menu button.
-#[test]
-fn tab_strips_never_overlap_the_menu_button() {
-    let overlap = |a: Rect, b: Rect| {
-        let i = a.intersect(b);
-        i.width() > 0.5 && i.height() > 0.5
-    };
-    for theme in ThemeKind::ALL {
-        for scale in [1.0, 2.0] {
-            for width in [180.0, 250.0, 290.0, 420.0] {
-                for g in Group::ALL {
-                    let tabs = g.tabs(is_pro(theme));
-                    for sel in 0..tabs.len() {
-                        let mut h = Harness::builder().with_size(vec2(width, 200.0)).with_pixels_per_point(scale).build_ui_state(
-                            move |ui, out: &mut StripProbe| {
-                                if !ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
-                                    return;
-                                }
-                                let mut s = sel;
-                                let r = crate::widgets::card_ex(ui, "t", tabs, &mut s, false, false, |ui, _| {
-                                    ui.label("body");
-                                });
-                                *out = Some((r.tabs, r.menu.rect, r.chevron, ui.max_rect()));
-                            },
-                            None,
-                        );
-                        PhotocraftApp::setup_context(&h.ctx, theme);
-                        h.run_steps(3);
-                        let (shown, menu, chevron, card) = h.state().clone().unwrap();
-                        let what = format!("{theme:?} {scale}x {width}pt {g:?} selected {sel}");
-                        assert!(shown.iter().any(|(i, _)| *i == sel), "{what}: the selected tab is on the strip: {shown:?}");
-                        for (i, r) in &shown {
-                            assert!(!overlap(*r, menu), "{what}: tab {i} {r:?} runs under the menu {menu:?}");
-                            assert!(r.left() >= card.left() - 0.5 && r.right() <= card.right() + 0.5, "{what}: tab {i} outside the card");
-                        }
-                        for w in shown.windows(2) {
-                            assert!(!overlap(w[0].1, w[1].1), "{what}: tabs overlap");
-                        }
-                        if let Some(c) = chevron {
-                            assert!(!overlap(c, menu) && shown.iter().all(|(_, r)| !overlap(*r, c)), "{what}: chevron overlaps");
-                        } else {
-                            assert_eq!(shown.len(), tabs.len(), "{what}: a tab went missing without a chevron");
-                        }
-                    }
-                }
-            }
-        }
-    }
-}
-
-/// #151 in the real dock: every strip at 2× scale fits beside its menu button, and a tab in the
-/// chevron menu can still be chosen.
-#[test]
-fn dock_strips_fit_and_the_chevron_menu_switches_tabs() {
-    for theme in ThemeKind::ALL {
-        let (mut app, _, _) = app_with_layers();
-        app.ui.panels.history = true;
-        app.ui.panels.navigator = true;
-        app.ui.panels.character = true;
-        let mut h = Harness::builder().with_size(vec2(900.0, 1000.0)).with_pixels_per_point(2.0).build_ui_state(
-            |ui, app: &mut PhotocraftApp| {
-                if !ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
-                    return;
-                }
-                crate::panels::right_dock(app, ui);
-                egui::CentralPanel::default().show(ui, |_| {});
-            },
-            app,
-        );
-        PhotocraftApp::setup_context(&h.ctx, theme);
-        h.state_mut().ui.theme = theme;
-        h.run_steps(4);
-        let strips = last_strips(&h.ctx);
-        assert!(strips.len() >= 5, "{theme:?}: {strips:?}");
-        for s in &strips {
-            for (i, r) in &s.tabs {
-                assert!(r.intersect(s.menu).width() <= 0.5, "{theme:?} {:?}: tab {i} under the menu", s.group);
-            }
-        }
-    }
-    // A strip too narrow for its tabs: pick a hidden tab from the chevron menu.
-    let mut h = Harness::builder().with_size(vec2(150.0, 200.0)).build_ui_state(
-        |ui, sel: &mut usize| {
-            if !ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
-                return;
-            }
-            let _ = crate::widgets::card_ex(ui, "color", &["Color", "Swatches", "Gradients", "Patterns"], sel, false, false, |ui, _| {
-                ui.label("body");
-            });
-        },
-        0usize,
-    );
-    PhotocraftApp::setup_context(&h.ctx, ThemeKind::ProMedium);
-    h.run_steps(3);
-    use egui_kittest::kittest::Queryable;
-    h.get_by_label("More panels").click();
-    h.run_steps(3);
-    h.get_by_label("Patterns").click();
-    h.run_steps(3);
-    assert_eq!(*h.state(), 3, "Patterns chosen from the chevron menu");
-}
-
 #[test]
 fn tab_hides_all_panels_and_shift_tab_only_the_dock() {
     // #1313: Photoshop's Tab hides the Tools panel, the options bar and the panel dock (Tab again
@@ -1076,14 +702,6 @@ fn navigator_preview_fills_its_group_and_keeps_aspect() {
     }
 }
 
-fn strip_tabs(h: &Harness<'static, PhotocraftApp>, g: Group) -> Vec<(usize, Rect)> {
-    last_strips(&h.ctx).into_iter().find(|s| s.group == g).map(|s| s.tabs).unwrap_or_else(|| panic!("{g:?} strip not drawn"))
-}
-
-fn tab_rect(h: &Harness<'static, PhotocraftApp>, g: Group, tab: usize) -> Rect {
-    strip_tabs(h, g).into_iter().find(|(i, _)| *i == tab).map(|(_, r)| r).unwrap_or_else(|| panic!("{g:?} tab {tab} not on the strip"))
-}
-
 fn click(h: &mut Harness<'static, PhotocraftApp>, p: Pos2) {
     h.event(egui::Event::PointerMoved(p));
     h.run_steps(1);
@@ -1094,22 +712,13 @@ fn click(h: &mut Harness<'static, PhotocraftApp>, p: Pos2) {
 }
 
 #[test]
-fn move_tab_reorders_by_name_and_bad_saved_orders_fall_back() {
+fn tab_order_is_by_name_and_bad_saved_orders_fall_back() {
     let mut l = DockLayout::default();
     let names = |l: &DockLayout, g, pro| l.visible_tabs(g, pro).into_iter().map(|(_, n)| n).collect::<Vec<_>>();
-    l.move_tab(Group::Layers, 2, Some(0), true);
+    l.tab_order.insert(Group::Layers, vec!["Paths".into()]);
     assert_eq!(l.visible_tabs(Group::Layers, true), vec![(2, "Paths"), (0, "Layers"), (1, "Channels")]);
-    l.move_tab(Group::Layers, 2, None, true);
-    assert_eq!(names(&l, Group::Layers, true), ["Layers", "Channels", "Paths"]);
-    assert!(l.tab_order.is_empty(), "the default order is stored as nothing");
-    // Out-of-range tabs and moves onto themselves change nothing; an unknown `before` is last.
-    for (tab, before) in [(9, Some(0)), (usize::MAX, None), (1, Some(1)), (2, Some(9))] {
-        let mut m = l.clone();
-        m.move_tab(Group::Layers, tab, before, true);
-        assert_eq!(names(&m, Group::Layers, true), ["Layers", "Channels", "Paths"], "{tab} {before:?}");
-    }
     // Names, not positions: the order survives the Pro/Studio swap of Color and Swatches.
-    l.move_tab(Group::Color, 3, Some(0), true);
+    l.tab_order.insert(Group::Color, vec!["Patterns".into(), "Color".into()]);
     assert_eq!(names(&l, Group::Color, true), ["Patterns", "Color", "Swatches", "Gradients"]);
     assert_eq!(names(&l, Group::Color, false), ["Patterns", "Color", "Swatches", "Gradients"]);
     // Hidden tabs keep their place for when they come back.
@@ -1135,42 +744,29 @@ fn move_tab_reorders_by_name_and_bad_saved_orders_fall_back() {
     assert_eq!(names(&back, Group::Layers, true), ["Channels", "Layers", "Paths"], "missing tabs follow in their default order");
 }
 
-/// #2272: dragging a tab along its strip reorders the group's tabs; the order persists in the
-/// UI state, the remembered layout and saved workspaces, and clicking still selects.
+/// #2272: a tab dragged along its strip reorders the group's tabs; the order persists in the
+/// remembered layout and saved workspaces, and clicking still selects.
 #[test]
 fn dragging_a_tab_reorders_the_group_and_the_order_persists() {
     for theme in [ThemeKind::ProMedium, ThemeKind::Studio] {
         let (app, _, _) = app_with_layers();
         let mut h = harness(app, vec2(1200.0, 800.0), theme);
-        let order = h.state().ui.dock.order();
-        let rects = last_rects(&h.ctx);
-        let paths = tab_rect(&h, Group::Layers, 2);
-        let layers = tab_rect(&h, Group::Layers, 0);
-        drag(&mut h, paths.center(), layers.left_center() + vec2(4.0, 0.0));
-        let strip: Vec<usize> = strip_tabs(&h, Group::Layers).iter().map(|(i, _)| *i).collect();
-        assert_eq!(strip, [2, 0, 1], "{theme:?}: Paths moved before Layers");
-        assert_eq!(h.state().ui.dock.order(), order, "{theme:?}: a tab drag along the strip leaves the groups put");
-        assert_eq!(last_rects(&h.ctx), rects);
-        // The dragged tab is brought to the front; dockTabs keeps its original indices.
-        assert_eq!(h.state().ui.dock_tabs.layers, 2, "{theme:?}");
+        let tab = |h: &Harness<'static, PhotocraftApp>, panel: &str| probe::tab_rect(&h.ctx, panel).unwrap_or_else(|| panic!("{panel} tab drawn"));
+        let others = |h: &Harness<'static, PhotocraftApp>| probe::group_of(h.state(), "color");
+        let color = others(&h);
+        let (paths, layers) = (tab(&h, "paths"), tab(&h, "layers"));
+        drag(&mut h, paths.center(), layers.left_center() + vec2(layers.width() / 4.0, 0.0));
+        assert_eq!(probe::group_of(h.state(), "layers"), ["paths", "layers", "channels"], "{theme:?}: Paths moved before Layers");
+        assert_eq!(others(&h), color, "{theme:?}: a tab drag along the strip leaves the other groups put");
+        assert_eq!(h.state().ui.dock_tabs.layers, 2, "{theme:?}: the dragged tab is selected");
 
         // A plain click still selects, and selects the tab under the pointer.
-        let layers = tab_rect(&h, Group::Layers, 0).center();
+        let layers = tab(&h, "layers").center();
         click(&mut h, layers);
         assert_eq!(h.state().ui.dock_tabs.layers, 0, "{theme:?}");
-        assert_eq!(strip_tabs(&h, Group::Layers).iter().map(|(i, _)| *i).collect::<Vec<_>>(), [2, 0, 1]);
+        assert_eq!(probe::group_of(h.state(), "layers"), ["paths", "layers", "channels"]);
 
-        // UI state round trip (the control channel's ui.get / ui.set).
-        let dock = serde_json::to_value(&h.state().ui.dock).unwrap();
-        assert_eq!(dock["tabOrder"], json!({"layers": ["Paths", "Layers", "Channels"]}));
         let ctx = h.ctx.clone();
-        let (req, _rx) = crate::control::ControlRequest::new("ui.set", json!({"dock": {"tabOrder": {"layers": ["Channels"]}}}));
-        crate::control::handle(h.state_mut(), &ctx, &req);
-        assert_eq!(h.state().ui.dock.visible_tabs(Group::Layers, is_pro(theme))[0], (1, "Channels"));
-        let (req, _rx) = crate::control::ControlRequest::new("ui.set", json!({"dock": dock}));
-        crate::control::handle(h.state_mut(), &ctx, &req);
-        assert_eq!(h.state().ui.dock.visible_tabs(Group::Layers, is_pro(theme))[0], (2, "Paths"));
-
         // Remembered across launches (prefs panelLayout) ...
         h.state_mut().session.prefs.edit(|p| p.workspace.remember_workspace_changes = true);
         persist(h.state_mut(), &ctx);
@@ -1181,42 +777,19 @@ fn dragging_a_tab_reorders_the_group_and_the_order_persists() {
             p.panel_layout = saved.clone();
         });
         restore(&mut fresh);
-        assert_eq!(fresh.ui.dock.visible_tabs(Group::Layers, is_pro(theme))[0], (2, "Paths"), "{theme:?}");
+        assert_eq!(probe::group_of(&fresh, "layers"), ["paths", "layers", "channels"], "{theme:?}");
 
         // ... and in a saved workspace, which Essentials resets and selecting brings back.
         crate::menus::invoke(h.state_mut(), &ctx, "window.workspace.newWorkspace", json!({"name": "Paths First"})).unwrap();
         crate::menus::invoke(h.state_mut(), &ctx, "window.workspace.essentials", json!({})).unwrap();
-        assert!(h.state().ui.dock.tab_order.is_empty());
+        assert_eq!(probe::group_of(h.state(), "layers"), ["layers", "channels", "paths"]);
         crate::menus::invoke(h.state_mut(), &ctx, "window.workspace.select", json!({"name": "Paths First"})).unwrap();
         h.run_steps(3);
-        assert_eq!(strip_tabs(&h, Group::Layers).iter().map(|(i, _)| *i).collect::<Vec<_>>(), [2, 0, 1], "{theme:?}");
+        assert_eq!(probe::group_of(h.state(), "layers"), ["paths", "layers", "channels"], "{theme:?}");
+        assert!(tab(&h, "paths").left() < tab(&h, "layers").left());
     }
 }
 
-/// Dragging a tab onto another group's body moves the whole group; onto its tab strip moves only
-/// the tab. A locked workspace keeps both the tab and group order.
-#[test]
-fn a_tab_dragged_off_the_strip_moves_the_group_and_locking_stops_reordering() {
-    let (app, _, _) = app_with_layers();
-    let mut h = harness(app, vec2(1200.0, 800.0), ThemeKind::ProMedium);
-    let paths = tab_rect(&h, Group::Layers, 2);
-    let to = rect_of(&h, Group::Color).left_top() + vec2(120.0, 40.0);
-    drag(&mut h, paths.center(), to);
-    assert_eq!(h.state().ui.dock.order().first(), Some(&Group::Layers));
-    assert!(h.state().ui.dock.tab_order.is_empty(), "the tabs kept their order");
-
-    h.state_mut().session.prefs.edit(|p| p.workspace_locked = true);
-    h.run_steps(2);
-    let order = h.state().ui.dock.order();
-    let paths = tab_rect(&h, Group::Layers, 2);
-    let layers = tab_rect(&h, Group::Layers, 0).left_center();
-    drag(&mut h, paths.center(), layers + vec2(4.0, 0.0));
-    assert!(h.state().ui.dock.tab_order.is_empty());
-    let paths = tab_rect(&h, Group::Layers, 2);
-    drag(&mut h, paths.center(), paths.center() + vec2(0.0, 500.0));
-    assert_eq!(h.state().ui.dock.order(), order);
-}
-
 #[test]
 fn brush_settings_window_is_closed_on_restart_but_can_be_reopened() {
     let mut first = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
@@ -1245,6 +818,23 @@ fn brush_settings_window_is_closed_on_restart_but_can_be_reopened() {
     assert!(workspace.ui.panels.brush_settings, "switching workspaces still restores their saved layout");
 }
 
+/// The saved `docking` value is the app's own serialization of `craft_ui::docking::Layout`. A
+/// value from an older/foreign docking schema that no longer deserializes is dropped (the
+/// legacy layout is rebuilt); the rest of the workspace still applies, and nothing panics.
+/// Panel widths still migrate separately through `panels::migrate_panel_state`, but a split/tab
+/// arrangement from such a schema may reset. No 0.36 sample was available to prove the actual
+/// transition.
+#[test]
+fn an_unreadable_docking_layout_is_dropped_and_the_rest_applies() {
+    let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+    let mut saved = snapshot(&app);
+    saved["docking"] = json!({"root": "not-a-dock-node"});
+    saved["timelineOpen"] = json!(true);
+    apply(&mut app, &saved);
+    assert!(app.ui.docking.is_none(), "the unreadable docking value is dropped");
+    assert!(app.ui.timeline.open, "the rest of the layout still applies");
+}
+
 /// Layers panel options live in the preferences on their own (like Photoshop's Panel Options),
 /// so a workspace layout neither saves nor restores them.
 #[test]
@@ -1265,3 +855,46 @@ fn workspace_layouts_leave_the_layers_panel_options_alone() {
     assert_ne!(app.ui.layers_panel_options.thumbnail_size, crate::state::LayerThumbnailSize::Large);
     assert_eq!(app.session.prefs().dialogs.get("ui.layersPanelOptions").cloned(), stored);
 }
+
+#[test]
+fn a_panel_window_the_os_moves_is_saved_once_it_keeps_still() {
+    let (mut app, _, _) = app_with_layers();
+    app.session.prefs.edit(|p| p.workspace.remember_workspace_changes = true);
+    app.run("window.panel.float", json!({"panel": "info"})).unwrap();
+    let ctx = egui::Context::default();
+    let frame = |app: &mut PhotocraftApp| ctx.run_ui(Default::default(), |ui| persist(app, ui.ctx())).textures_delta.clear();
+    let place = |app: &mut PhotocraftApp, x: f32| {
+        let window = app.ui.docking.as_mut().unwrap().layout.floating.iter_mut().find(|w| w.contains("info")).unwrap();
+        window.native = Some([x, 100.0, 300.0, 200.0]);
+    };
+    frame(&mut app);
+    let saved = app.session.prefs().panel_layout.clone();
+    for x in 500..520 {
+        place(&mut app, x as f32);
+        frame(&mut app);
+        assert_eq!(app.session.prefs().panel_layout, saved, "not saved while the window moves");
+    }
+    frame(&mut app);
+    let native = app.session.prefs().panel_layout["docking"]["layout"]["floating"][0]["native"].clone();
+    assert_eq!(native, json!([519.0, 100.0, 300.0, 200.0]), "saved once it keeps still");
+}
+
+#[test]
+fn a_workspace_from_a_newer_version_shows_the_default_and_stays_saved() {
+    let (mut app, _, _) = app_with_layers();
+    app.session.prefs.edit(|p| p.workspace.remember_workspace_changes = true);
+    let mut saved = snapshot(&app);
+    saved["docking"] = json!({"version": 99, "layout": {"root": null, "floating": []}, "future": true});
+    app.session.prefs.edit(|p| p.panel_layout = saved.clone());
+    restore(&mut app);
+    assert!(app.ui.docking.is_none(), "the default layout shows");
+    let ctx = egui::Context::default();
+    let frame = |app: &mut PhotocraftApp| ctx.run_ui(Default::default(), |ui| persist(app, ui.ctx())).textures_delta.clear();
+    frame(&mut app);
+    assert_eq!(app.session.prefs().panel_layout, saved, "an idle frame leaves it saved");
+
+    app.run("window.panel.close", json!({"panel": "layers"})).unwrap();
+    frame(&mut app);
+    let docking = &app.session.prefs().panel_layout["docking"];
+    assert_eq!(docking["version"], json!(craft_ui::docking::Workspace::<String>::VERSION), "a changed layout replaces it: {docking}");
+}
diff --git a/crates/ui-egui/src/duplicate_layer_ui.rs b/crates/ui-egui/src/duplicate_layer_ui.rs
index c1b76c0ead..3d9b0edc8f 100644
--- a/crates/ui-egui/src/duplicate_layer_ui.rs
+++ b/crates/ui-egui/src/duplicate_layer_ui.rs
@@ -48,21 +48,21 @@ pub fn body(app: &PhotocraftApp, ui: &mut egui::Ui, fields: &mut Map<String, Val
     egui::Grid::new("duplicate-layer").num_columns(2).spacing([12.0, 6.0]).show(ui, |ui| {
         if let Some(name) = fields.get("name").and_then(Value::as_str) {
             let mut name = name.to_string();
-            ui.label(tl!("Name:"));
-            ui.add(egui::TextEdit::singleline(&mut name).desired_width(260.0));
+            let name_label = ui.label(tl!("Name:"));
+            ui.add(egui::TextEdit::singleline(&mut name).desired_width(260.0)).labelled_by(name_label.id);
             fields.insert("name".into(), json!(name));
             ui.end_row();
         }
         ui.label(egui::RichText::new(tl!("Destination")).font(crate::theme::semibold(13.0)));
         ui.end_row();
         ui.label(tl!("Document"));
-        crate::widgets::dropdown(ui, "duplicate-layer-document", &mut destination, &options, 260.0);
+        crate::widgets::dropdown(ui, "duplicate-layer-document", tl!("Document"), &mut destination, &options, 260.0);
         ui.end_row();
         // Photoshop's document-`Name` is only there when the destination is a new document.
         if destination == "new" {
             let mut doc_name = fields.get("documentName").and_then(Value::as_str).unwrap_or("").to_string();
-            ui.label(tl!("Name:"));
-            ui.add(egui::TextEdit::singleline(&mut doc_name).desired_width(260.0));
+            let name_label = ui.label(tl!("Name:"));
+            ui.add(egui::TextEdit::singleline(&mut doc_name).desired_width(260.0)).labelled_by(name_label.id);
             fields.insert("documentName".into(), json!(doc_name));
             ui.end_row();
         }
diff --git a/crates/ui-egui/src/egui_fonts.rs b/crates/ui-egui/src/egui_fonts.rs
index 4c71705e64..ecd121c05f 100644
--- a/crates/ui-egui/src/egui_fonts.rs
+++ b/crates/ui-egui/src/egui_fonts.rs
@@ -1,5 +1,5 @@
-//! egui's default fonts (Ubuntu Light, Hack, Noto Emoji and emoji-icon-font: the fallback stack
-//! behind Inter and JetBrains Mono, for symbols and emoji), stored deflated.
+//! egui's default fonts (Ubuntu Light, Hack, egui-icons, Noto Emoji and emoji-icon-font: the
+//! fallback stack behind Inter and JetBrains Mono, for symbols and emoji), stored deflated.
 //!
 //! egui's `default_fonts` feature embeds them uncompressed (1.4 MB), which the web build's 24 MiB
 //! size gate (packaging/web/package.sh) can't afford. The app builds egui without it; build.rs
@@ -19,6 +19,7 @@ macro_rules! deflated {
 }
 
 static HACK: LazyLock<Vec<u8>> = LazyLock::new(|| inflate(deflated!("Hack-Regular")));
+static EGUI_ICONS: LazyLock<Vec<u8>> = LazyLock::new(|| inflate(deflated!("egui-icons")));
 static NOTO_EMOJI: LazyLock<Vec<u8>> = LazyLock::new(|| inflate(deflated!("NotoEmoji-Regular")));
 static UBUNTU_LIGHT: LazyLock<Vec<u8>> = LazyLock::new(|| inflate(deflated!("Ubuntu-Light")));
 static EMOJI_ICON: LazyLock<Vec<u8>> = LazyLock::new(|| inflate(deflated!("emoji-icon-font")));
@@ -46,11 +47,13 @@ pub fn definitions() -> FontDefinitions {
 /// egui's default definitions, built from the deflated copies.
 fn from_deflated() -> FontDefinitions {
     let mut fonts = FontDefinitions::empty();
-    let faces: [(&str, &'static [u8], f32); 4] = [
+    let faces: [(&str, &'static [u8], f32); 5] = [
         ("Hack", HACK.as_slice(), 1.0),
+        ("Ubuntu-Light", UBUNTU_LIGHT.as_slice(), 1.0),
+        // The handful of icons in `egui::special_emojis`, which no platform font has.
+        ("egui-icons", EGUI_ICONS.as_slice(), 0.90),
         // egui draws its emoji fonts a little smaller.
         ("NotoEmoji-Regular", NOTO_EMOJI.as_slice(), 0.81),
-        ("Ubuntu-Light", UBUNTU_LIGHT.as_slice(), 1.0),
         ("emoji-icon-font", EMOJI_ICON.as_slice(), 0.90),
     ];
     for (name, bytes, scale) in faces {
@@ -62,8 +65,9 @@ fn from_deflated() -> FontDefinitions {
         fonts.font_data.insert(name.to_owned(), Arc::new(data));
     }
     let stack = |names: &[&str]| -> Vec<String> { names.iter().filter(|n| fonts.font_data.contains_key(**n)).map(|n| (*n).to_owned()).collect() };
-    let mono = stack(&["Hack", "Ubuntu-Light", "NotoEmoji-Regular", "emoji-icon-font"]);
-    let proportional = stack(&["Ubuntu-Light", "NotoEmoji-Regular", "emoji-icon-font"]);
+    // 0.37's family order: egui-icons and the monochrome emoji fonts last, as fallbacks.
+    let mono = stack(&["Hack", "Ubuntu-Light", "egui-icons", "NotoEmoji-Regular", "emoji-icon-font"]);
+    let proportional = stack(&["Ubuntu-Light", "egui-icons", "NotoEmoji-Regular", "emoji-icon-font"]);
     fonts.families.insert(FontFamily::Monospace, mono);
     fonts.families.insert(FontFamily::Proportional, proportional);
     fonts
@@ -83,6 +87,32 @@ mod tests {
         assert_eq!(definitions(), egui);
     }
 
+    /// The deflated stack carries egui 0.37's `egui-icons` face and the monochrome emoji faces,
+    /// so `egui::special_emojis` and the UI's symbol glyphs do not render as tofu (kittest's
+    /// `MissingGlyphPolicy::Panic` depends on this).
+    #[test]
+    fn the_deflated_stack_draws_egui_icons() {
+        let ctx = egui::Context::default();
+        ctx.set_fonts(from_deflated());
+        let mut output = ctx.run_ui(Default::default(), |_| {});
+        // The headless test never uploads the atlas; drop its delta deliberately.
+        output.textures_delta.clear();
+        let id = egui::FontId::proportional(14.0);
+        let icons: String = [
+            egui::special_emojis::OS_LINUX,
+            egui::special_emojis::OS_WINDOWS,
+            egui::special_emojis::OS_ANDROID,
+            egui::special_emojis::OS_APPLE,
+            egui::special_emojis::GITHUB,
+            egui::special_emojis::GIT,
+        ]
+        .into_iter()
+        .collect();
+        assert!(ctx.fonts_mut(|f| f.has_glyphs(&id, &icons)), "egui-icons covers every special emoji");
+        let mono = egui::FontId::monospace(14.0);
+        assert!(ctx.fonts_mut(|f| f.has_glyphs(&mono, &icons)), "and the monospace family too");
+    }
+
     #[test]
     fn corrupt_font_data_is_left_out_not_a_panic() {
         assert!(inflate(b"not deflate data").is_empty());
diff --git a/crates/ui-egui/src/eraser_ui.rs b/crates/ui-egui/src/eraser_ui.rs
index f92c3427e9..ac896eeb0b 100644
--- a/crates/ui-egui/src/eraser_ui.rs
+++ b/crates/ui-egui/src/eraser_ui.rs
@@ -81,12 +81,13 @@ pub fn block_size(app: &PhotocraftApp) -> f32 {
 pub fn mode_dropdown(ui: &mut egui::Ui, mode: &mut String) -> bool {
     opt(ui, tl!("Mode:"));
     let modes = [("brush".to_string(), tl!("Brush")), ("pencil".to_string(), tl!("Pencil")), ("block".to_string(), tl!("Block"))];
-    widgets::dropdown(ui, "eraser-mode", mode, &modes, 96.0)
+    widgets::dropdown(ui, "eraser-mode", tl!("Mode"), mode, &modes, 96.0)
 }
 
 fn opt(ui: &mut egui::Ui, text: &str) {
     let t = Tokens::get(ui.ctx());
-    ui.label(egui::RichText::new(tl!(&text)).color(t.text_dim).size(12.0));
+    let label = ui.label(egui::RichText::new(tl!(&text)).color(t.text_dim).size(12.0));
+    crate::widgets::scrub_option_label(ui, &label);
 }
 
 /// Options bar for the Magic Eraser and Background Eraser. Returns false for other tools.
@@ -123,7 +124,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
                 ("contiguous".to_string(), tl!("Contiguous")),
                 ("findEdges".to_string(), tl!("Find Edges")),
             ];
-            widgets::dropdown(ui, "bg-eraser-limits", &mut o.bg_limits, &limits, 110.0);
+            widgets::dropdown(ui, "bg-eraser-limits", tl!("Limits:"), &mut o.bg_limits, &limits, 110.0);
             opt(ui, tl!("Tolerance:"));
             widgets::value_field(ui, &mut o.bg_tolerance, 0.0..=100.0, "%", 62.0);
             widgets::checkbox(ui, &mut o.bg_protect_fg, tl!("Protect Foreground Color"));
diff --git a/crates/ui-egui/src/export_dialog.rs b/crates/ui-egui/src/export_dialog.rs
index 29ee74b1aa..c014947aa3 100644
--- a/crates/ui-egui/src/export_dialog.rs
+++ b/crates/ui-egui/src/export_dialog.rs
@@ -533,7 +533,7 @@ fn poll_or_start_preview(
     doc: Arc<Document>,
     fields: &Map<String, Value>,
 ) -> Option<Result<PreviewPixels, String>> {
-    let pending_key = egui::Id::new(("export-preview-pending", doc.id.0));
+    let pending_key = egui::Id::unique(("export-preview-pending", doc.id.0));
     let pending: Option<PendingPreview> = ui.data(|d| d.get_temp(pending_key));
     if let Some(pending) = pending {
         let result = pending.result.lock().unwrap_or_else(std::sync::PoisonError::into_inner).take()?;
@@ -659,7 +659,7 @@ fn size_fields(ui: &mut egui::Ui, f: &mut Map<String, Value>, src_w: f64, src_h:
     let mut sc = passed as f32;
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(tl!("Scale")).color(t.text_dim));
-        crate::widgets::value_field(ui, &mut sc, 1.0..=1000.0, "%", 70.0);
+        crate::widgets::value_field(ui, &mut sc, 1.0..=1000.0, "%", 70.0).accessible_name(tl!("Scale"));
     });
     let sc_r = f64::from(sc).round().clamp(1.0, 1000.0);
     if (sc_r - passed).abs() > 0.01
@@ -672,7 +672,7 @@ fn size_fields(ui: &mut egui::Ui, f: &mut Map<String, Value>, src_w: f64, src_h:
     let mut width = stored_w.clamp(1.0, MAX_PX) as f32;
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(tl!("Width")).color(t.text_dim));
-        crate::widgets::value_field(ui, &mut width, 1.0..=MAX_PX as f32, "px", 70.0);
+        crate::widgets::value_field(ui, &mut width, 1.0..=MAX_PX as f32, "px", 70.0).accessible_name(tl!("Width"));
     });
     let width_r = f64::from(width).round();
     if (width_r - stored_w.round()).abs() > 0.01
@@ -684,7 +684,7 @@ fn size_fields(ui: &mut egui::Ui, f: &mut Map<String, Value>, src_w: f64, src_h:
     let mut height = stored_h.clamp(1.0, MAX_PX) as f32;
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(tl!("Height")).color(t.text_dim));
-        crate::widgets::value_field(ui, &mut height, 1.0..=MAX_PX as f32, "px", 70.0);
+        crate::widgets::value_field(ui, &mut height, 1.0..=MAX_PX as f32, "px", 70.0).accessible_name(tl!("Height"));
     });
     let height_r = f64::from(height).round();
     if (height_r - stored_h.round()).abs() > 0.01
@@ -709,7 +709,7 @@ fn resample_field(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
         ui.label(egui::RichText::new(tl!("Resample")).color(t.text_dim));
         let mut method = resample_method(f, None).unwrap_or(DEFAULT_RESAMPLE).to_string();
         let opts: Vec<(String, &str)> = RESAMPLE.iter().map(|(k, label)| ((*k).to_string(), resample_label(label))).collect();
-        if crate::widgets::dropdown(ui, "export-resample", &mut method, &opts, 130.0) {
+        if crate::widgets::dropdown(ui, "export-resample", tl!("Resample"), &mut method, &opts, 130.0) {
             f.insert("resample".into(), json!(method));
         }
     });
@@ -788,7 +788,7 @@ fn preset_fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String,
             for name in &names {
                 opts.push((name.clone(), name.as_str()));
             }
-            if crate::widgets::dropdown(ui, "export-preset", &mut selected, &opts, 130.0) {
+            if crate::widgets::dropdown(ui, "export-preset", tl!("Preset"), &mut selected, &opts, 130.0) {
                 f.insert("__preset".into(), json!(selected));
                 if let Some(preset) = app.session.presets.export_presets.iter().find(|p| p.name == s(f, "__preset")).cloned() {
                     apply_preset(f, &preset.settings, src_w, src_h);
@@ -858,7 +858,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                 ui.label(egui::RichText::new(tl!("Format")).color(t.text_dim));
                 let mut fmt = s_fmt(f);
                 let opts: Vec<(String, &str)> = FORMATS.iter().map(|(k, l)| (k.to_string(), *l)).collect();
-                if crate::widgets::dropdown(ui, "export-format", &mut fmt, &opts, 130.0) {
+                if crate::widgets::dropdown(ui, "export-format", tl!("Format"), &mut fmt, &opts, 130.0) {
                     set_format_defaults(f, &fmt, &app.session.prefs().export);
                 }
             });
@@ -879,7 +879,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                     let mut bits = s(f, "tgaBits");
                     let opts: Vec<(String, &str)> =
                         vec![("auto".into(), tl!("Auto")), ("24".into(), tl!("24 bits/pixel")), ("32".into(), tl!("32 bits/pixel"))];
-                    if crate::widgets::dropdown(ui, "export-tga-bits", &mut bits, &opts, 130.0) {
+                    if crate::widgets::dropdown(ui, "export-tga-bits", tl!("Depth"), &mut bits, &opts, 130.0) {
                         f.insert("tgaBits".into(), json!(bits));
                     }
                 });
@@ -893,7 +893,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                 ui.label(egui::RichText::new(tl!("Metadata")).color(t.text_dim));
                 let mut m = s(f, "metadata");
                 let opts: Vec<(String, &str)> = vec![("none".into(), tl!("None")), ("exif".into(), tl!("EXIF")), ("all".into(), tl!("All"))];
-                if crate::widgets::dropdown(ui, "export-metadata", &mut m, &opts, 130.0) {
+                if crate::widgets::dropdown(ui, "export-metadata", tl!("Metadata"), &mut m, &opts, 130.0) {
                     f.insert("metadata".into(), json!(m));
                 }
             });
@@ -904,7 +904,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                     profile = "document".into();
                 }
                 let opts: Vec<(String, &str)> = vec![("document".into(), tl!("Document Profile")), ("srgb".into(), tl!("Convert to sRGB"))];
-                if crate::widgets::dropdown(ui, "export-profile", &mut profile, &opts, 130.0) {
+                if crate::widgets::dropdown(ui, "export-profile", tl!("Color Profile"), &mut profile, &opts, 130.0) {
                     f.insert("profile".into(), json!(profile));
                 }
             });
@@ -927,7 +927,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
         // Right: preview + estimated size.
         ui.vertical(|ui| {
             let layer = f.get("__layer").and_then(Value::as_u64);
-            let key = egui::Id::new(("export-preview", doc.id.0, app.session.active().map_or(0, |s| s.revision), layer));
+            let key = egui::Id::unique(("export-preview", doc.id.0, app.session.active().map_or(0, |s| s.revision), layer));
             let sig = format!(
                 "{}{}{}{}{}{}{}{}{}{}{}{}{}",
                 s_fmt(f),
@@ -1423,7 +1423,7 @@ mod tests {
         assert!((old as f64 / actual as f64 - 1.0).abs() > 0.1, "the proxy estimate was off: {old} vs {actual}");
 
         let ctx = egui::Context::default();
-        let key = egui::Id::new("exact-estimate-test");
+        let key = egui::Id::unique("exact-estimate-test");
         let deadline = std::time::Instant::now() + std::time::Duration::from_secs(20);
         let size = loop {
             let mut size = None;
@@ -1562,7 +1562,7 @@ mod tests {
         assert!(background_preview_needed(&doc));
         let fields = Map::from_iter([("format".into(), json!("png")), ("scale".into(), json!(100))]);
         let ctx = egui::Context::default();
-        let key = egui::Id::new("layered-preview-test");
+        let key = egui::Id::unique("layered-preview-test");
         let mut result = None;
         let mut output = ctx.run_ui(Default::default(), |ctx| {
             egui::CentralPanel::default().show(ctx, |ui| {
diff --git a/crates/ui-egui/src/eyedropper_ui.rs b/crates/ui-egui/src/eyedropper_ui.rs
index 4b50d4c33a..1a225592af 100644
--- a/crates/ui-egui/src/eyedropper_ui.rs
+++ b/crates/ui-egui/src/eyedropper_ui.rs
@@ -42,9 +42,9 @@ fn opt(ui: &mut egui::Ui, text: &str) {
 pub fn options(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let o = &mut app.ui.tool_options;
     opt(ui, tl!("Sample Size:"));
-    widgets::dropdown(ui, "eyedropper-size", &mut o.eyedropper_size, &size_options(), 130.0);
+    widgets::dropdown(ui, "eyedropper-size", tl!("Size"), &mut o.eyedropper_size, &size_options(), 130.0);
     opt(ui, tl!("Sample:"));
-    widgets::dropdown(ui, "eyedropper-sample", &mut o.eyedropper_sample, &layer_options(), 190.0);
+    widgets::dropdown(ui, "eyedropper-sample", tl!("Source"), &mut o.eyedropper_sample, &layer_options(), 190.0);
     widgets::checkbox(ui, &mut o.eyedropper_ring, tl!("Show Sampling Ring"));
     widgets::vline(ui, 22.0);
     let t = Tokens::get(ui.ctx());
diff --git a/crates/ui-egui/src/field_tab.rs b/crates/ui-egui/src/field_tab.rs
index 467c7d8b50..79d8217029 100644
--- a/crates/ui-egui/src/field_tab.rs
+++ b/crates/ui-egui/src/field_tab.rs
@@ -12,15 +12,15 @@
 use egui::{Context, Id, Key, Modifiers};
 
 fn list_id() -> Id {
-    Id::new("pc-field-tab-order")
+    Id::unique("pc-field-tab-order")
 }
 
 fn collecting_id() -> Id {
-    Id::new("pc-field-tab-collecting")
+    Id::unique("pc-field-tab-collecting")
 }
 
 fn pending_id() -> Id {
-    Id::new("pc-field-tab-pending")
+    Id::unique("pc-field-tab-pending")
 }
 
 /// Give `id` the focus from the next frame on. Focusing a widget after it was laid out would
diff --git a/crates/ui-egui/src/field_wheel.rs b/crates/ui-egui/src/field_wheel.rs
index 92b15965dc..f4d0ac80d2 100644
--- a/crates/ui-egui/src/field_wheel.rs
+++ b/crates/ui-egui/src/field_wheel.rs
@@ -30,15 +30,15 @@ struct Gesture {
 }
 
 fn gesture_id() -> Id {
-    Id::new("pc-field-wheel-gesture")
+    Id::unique("pc-field-wheel-gesture")
 }
 
 fn focused_id() -> Id {
-    Id::new("pc-field-wheel-focused")
+    Id::unique("pc-field-wheel-focused")
 }
 
 fn taken_id() -> Id {
-    Id::new("pc-field-wheel-taken")
+    Id::unique("pc-field-wheel-taken")
 }
 
 /// A wheel event a field takes: plain or Shift, not the view's Alt or Ctrl/Cmd zoom, nor a plain
@@ -167,11 +167,12 @@ mod tests {
             |ui, s: &mut State| {
                 super::begin_frame(ui.ctx());
                 let out = egui::ScrollArea::both().max_height(100.0).max_width(200.0).show(ui, |ui| {
-                    ui.add_enabled_ui(s.2, |ui| crate::widgets::value_field(ui, &mut s.0, 0.0..=1000.0, "px", 90.0));
+                    ui.add_enabled_ui(s.2, |ui| crate::widgets::value_field(ui, &mut s.0, 0.0..=1000.0, "px", 90.0).accessible_name("Size"));
                     ui.allocate_space(vec2(1000.0, 1000.0));
                 });
-                s.1 = out.state.offset.y;
-                s.3 = out.state.offset.x;
+                let offset = out.state.clamped_offset();
+                s.1 = offset.y;
+                s.3 = offset.x;
             },
             (value, 0.0, true, 0.0),
         );
@@ -187,7 +188,13 @@ mod tests {
     fn wheel(h: &mut Harness<'static, State>, at: Pos2, lines: f32, modifiers: Modifiers) {
         h.hover_at(at);
         h.run_steps(1);
-        h.event(egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: vec2(0.0, lines), phase: egui::TouchPhase::Move, modifiers });
+        h.event(egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: egui::MouseWheelUnit::Line,
+            delta: vec2(0.0, lines),
+            phase: egui::TouchPhase::Move,
+            modifiers,
+        });
         h.run_steps(4);
     }
 
@@ -225,8 +232,13 @@ mod tests {
         let below = field(&h).center() + vec2(0.0, 40.0);
         h.hover_at(below);
         h.run_steps(1);
-        let down =
-            || egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: vec2(0.0, -1.0), phase: egui::TouchPhase::Move, modifiers: Modifiers::NONE };
+        let down = || egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: egui::MouseWheelUnit::Line,
+            delta: vec2(0.0, -1.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: Modifiers::NONE,
+        };
         h.event(down());
         h.run_steps(1);
         // Still the same gesture as the pointer reaches a field.
@@ -251,7 +263,13 @@ mod tests {
                 let at = field(&h).center();
                 h.hover_at(at);
                 h.run_steps(1);
-                h.event(egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: vec2(1.0, 0.0), phase: egui::TouchPhase::Move, modifiers: m });
+                h.event(egui::Event::MouseWheel {
+                    source: egui::MouseWheelSource::Unknown,
+                    unit: egui::MouseWheelUnit::Line,
+                    delta: vec2(1.0, 0.0),
+                    phase: egui::TouchPhase::Move,
+                    modifiers: m,
+                });
                 h.run_steps(4);
                 assert_eq!(h.state().0, want, "focus {focus}, {m:?}");
             }
@@ -265,7 +283,13 @@ mod tests {
         let mut h = harness(100.0);
         h.hover_at(field(&h).center());
         h.run_steps(1);
-        let ev = |phase, y| egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: vec2(0.0, y), phase, modifiers: Modifiers::NONE };
+        let ev = |phase, y| egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: egui::MouseWheelUnit::Line,
+            delta: vec2(0.0, y),
+            phase,
+            modifiers: Modifiers::NONE,
+        };
         h.event(ev(egui::TouchPhase::Start, 0.0));
         h.run_steps(1);
         h.event(ev(egui::TouchPhase::Move, 2.0));
@@ -281,7 +305,13 @@ mod tests {
         let mut h = harness(100.0);
         h.hover_at(field(&h).center());
         h.run_steps(1);
-        let ev = |phase, x| egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: vec2(x, 0.0), phase, modifiers: Modifiers::NONE };
+        let ev = |phase, x| egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: egui::MouseWheelUnit::Line,
+            delta: vec2(x, 0.0),
+            phase,
+            modifiers: Modifiers::NONE,
+        };
         h.event(ev(egui::TouchPhase::Start, 0.0));
         h.run_steps(1);
         h.event(ev(egui::TouchPhase::Move, -2.0));
@@ -298,7 +328,7 @@ mod tests {
         let mut h = harness_stepping(100.0, 1.0 / 30.0);
         h.hover_at(field(&h).center());
         h.run_steps(1);
-        let ev = |phase, unit, d| egui::Event::MouseWheel { unit, delta: d, phase, modifiers: Modifiers::NONE };
+        let ev = |phase, unit, d| egui::Event::MouseWheel { source: egui::MouseWheelSource::Unknown, unit, delta: d, phase, modifiers: Modifiers::NONE };
         h.event(ev(egui::TouchPhase::Start, egui::MouseWheelUnit::Point, vec2(0.0, 0.0)));
         h.run_steps(1);
         // A short swipe, so the field stays in view.
@@ -321,8 +351,13 @@ mod tests {
         h.hover_at(field(&h).center());
         h.run_steps(1);
         // Up, so the panel (already at the top) doesn't move the field.
-        let up =
-            || egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: vec2(0.0, 1.0), phase: egui::TouchPhase::Move, modifiers: Modifiers::NONE };
+        let up = || egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: egui::MouseWheelUnit::Line,
+            delta: vec2(0.0, 1.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: Modifiers::NONE,
+        };
         h.event(up());
         h.run_steps(1);
         assert_eq!(h.state().0, 101.0);
@@ -369,7 +404,7 @@ mod tests {
         use egui::MouseWheelUnit::{Line, Point};
         let ctx = egui::Context::default();
         let mut out = ctx.run_ui(Default::default(), |ui| {
-            let id = egui::Id::new("acc");
+            let id = egui::Id::unique("acc");
             for d in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
                 for unit in [Line, Point] {
                     assert_eq!(crate::widgets::count_notches(ui, id, &[(unit, vec2(0.0, d), false)], 10.0), 0.0, "{d} {unit:?}");
diff --git a/crates/ui-egui/src/field_wheel_app_tests.rs b/crates/ui-egui/src/field_wheel_app_tests.rs
index 6d4f56db3e..61ff68d2ea 100644
--- a/crates/ui-egui/src/field_wheel_app_tests.rs
+++ b/crates/ui-egui/src/field_wheel_app_tests.rs
@@ -30,7 +30,13 @@ fn field<'a>(h: &'a Harness<'_, PhotocraftApp>, value: &str) -> egui_kittest::No
 fn wheel(h: &mut Harness<'_, PhotocraftApp>, at: egui::Pos2, lines: f32, modifiers: egui::Modifiers) {
     h.hover_at(at);
     h.run_steps(1);
-    h.event(egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: vec2(0.0, lines), phase: egui::TouchPhase::Move, modifiers });
+    h.event(egui::Event::MouseWheel {
+        source: egui::MouseWheelSource::Unknown,
+        unit: egui::MouseWheelUnit::Line,
+        delta: vec2(0.0, lines),
+        phase: egui::TouchPhase::Move,
+        modifiers,
+    });
     h.run_steps(6);
 }
 
@@ -84,7 +90,13 @@ fn canvas_pan(focus: bool, delta: egui::Vec2, modifiers: egui::Modifiers) -> (f3
     h.hover_at(canvas);
     h.run_steps(1);
     let before = view(&h);
-    h.event(egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta, phase: egui::TouchPhase::Move, modifiers });
+    h.event(egui::Event::MouseWheel {
+        source: egui::MouseWheelSource::Unknown,
+        unit: egui::MouseWheelUnit::Line,
+        delta,
+        phase: egui::TouchPhase::Move,
+        modifiers,
+    });
     h.run_steps(40);
     assert!(h.query_all_by_role(Role::SpinButton).any(|n| n.value().as_deref() == Some("10")), "focus {focus}: the field wasn't stepped");
     let after = view(&h);
diff --git a/crates/ui-egui/src/file_ui.rs b/crates/ui-egui/src/file_ui.rs
index 18ac75478a..39b0278b31 100644
--- a/crates/ui-egui/src/file_ui.rs
+++ b/crates/ui-egui/src/file_ui.rs
@@ -202,13 +202,17 @@ mod web_preview;
 
 const WEB_FORMATS: [(&str, &str); 5] = [("gif", "GIF"), ("png8", "PNG-8"), ("png24", "PNG-24"), ("jpeg", "JPEG"), ("wbmp", "WBMP")];
 const WEB_COMMAND: &str = "file.export.saveForWebLegacy";
+/// Save for Web's preview tabs: the `__view` field's values and their labels.
+const WEB_VIEWS: [(&str, &str); 4] = [("original", "Original"), ("optimized", "Optimized"), ("2up", "2-Up"), ("4up", "4-Up")];
 
 pub fn open_web(app: &mut PhotocraftApp) -> u64 {
     let mut f = Map::new();
     f.insert("__web".into(), json!(true));
     f.insert("__command".into(), json!(WEB_COMMAND));
     f.insert("__label".into(), json!("Save for Web (Legacy)"));
-    f.insert("__view".into(), json!("2up"));
+    // The preview tab chosen last time, 2-Up at first (#9174).
+    let view = app.ui.web_view.as_deref().filter(|v| WEB_VIEWS.iter().any(|(k, _)| k == v)).unwrap_or("2up");
+    f.insert("__view".into(), json!(view));
     // Remember encoding choices, but each document starts at its own full size. This session's
     // last export lives in `file_menu`; the last one before a restart comes from the
     // preferences' remembered dialog settings (`web_cmds::remember_web_settings`).
@@ -286,7 +290,7 @@ fn web_pane(app: &PhotocraftApp, ui: &mut egui::Ui, size: egui::Vec2, p: Option<
     // A bounded proxy; navigation never recomposites or re-encodes it.
     let base = p.cloned().unwrap_or_else(|| json!({}));
     let size_sig = format!("{}|{}|{}|{}|{}", base["percent"], base["width"], base["height"], base["resample"], base["convertToSrgb"]);
-    let wkey = egui::Id::new(("web-proxy", doc.id.0, pane));
+    let wkey = egui::Id::unique(("web-proxy", doc.id.0, pane));
     let proxy_sig = format!("{rev}|{frame:?}|{size_sig}");
     let cached_proxy: Option<(String, WebProxy)> = ui.data(|d| d.get_temp(wkey));
     let proxy = cached_proxy.filter(|(sig, _)| sig == &proxy_sig).map(|(_, proxy)| proxy);
@@ -322,7 +326,7 @@ fn web_pane(app: &PhotocraftApp, ui: &mut egui::Ui, size: egui::Vec2, p: Option<
         }
     };
     let sig = format!("{}|{rev}|{frame:?}|{size_sig}|{}", doc.id.0, p.map(|v| v.to_string()).unwrap_or_else(|| "original".into()));
-    let key = egui::Id::new(("web-pane", doc.id.0, pane));
+    let key = egui::Id::unique(("web-pane", doc.id.0, pane));
     let cached: Option<WebCache> = ui.data(|d| d.get_temp(key));
     let (tex, info) = match cached.filter(|c| c.0 == sig) {
         Some((_, tex, info)) => (tex, info),
@@ -392,10 +396,10 @@ fn printer_options(list: Option<&Value>, current: &str) -> Vec<(String, String)>
     opts
 }
 
-fn dropdown_str(ui: &mut egui::Ui, id: &str, f: &mut Map<String, Value>, key: &str, opts: &[(&str, &str)], w: f32) {
+fn dropdown_str(ui: &mut egui::Ui, id: &str, name: &str, f: &mut Map<String, Value>, key: &str, opts: &[(&str, &str)], w: f32) {
     let mut v = s(f, key, opts.first().map_or("", |o| o.0));
     let o: Vec<(String, &str)> = opts.iter().map(|(k, l)| (k.to_string(), *l)).collect();
-    if crate::widgets::dropdown(ui, id, &mut v, &o, w) {
+    if crate::widgets::dropdown(ui, id, name, &mut v, &o, w) {
         f.insert(key.into(), json!(v));
     }
 }
@@ -411,7 +415,7 @@ fn number(ui: &mut egui::Ui, f: &mut Map<String, Value>, key: &str, label: &str,
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(tl!(&label)).color(t.text_dim));
         let mut v = n(f, key, d) as f32;
-        crate::widgets::value_field(ui, &mut v, range, unit, 64.0);
+        crate::widgets::value_field(ui, &mut v, range, unit, 64.0).accessible_name(tl!(&label));
         f.insert(key.into(), json!(v.round()));
     });
 }
@@ -485,9 +489,11 @@ fn web_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
     let Some(doc) = app.session.active().map(|d| d.doc.clone()) else { return };
     ui.horizontal(|ui| {
         let mut view = s(f, "__view", "2up");
-        for (k, l) in [("original", tl!("Original")), ("optimized", tl!("Optimized")), ("2up", "2-Up"), ("4up", "4-Up")] {
-            if ui.selectable_label(view == k, tl!(&l)).clicked() {
+        for (k, l) in WEB_VIEWS {
+            if ui.selectable_label(view == k, tl!(l)).clicked() {
                 view = k.into();
+                // The next Save for Web opens on this tab, as Photoshop's does.
+                app.ui.web_view = Some(view.clone());
             }
         }
         f.insert("__view".into(), json!(view));
@@ -537,14 +543,14 @@ fn web_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                 let mut preset = s(f, "__preset", "");
                 let mut opts: Vec<(String, &str)> = vec![("".into(), "[Unnamed]")];
                 opts.extend(web_cmds::PRESETS.iter().map(|p| (p.to_string(), *p)));
-                if crate::widgets::dropdown(ui, "web-preset", &mut preset, &opts, 230.0) && !preset.is_empty() {
+                if crate::widgets::dropdown(ui, "web-preset", tl!("Preset"), &mut preset, &opts, 230.0) && !preset.is_empty() {
                     if let Some(Value::Object(m)) = web_cmds::preset_settings(&preset).map(|st| st.to_params()) {
                         f.extend(m);
                     }
                     f.insert("__preset".into(), json!(preset));
                 }
                 ui.add_space(4.0);
-                dropdown_str(ui, "web-format", f, "format", &WEB_FORMATS, 230.0);
+                dropdown_str(ui, "web-format", tl!("Format"), f, "format", &WEB_FORMATS, 230.0);
                 ui.add_space(4.0);
                 let fmt = s(f, "format", "jpeg");
                 match fmt.as_str() {
@@ -552,6 +558,7 @@ fn web_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                         dropdown_str(
                             ui,
                             "web-palette",
+                            tl!("Color Table"),
                             f,
                             "palette",
                             &[
@@ -567,6 +574,7 @@ fn web_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                         dropdown_str(
                             ui,
                             "web-dither",
+                            tl!("Dither"),
                             f,
                             "dither",
                             &[("none", tl!("No Dither")), ("diffusion", tl!("Diffusion")), ("pattern", tl!("Pattern")), ("noise", tl!("Noise"))],
@@ -587,6 +595,7 @@ fn web_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                         dropdown_str(
                             ui,
                             "web-dither",
+                            tl!("Dither"),
                             f,
                             "dither",
                             &[("none", tl!("No Dither")), ("diffusion", tl!("Diffusion")), ("pattern", tl!("Pattern"))],
@@ -600,9 +609,9 @@ fn web_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                 }
                 if fmt != "png24" || !b(f, "transparency", true) {
                     ui.horizontal(|ui| {
-                        ui.label(egui::RichText::new(tl!("Matte")).color(t.text_dim));
+                        let matte_label = ui.label(egui::RichText::new(tl!("Matte")).color(t.text_dim));
                         let mut m = s(f, "matte", "#ffffff");
-                        if ui.add(egui::TextEdit::singleline(&mut m).desired_width(80.0)).changed() {
+                        if ui.add(egui::TextEdit::singleline(&mut m).desired_width(80.0)).labelled_by(matte_label.id).changed() {
                             f.insert("matte".into(), json!(m));
                         }
                     });
@@ -614,6 +623,7 @@ fn web_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                     dropdown_str(
                         ui,
                         "web-meta",
+                        tl!("Metadata"),
                         f,
                         "metadata",
                         &[
@@ -636,7 +646,7 @@ fn web_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                     ui.add_space(6.0);
                     ui.label(egui::RichText::new(crate::i18n::trn(crate::i18n::current(), nslices as u64, "{n} slice", "{n} slices")).color(t.text_dim));
                     check(ui, f, "html", tl!("Save HTML and Images"), true);
-                    dropdown_str(ui, "web-slices", f, "slices", &[("all", tl!("All Slices")), ("user", tl!("All User Slices"))], 150.0);
+                    dropdown_str(ui, "web-slices", tl!("Slices"), f, "slices", &[("all", tl!("All Slices")), ("user", tl!("All User Slices"))], 150.0);
                 }
             });
         });
@@ -651,7 +661,7 @@ fn size_field(ui: &mut egui::Ui, label: &str, shown: f64, range: std::ops::Range
     let passed = (shown as f32).clamp(*range.start(), *range.end());
     let mut v = passed;
     ui.label(egui::RichText::new(label).color(t.text_dim));
-    crate::widgets::value_field_prec(ui, &mut v, range, unit, 90.0, decimals);
+    crate::widgets::value_field_prec(ui, &mut v, range, unit, 90.0, decimals).accessible_name(tl!(&label));
     ui.end_row();
     (v != passed).then_some(f64::from(v))
 }
@@ -709,6 +719,7 @@ fn web_size(ui: &mut egui::Ui, f: &mut Map<String, Value>, doc: &photocraft_doc:
         dropdown_str(
             ui,
             "web-resample",
+            tl!("Resample"),
             f,
             "resample",
             &[
@@ -938,7 +949,7 @@ fn length_field_range(ui: &mut egui::Ui, label: &str, pt: &mut f64, units: &str,
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(label).color(t.text_dim));
         let before = v;
-        crate::widgets::value_field_prec(ui, &mut v, range, units, 70.0, decimals);
+        crate::widgets::value_field_prec(ui, &mut v, range, units, 70.0, decimals).accessible_name(tl!(&label));
         if (v - before).abs() > 1e-4 && v.is_finite() {
             *pt = f64::from(v) * k;
             changed = true;
@@ -966,7 +977,7 @@ fn print_paper_controls(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
     ui.horizontal(|ui| {
         let mut papers: Vec<_> = photocraft_engine::print_cmds::PAPERS.iter().map(|p| (p.0.to_string(), p.0)).collect();
         papers.push(("custom".to_string(), tl!("Custom")));
-        if crate::widgets::dropdown(ui, "print-paper", &mut selected, &papers, 110.0) {
+        if crate::widgets::dropdown(ui, "print-paper", tl!("Paper"), &mut selected, &papers, 110.0) {
             if selected == "custom" {
                 let (w, h) = print_paper_size(f.get("__customPaper").or(previous.as_ref()));
                 f.insert("paper".into(), json!([w, h]));
@@ -977,7 +988,7 @@ fn print_paper_controls(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
                 f.insert("paper".into(), json!(selected));
             }
         }
-        dropdown_str(ui, "print-orient", f, "orientation", &[("portrait", tl!("Portrait")), ("landscape", tl!("Landscape"))], 110.0);
+        dropdown_str(ui, "print-orient", tl!("Orientation"), f, "orientation", &[("portrait", tl!("Portrait")), ("landscape", tl!("Landscape"))], 110.0);
     });
     if f.get("paper").is_some_and(Value::is_array) {
         let (mut w, mut h) = print_paper_size(f.get("paper"));
@@ -1086,10 +1097,10 @@ fn print_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Va
                     ui.painter().rect_filled(page, 0.0, egui::Color32::WHITE);
                     ui.painter().rect_stroke(page, 0.0, egui::Stroke::new(1.0, t.separator), egui::StrokeKind::Outside);
                     let mut img = print_preview_image(l, page, k);
-                    let drag_id = ui.id().with(("print-position", id));
+                    let drag_id = ui.scope_id().with(("print-position", id));
                     let visible = img.intersect(page).intersect(ui.clip_rect());
                     let response = ui.interact(visible, drag_id, egui::Sense::drag()).on_hover_cursor(egui::CursorIcon::Grab);
-                    response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Image, true, tl!("Print preview image")));
+                    response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Image, true, tl!("Print preview image")));
                     // Keep a fixed layout and press origin for the whole gesture: rounding and
                     // the transition from Center must never accumulate or move the grab point.
                     if response.drag_started_by(egui::PointerButton::Primary)
@@ -1112,7 +1123,7 @@ fn print_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Va
                         ui.data_mut(|d| d.remove::<(photocraft_engine::print_cmds::PrintLayout, egui::Pos2, f32)>(drag_id));
                     }
                     let (x, y, w, h) = l.rect;
-                    let key = egui::Id::new(("print-thumb", doc.id.0, app.session.active().map_or(0, |d| d.revision)));
+                    let key = egui::Id::unique(("print-thumb", doc.id.0, app.session.active().map_or(0, |d| d.revision)));
                     let tex: Option<Arc<egui::TextureHandle>> = ui.data(|d| d.get_temp(key));
                     let tex = tex.unwrap_or_else(|| {
                         let th = photocraft_compose::thumbnail(&doc, 400);
@@ -1176,7 +1187,7 @@ fn print_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Va
                     ui.label(egui::RichText::new(tl!("Printer")).color(t.text_dim));
                     let before = s(f, "printer", "");
                     let opts: Vec<(&str, &str)> = printers.iter().map(|n| (n.as_str(), n.as_str())).collect();
-                    dropdown_str(ui, "print-printer", f, "printer", &opts, 220.0);
+                    dropdown_str(ui, "print-printer", tl!("Printer"), f, "printer", &opts, 220.0);
                     if s(f, "printer", "") != before {
                         f.remove("printerSettings");
                         driver_page(f);
@@ -1225,7 +1236,7 @@ fn print_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Va
                     let mut pr = s(f, "printer", "");
                     let opts = printer_options(f.get("__systemPrinters"), &pr);
                     let o: Vec<(String, &str)> = opts.iter().map(|(k, l)| (k.clone(), l.as_str())).collect();
-                    if crate::widgets::dropdown(ui, "print-printer", &mut pr, &o, 240.0) {
+                    if crate::widgets::dropdown(ui, "print-printer", tl!("Printer"), &mut pr, &o, 240.0) {
                         f.insert("printer".into(), json!(pr));
                     }
                 });
@@ -1236,6 +1247,7 @@ fn print_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Va
             dropdown_str(
                 ui,
                 "print-color",
+                tl!("Color Management"),
                 f,
                 "colorHandling",
                 &[
@@ -1266,11 +1278,12 @@ fn print_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Va
                 if !profiles.iter().any(|(v, _)| *v == cur) {
                     profiles.push((cur.as_str(), stem.as_str()));
                 }
-                dropdown_str(ui, "print-profile", f, "printerProfile", &profiles, 240.0);
+                dropdown_str(ui, "print-profile", tl!("Profile"), f, "printerProfile", &profiles, 240.0);
                 ui.horizontal(|ui| {
                     dropdown_str(
                         ui,
                         "print-intent",
+                        tl!("Mode"),
                         f,
                         "intent",
                         &[
@@ -1290,7 +1303,7 @@ fn print_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Va
                 }
             }
             head(ui, tl!("Position and Size"));
-            dropdown_str(ui, "print-units", f, "units", &[("cm", tl!("Centimeters")), ("mm", tl!("Millimeters")), ("in", tl!("Inches"))], 130.0);
+            dropdown_str(ui, "print-units", tl!("Units"), f, "units", &[("cm", tl!("Centimeters")), ("mm", tl!("Millimeters")), ("in", tl!("Inches"))], 130.0);
             let units = s(f, "units", "cm");
             check(ui, f, "center", tl!("Center"), true);
             let centered = b(f, "center", true);
@@ -1322,7 +1335,7 @@ fn print_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Va
                     ui.horizontal(|ui| {
                         ui.label(egui::RichText::new(tl!("Scale")).color(t.text_dim));
                         let mut v = n(f, "scale", 100.0) as f32;
-                        crate::widgets::value_field(ui, &mut v, 1.0..=1000.0, "%", 64.0);
+                        crate::widgets::value_field(ui, &mut v, 1.0..=1000.0, "%", 64.0).accessible_name(tl!("Scale"));
                         f.insert("scale".into(), json!((f64::from(v) * 100.0).round() / 100.0));
                     });
                 }
@@ -1745,7 +1758,7 @@ mod tests {
             )
         };
         let before = pane(&h);
-        let rects: Vec<egui::Rect> = h.ctx.data(|m| m.get_temp(egui::Id::new("pc-dialog-rects"))).unwrap();
+        let rects: Vec<egui::Rect> = h.ctx.data(|m| m.get_temp(egui::Id::unique("pc-dialog-rects"))).unwrap();
         let corner = rects[0].max - egui::vec2(14.0, 14.0);
         h.event(egui::Event::PointerMoved(corner));
         h.step();
@@ -2016,6 +2029,28 @@ mod web_playback_tests {
         h
     }
 
+    /// #9174: Save for Web reopens on the preview tab chosen last, as Photoshop's does; 2-Up at
+    /// first, and for a remembered value it doesn't know.
+    #[test]
+    fn save_for_web_reopens_on_the_last_preview_tab() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.run("file.new", json!({"width": 40, "height": 30})).unwrap();
+        let id = open_web(&mut app);
+        let fields = app.ui.dialog_mut(id).unwrap().fields.clone();
+        assert_eq!(fields["__view"], "2up");
+        let mut h = harness(app, fields);
+        use egui_kittest::kittest::Queryable;
+        h.get_by_label("4-Up").click();
+        h.run_steps(2);
+        assert_eq!(h.state().1["__view"], "4up");
+        let (mut app, _) = h.into_state();
+        let id = open_web(&mut app);
+        assert_eq!(app.ui.dialog_mut(id).unwrap().fields["__view"], "4up");
+        app.ui.web_view = Some("6up".into());
+        let id = open_web(&mut app);
+        assert_eq!(app.ui.dialog_mut(id).unwrap().fields["__view"], "2up");
+    }
+
     #[test]
     fn animated_save_for_web_offers_playback() {
         let mut app = animated_app(8);
@@ -2088,9 +2123,9 @@ mod web_playback_tests {
             h.state_mut().1.insert("__web_frame".into(), json!(frame));
             h.run_steps(2);
             for pane in 0usize..4 {
-                let proxy: (String, WebProxy) = h.ctx.data(|d| d.get_temp(egui::Id::new(("web-proxy", doc_id, pane)))).unwrap();
+                let proxy: (String, WebProxy) = h.ctx.data(|d| d.get_temp(egui::Id::unique(("web-proxy", doc_id, pane)))).unwrap();
                 assert!(proxy.1.0[0][frame] > 0.99, "pane {pane} must show frame {frame}");
-                let cache: WebCache = h.ctx.data(|d| d.get_temp(egui::Id::new(("web-pane", doc_id, pane)))).unwrap();
+                let cache: WebCache = h.ctx.data(|d| d.get_temp(egui::Id::unique(("web-pane", doc_id, pane)))).unwrap();
                 assert!(cache.0.contains(&format!("Some({frame})")));
             }
         }
@@ -2110,7 +2145,7 @@ mod web_playback_tests {
         h.state_mut().1.insert("colorTable".into(), expected_palette.clone());
         h.run_steps(2);
         assert_eq!(h.state().1["colorTable"], expected_palette);
-        let key = egui::Id::new(("web-pane", doc_id, 1usize)).with("indexed-source");
+        let key = egui::Id::unique(("web-pane", doc_id, 1usize)).with("indexed-source");
         let encoded = |ctx: &egui::Context| ctx.data(|d| d.get_temp::<(String, Arc<Optimized>)>(key)).unwrap().1;
         let first = encoded(&h.ctx);
         h.state_mut().1.insert("colorTableEdits".into(), json!({"0":"#ffff00"}));
diff --git a/crates/ui-egui/src/file_ui/web_preview.rs b/crates/ui-egui/src/file_ui/web_preview.rs
index 02cf44cb6d..44399b7d52 100644
--- a/crates/ui-egui/src/file_ui/web_preview.rs
+++ b/crates/ui-egui/src/file_ui/web_preview.rs
@@ -219,7 +219,7 @@ pub fn controls(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
             nav.zoom = Some((nav.zoom.unwrap_or(effective) * 1.25).min(32.0));
         }
         let mut percent = nav.zoom.unwrap_or(effective) * 100.0;
-        if ui.add(egui::DragValue::new(&mut percent).range(0.01..=3200.0).suffix("%").speed(10.0)).changed() {
+        if ui.add(egui::DragValue::new(&mut percent).range(0.01..=3200.0).suffix("%").speed(10.0)).accessible_name(tl!("Zoom")).changed() {
             nav.zoom = Some(percent / 100.0);
         }
         if ui.small_button(tl!("100%")).clicked() {
@@ -292,7 +292,7 @@ mod tests {
 
     #[test]
     fn palette_picker_reuses_indices_and_updates_preview_pixels() {
-        let key = egui::Id::new("test-web-preview");
+        let key = egui::Id::unique("test-web-preview");
         let p = json!({"format": "gif", "colorTable": ["#ff0000", "#0000ff"], "dither": "none"});
         let mut h = egui_kittest::Harness::builder().build_ui_state(
             move |ui, state: &mut (Value, Vec<u8>)| {
diff --git a/crates/ui-egui/src/fill_ui.rs b/crates/ui-egui/src/fill_ui.rs
index faa917f039..7e2d3e17ed 100644
--- a/crates/ui-egui/src/fill_ui.rs
+++ b/crates/ui-egui/src/fill_ui.rs
@@ -155,7 +155,7 @@ pub fn body(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Value>)
     ui.horizontal(|ui| {
         label(ui, tl!("Contents:"));
         let opts: Vec<(String, &str)> = CONTENTS.iter().map(|(k, l)| (k.to_string(), *l)).collect();
-        if crate::widgets::dropdown(ui, "fill-contents", &mut contents, &opts, 170.0) {
+        if crate::widgets::dropdown(ui, "fill-contents", tl!("Contents:"), &mut contents, &opts, 170.0) {
             f.insert("contents".into(), json!(contents));
             // Choosing Color… opens the Color Picker, as in Photoshop.
             if contents == "color" {
diff --git a/crates/ui-egui/src/filter_dialog.rs b/crates/ui-egui/src/filter_dialog.rs
index b611b9ac64..7f0ae8e998 100644
--- a/crates/ui-egui/src/filter_dialog.rs
+++ b/crates/ui-egui/src/filter_dialog.rs
@@ -829,9 +829,10 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
                         // Keep one numeric field for direct entry and one log-scaled slider for
                         // wide ranges. slider_row would add a second, linear slider (#146).
                         ui.horizontal(|ui| {
-                            ui.label(egui::RichText::new(label(&p.key)).color(t.text_dim));
+                            let name = label(&p.key);
+                            ui.label(egui::RichText::new(&name).color(t.text_dim));
                             ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                                crate::widgets::value_field(ui, &mut v, min..=max, unit, 74.0);
+                                crate::widgets::value_field(ui, &mut v, min..=max, unit, 74.0).accessible_name(name);
                             });
                         });
                         let mut lv = v.clamp(min, max).ln();
@@ -891,7 +892,7 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
                     if lists_installed && !opts.iter().any(|(v, _)| *v == cur) {
                         opts.push((cur.clone(), stem.as_str()));
                     }
-                    crate::widgets::dropdown(ui, &format!("flt-{cmd}-{}", p.key), &mut cur, &opts, 170.0);
+                    crate::widgets::dropdown(ui, &format!("flt-{cmd}-{}", p.key), &label(&p.key), &mut cur, &opts, 170.0);
                     if let Some(i) = cur.strip_prefix("channel:").filter(|_| depth).and_then(|i| i.parse::<usize>().ok()) {
                         f.insert("depthChannel".into(), json!(i));
                         cur = "channel".into();
@@ -909,8 +910,8 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
             Kind::Text => {
                 let mut v = f.get(&p.key).and_then(Value::as_str).unwrap_or_default().to_string();
                 ui.horizontal(|ui| {
-                    ui.label(egui::RichText::new(label(&p.key)).color(t.text_dim));
-                    ui.add(egui::TextEdit::singleline(&mut v).desired_width(200.0));
+                    let lp = ui.label(egui::RichText::new(label(&p.key)).color(t.text_dim));
+                    ui.add(egui::TextEdit::singleline(&mut v).desired_width(200.0)).labelled_by(lp.id);
                     // Install Plug-in…: pick the .wasm file instead of typing its path (#7531).
                     if cmd == "plugin.install" && p.key == "path" && crate::widgets::secondary_button(ui, tl!("Browse…"), 0.0).clicked() {
                         f.insert(crate::dialogs::BROWSE_FIELD.into(), json!(p.key));
@@ -931,7 +932,7 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
                 opts.extend(names.iter().enumerate().map(|(i, n)| (i.to_string(), n.as_str())));
                 ui.horizontal(|ui| {
                     ui.label(egui::RichText::new(label(&p.key)).color(t.text_dim));
-                    crate::widgets::dropdown(ui, &format!("flt-{cmd}-{}", p.key), &mut sel, &opts, 170.0);
+                    crate::widgets::dropdown(ui, &format!("flt-{cmd}-{}", p.key), &label(&p.key), &mut sel, &opts, 170.0);
                 });
                 match sel.parse::<i64>() {
                     Ok(i) if i >= 0 => f.insert(p.key, json!(i)),
@@ -946,7 +947,7 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
                 ui.label(egui::RichText::new(label(&p.key)).color(t.text_dim));
                 egui::Grid::new(format!("flt-grid-{cmd}-{}", p.key)).spacing([4.0, 4.0]).show(ui, |ui| {
                     for (i, v) in vals.iter_mut().enumerate() {
-                        crate::widgets::value_field(ui, v, -999.0..=999.0, "", 44.0);
+                        crate::widgets::value_field(ui, v, -999.0..=999.0, "", 44.0).accessible_name(format!("{} {}", label(&p.key), i + 1));
                         if (i + 1) % side == 0 {
                             ui.end_row();
                         }
@@ -991,7 +992,7 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
                 let mut v = f.get(&p.key).and_then(Value::as_f64).unwrap_or(default as f64) as f32;
                 ui.horizontal(|ui| {
                     ui.label(egui::RichText::new(label(&p.key)).color(t.text_dim));
-                    crate::widgets::value_field(ui, &mut v, -30000.0..=30000.0, "", 80.0);
+                    crate::widgets::value_field(ui, &mut v, -30000.0..=30000.0, "", 80.0).accessible_name(label(&p.key));
                     // A seed gets a fresh random value in one click (#5710): Clouds, Add Noise,
                     // Fibers… then render a new pattern, as each run of Photoshop's does.
                     if p.key == "seed" && ui.button(tl!("Random")).clicked() {
diff --git a/crates/ui-egui/src/filter_dialog/zoom_center.rs b/crates/ui-egui/src/filter_dialog/zoom_center.rs
index 3acb09b052..963b7c16b4 100644
--- a/crates/ui-egui/src/filter_dialog/zoom_center.rs
+++ b/crates/ui-egui/src/filter_dialog/zoom_center.rs
@@ -39,7 +39,7 @@ pub(super) fn row(ui: &mut Ui, fields: &mut Map<String, Value>) {
         });
         // Paint after both sliders so their edits move the marker in this very frame.
         paint(ui, rect, plot, center, amount, response.has_focus());
-        response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Slider, ui.is_enabled(), tl!("Center")));
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Slider, ui.is_enabled(), tl!("Center")));
         response.on_hover_cursor(egui::CursorIcon::Crosshair);
     });
     for (key, value) in [("centerX", center.x), ("centerY", center.y)] {
diff --git a/crates/ui-egui/src/filter_preview_ui.rs b/crates/ui-egui/src/filter_preview_ui.rs
index 0dd76f4f45..f83a260b0d 100644
--- a/crates/ui-egui/src/filter_preview_ui.rs
+++ b/crates/ui-egui/src/filter_preview_ui.rs
@@ -61,7 +61,7 @@ pub(crate) fn window(app: &PhotocraftApp, dialog: u64, ui: &mut egui::Ui, f: &mu
     });
 
     let t = Tokens::get(ui.ctx());
-    let cache_id = egui::Id::new(("filter-preview-ui", dialog));
+    let cache_id = egui::Id::unique(("filter-preview-ui", dialog));
     let mut cache: Cache = ui.ctx().data_mut(|d| std::mem::take(d.get_temp_mut_or_default::<Cache>(cache_id)));
     // Channel visibility and the active mask can change without a document revision. Both the
     // original (press-and-hold) and filtered textures must follow the canvas's current view.
@@ -364,7 +364,7 @@ mod tests {
         let id = crate::filter_dialog::open(&mut app, "filter.blur.gaussianBlur").unwrap();
         let mut fields = app.ui.dialogs.last().unwrap().fields.clone();
         let ctx = egui::Context::default();
-        let cache_id = egui::Id::new(("filter-preview-ui", id));
+        let cache_id = egui::Id::unique(("filter-preview-ui", id));
         ctx.run_ui(Default::default(), |ui| window(&app, id, ui, &mut fields)).textures_delta.clear();
         let before = ctx.data(|d| d.get_temp::<Cache>(cache_id).unwrap().original.unwrap().tex.id());
         app.session.active_mut().unwrap().channel_view.target = ChannelTarget::Alpha(1);
diff --git a/crates/ui-egui/src/font_preview.rs b/crates/ui-egui/src/font_preview.rs
index 678da4191c..58b1b20b15 100644
--- a/crates/ui-egui/src/font_preview.rs
+++ b/crates/ui-egui/src/font_preview.rs
@@ -123,7 +123,7 @@ fn key(ctx: &egui::Context, family: &str, size: f32) -> Key {
 pub(crate) fn slot_width(ctx: &egui::Context, family: &str, size: f32) -> f32 {
     let key = key(ctx, family, size);
     let arabic = ctx.data_mut(|d| {
-        let cache = d.get_temp_mut_or_default::<Cache>(egui::Id::new(CACHE_ID));
+        let cache = d.get_temp_mut_or_default::<Cache>(egui::Id::unique(CACHE_ID));
         cache.0.iter().any(|(k, samples)| k == &key && samples.as_ref().is_some_and(|s| s.arabic.is_some()))
     });
     if arabic { scaled(WIDTH, size) + GAP + scaled(ARABIC_WIDTH, size) } else { scaled(WIDTH, size) }
@@ -133,7 +133,7 @@ pub(crate) fn paint(ui: &egui::Ui, family: &str, row: Rect, size: f32) {
     let ctx = ui.ctx();
     let scale = ctx.pixels_per_point().ceil().clamp(1.0, 4.0) as u32;
     let key = key(ctx, family, size);
-    let id = egui::Id::new(CACHE_ID);
+    let id = egui::Id::unique(CACHE_ID);
     let cached = ctx.data_mut(|d| {
         let cache = d.get_temp_mut_or_default::<Cache>(id);
         let index = cache.0.iter().position(|(k, _)| k == &key)?;
diff --git a/crates/ui-egui/src/gallery_ui.rs b/crates/ui-egui/src/gallery_ui.rs
index b5e50734f9..aade41f2e9 100644
--- a/crates/ui-egui/src/gallery_ui.rs
+++ b/crates/ui-egui/src/gallery_ui.rs
@@ -80,6 +80,8 @@ pub struct GalleryDialog {
     background: [f32; 4],
     /// Screen px per document px (0 = fit) and the view centre (document px).
     pub zoom: f32,
+    /// The zoom Fit in View showed last (1 before the first frame).
+    fit: f32,
     center: [f32; 2],
     tex: Option<TextureHandle>,
     /// The key of the preview in `tex` and the document rect it covers.
@@ -365,6 +367,7 @@ fn open_on(
         foreground: colours[0],
         background: colours[1],
         zoom: 0.0,
+        fit: 1.0,
         center: [(canvas.x0 + canvas.x1) as f32 / 2.0, (canvas.y0 + canvas.y1) as f32 / 2.0],
         tex: None,
         shown: None,
@@ -437,9 +440,9 @@ pub fn control(app: &mut PhotocraftApp, ui: &Value) -> Result<Value, String> {
     d.history.settle(&d.effects, false);
     match ui.get("zoom") {
         Some(Value::String(s)) if s == "fit" => d.zoom = 0.0,
-        // The gallery's own preview zoom, not the canvas (`zoom_levels` doesn't apply): its − / +
-        // buttons and menu stop at 400 %, an agent may set up to 3200 %.
-        Some(v) if v.is_number() => d.zoom = (v.as_f64().unwrap_or(1.0) as f32).clamp(0.01, 32.0),
+        // The gallery's own preview zoom, not the canvas: its menu stops at 400 %, the − / +
+        // buttons, ⌘+ and an agent go up to 3200 %.
+        Some(v) if v.is_number() => d.zoom = (v.as_f64().unwrap_or(1.0) as f32).clamp(ZOOM_MIN, ZOOM_MAX),
         _ => {}
     }
     Ok(d.describe())
@@ -462,12 +465,39 @@ impl Drop for PreviewJob {
     }
 }
 
+/// The preview's zoom range (1 = 100 %), as Liquify's.
+const ZOOM_MIN: f32 = 0.01;
+const ZOOM_MAX: f32 = 32.0;
+
+/// Zoom In (`dir` > 0) or Zoom Out along the canvas's ladder, as Liquify's preview does (#7210),
+/// from the zoom on screen: Fit in View steps from the zoom it fits at, so zooming in from a
+/// large image's Fit never shrinks it, and zooming out from a Fit below [`ZOOM_MIN`] stays at Fit.
+fn step_zoom(d: &GalleryDialog, dir: i32) -> f32 {
+    let on_screen = if d.zoom > 0.0 { d.zoom } else { d.fit };
+    let next = crate::zoom_levels::step_in_range(on_screen, dir, ZOOM_MIN, ZOOM_MAX);
+    if d.zoom <= 0.0 && dir < 0 && next >= d.fit { 0.0 } else { next }
+}
+
+/// ⌘+ / ⌘− / ⌘0 / ⌘1 (or their overrides) zoom the preview like its − / + buttons, Fit in View
+/// and 100 %, not the canvas behind the dialog.
+pub fn keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    let nav = if app.distort.gallery.is_some() { crate::shortcuts::nav_shortcut(app, ctx) } else { None };
+    let (Some(d), Some(id)) = (app.distort.gallery.as_mut(), nav) else { return };
+    d.zoom = match id {
+        "view.zoomIn" => step_zoom(d, 1),
+        "view.zoomOut" => step_zoom(d, -1),
+        "view.fitOnScreen" => 0.0,
+        _ => 1.0,
+    };
+}
+
 /// The preview's zoom (screen px per document px), the visible document rect and the factor the
 /// texture is reduced by. Fit in View also recentres the view.
 fn view(d: &mut GalleryDialog, area: ERect) -> (f32, Rect, u32) {
     let (cw, ch) = (d.canvas.width().max(1) as f32, d.canvas.height().max(1) as f32);
     let zoom = if d.zoom > 0.0 { d.zoom } else { ((area.width() - 24.0) / cw).min((area.height() - 24.0) / ch).clamp(0.005, 1.0) };
     if d.zoom <= 0.0 {
+        d.fit = zoom;
         d.center = [d.canvas.x0 as f32 + cw / 2.0, d.canvas.y0 as f32 + ch / 2.0];
     }
     let (hw, hh) = (area.width() / zoom / 2.0, area.height() / zoom / 2.0);
@@ -608,7 +638,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let screen = ctx.content_rect();
     let mut action: Option<&str> = None;
     let background = app.background_jobs;
-    egui::Area::new(egui::Id::new("gallery-dialog")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
+    egui::Area::new(egui::Id::unique("gallery-dialog")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
         let Some(d) = app.distort.gallery.as_mut() else { return };
         d.history.settle(&d.effects, ctx.input(|i| i.pointer.any_down()));
         let (full, _) = ui.allocate_exact_size(screen.size(), Sense::hover());
@@ -635,7 +665,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
             clip.image(tex.id(), r, ERect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
             clip.rect_stroke(r, 0.0, Stroke::new(1.0, t.separator), egui::StrokeKind::Outside);
         }
-        let resp = ui.interact(area, egui::Id::new("gallery-preview"), Sense::drag());
+        let resp = ui.interact(area, egui::Id::unique("gallery-preview"), Sense::drag());
         if resp.dragged() && d.zoom > 0.0 {
             let dl = resp.drag_delta() / d.zoom;
             d.center = [d.center[0] - dl.x, d.center[1] - dl.y];
@@ -643,17 +673,22 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         // ---- Zoom bar ----
         painter.rect_filled(zoom_bar, 0.0, t.dock);
         let mut zb = ui.new_child(egui::UiBuilder::new().max_rect(zoom_bar.shrink2(vec2(10.0, 3.0))).layout(egui::Layout::left_to_right(egui::Align::Center)));
-        let steps = [0.0f32, 0.125, 0.25, 0.5, 1.0, 2.0, 4.0];
         if crate::icons::button(&mut zb, "minus", 22.0, false, tl!("Zoom out")).clicked() {
-            d.zoom = steps.iter().rev().copied().find(|&s| s > 0.0 && s < d.zoom.max(0.0) - 1e-3).unwrap_or(0.0);
+            d.zoom = step_zoom(d, -1);
         }
         if crate::icons::button(&mut zb, "plus", 22.0, false, tl!("Zoom in")).clicked() {
-            d.zoom = steps.iter().copied().find(|&s| s > d.zoom + 1e-3).unwrap_or(4.0);
+            d.zoom = step_zoom(d, 1);
         }
         let mut z = d.zoom;
-        let opts: Vec<(f32, &str)> =
+        let mut opts: Vec<(f32, &str)> =
             vec![(0.0, tl!("Fit in View")), (0.125, "12.5%"), (0.25, "25%"), (0.5, "50%"), (1.0, "100%"), (2.0, "200%"), (4.0, "400%")];
-        if widgets::dropdown(&mut zb, "gallery-zoom", &mut z, &opts, 110.0) {
+        // A zoom off the menu (stepped to 300 %, say) shows as itself, not as "—".
+        let off_menu = format!("{:.0}%", z * 100.0);
+        if !opts.iter().any(|(v, _)| *v == z) {
+            let at = opts.iter().position(|(v, _)| *v > z).unwrap_or(opts.len());
+            opts.insert(at, (z, &off_menu));
+        }
+        if widgets::dropdown(&mut zb, "gallery-zoom", tl!("Zoom"), &mut z, &opts, 110.0) {
             d.zoom = z;
         }
         if let Some(p) = d.rendering() {
@@ -738,7 +773,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         ru.add_space(4.0);
         let mut cur = d.effects[d.selected].filter;
         let names: Vec<(GalleryFilter, &str)> = GalleryFilter::ALL.iter().map(|f| (*f, f.name())).collect();
-        if widgets::dropdown(&mut ru, "gallery-filter", &mut cur, &names, inner.width() - 8.0) {
+        if widgets::dropdown(&mut ru, "gallery-filter", tl!("Filter"), &mut cur, &names, inner.width() - 8.0) {
             d.set_filter(cur);
         }
         widgets::hairline(&mut ru);
@@ -762,7 +797,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                         let opts: Vec<(String, &str)> = options.iter().cloned().zip(labels.iter().map(String::as_str)).collect();
                         ui.horizontal(|ui| {
                             ui.label(egui::RichText::new(tl!(&label)).color(t.text_dim));
-                            widgets::dropdown(ui, &format!("gallery-{}", p.key), &mut c, &opts, 140.0);
+                            widgets::dropdown(ui, &format!("gallery-{}", p.key), tl!(&label), &mut c, &opts, 140.0);
                         });
                         e.params.insert(p.key, json!(c));
                     }
@@ -879,6 +914,67 @@ mod tests {
         app
     }
 
+    /// ⌘+ / ⌘− step the preview along the canvas's zoom ladder as Liquify's do, from the zoom Fit
+    /// in View shows; ⌘0 fits it and ⌘1 is 100 %, through the canvas's own shortcuts; the canvas
+    /// behind keeps its zoom.
+    #[test]
+    fn zoom_shortcuts_zoom_the_preview_not_the_canvas() {
+        let ctx = egui::Context::default();
+        PhotocraftApp::setup_context(&ctx, crate::theme::ThemeKind::ALL[0]);
+        // Large enough that Fit in View is well under 100 % in a 1000 × 700 window.
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+        app.session.execute("file.new", json!({"width": 3000, "height": 2000})).unwrap();
+        app.sync_views();
+        open(&mut app).unwrap();
+        let canvas_zoom = app.ui.views.first().map(|v| v.zoom);
+        let mut run = |key: Option<egui::Key>| {
+            let events = key
+                .map(|key| egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND })
+                .into_iter()
+                .collect();
+            let screen = ERect::from_min_size(pos2(0.0, 0.0), vec2(1000.0, 700.0));
+            let raw = egui::RawInput { screen_rect: Some(screen), events, ..Default::default() };
+            let mut out = ctx.run_ui(raw, |ui| {
+                crate::shortcuts::handle(&mut app, ui.ctx());
+                show(&mut app, ui.ctx());
+            });
+            out.textures_delta.clear();
+            let d = app.distort.gallery.as_ref().unwrap();
+            (d.zoom, d.fit)
+        };
+        let (zoom, fit) = run(None);
+        assert_eq!(zoom, 0.0, "opens at Fit in View");
+        assert!(fit > 0.0 && fit < 0.5, "fits a 3000 px image well under 100 %: {fit}");
+        let step = |z, dir| crate::zoom_levels::step_in_range(z, dir, ZOOM_MIN, ZOOM_MAX);
+        let (zoom, _) = run(Some(egui::Key::Equals));
+        assert_eq!(zoom, step(fit, 1), "⌘= steps up from the fitted zoom, not from the menu's first entry");
+        assert!(zoom > fit);
+        assert_eq!(run(Some(egui::Key::Plus)).0, step(step(fit, 1), 1), "⌘+ typed as Plus too");
+        assert_eq!(run(Some(egui::Key::Num0)).0, 0.0, "Fit in View");
+        assert!(run(Some(egui::Key::Minus)).0 < fit, "⌘− steps down from the fitted zoom");
+        assert_eq!(run(Some(egui::Key::Num1)).0, 1.0);
+        assert_eq!(run(Some(egui::Key::Equals)).0, 2.0);
+        assert_eq!(run(Some(egui::Key::Equals)).0, 3.0, "past the menu's steps, on the canvas's ladder");
+        assert_eq!(run(Some(egui::Key::Minus)).0, 2.0);
+        assert!(app.distort.gallery.is_some(), "the dialog stays open");
+        assert_eq!(app.ui.views.first().map(|v| v.zoom), canvas_zoom, "the canvas behind keeps its zoom");
+    }
+
+    /// A huge image can fit below the 1 % minimum: Zoom Out keeps Fit in View rather than
+    /// enlarging it to 1 %, and Zoom In still steps up from there.
+    #[test]
+    fn zoom_out_from_a_fit_below_the_minimum_stays_at_fit() {
+        let mut app = app();
+        open(&mut app).unwrap();
+        let d = app.distort.gallery.as_mut().unwrap();
+        d.zoom = 0.0;
+        d.fit = 0.005;
+        assert_eq!(step_zoom(d, -1), 0.0, "no smaller zoom than Fit: stays at Fit in View");
+        assert!(step_zoom(d, 1) > d.fit);
+        d.fit = 0.05;
+        assert!(step_zoom(d, -1) > 0.0 && step_zoom(d, -1) < 0.05, "a Fit above the minimum still steps down");
+    }
+
     #[test]
     fn stack_editing_and_commit_match_the_engine() {
         let ctx = egui::Context::default();
diff --git a/crates/ui-egui/src/gpu_canvas.rs b/crates/ui-egui/src/gpu_canvas.rs
index d99db8c25e..5af1f71cef 100644
--- a/crates/ui-egui/src/gpu_canvas.rs
+++ b/crates/ui-egui/src/gpu_canvas.rs
@@ -120,6 +120,9 @@ pub struct GpuCanvas {
     /// [`canvas_budget`], shared with the paint callback's resources: [`GpuCanvas::format_for`]
     /// reads it while the renderer is locked.
     canvas_budget: std::sync::Arc<std::sync::atomic::AtomicU64>,
+    /// Camera Raw's preview pass, built the first time the dialog asks (#6419).
+    camera_raw: crate::camera_raw_gpu::Slot,
+    camera_raw_started: std::sync::Arc<std::sync::atomic::AtomicBool>,
 }
 
 /// Whether `regenerate_mips` builds each level in a scratch texture and copies it back: on
@@ -177,7 +180,7 @@ impl GpuCanvas {
             rs.target_format,
             vram.map_or_else(|| "unknown".to_owned(), |b| format!("{} MB", b >> 20))
         );
-        Self { rs: rs.clone(), tile, high, health, vram, canvas_budget: budget }
+        Self { rs: rs.clone(), tile, high, health, vram, canvas_budget: budget, camera_raw: Default::default(), camera_raw_started: Default::default() }
     }
 
     /// The device's health flag (shared with the wgpu compositor and the paint callback).
@@ -185,6 +188,42 @@ impl GpuCanvas {
         &self.health
     }
 
+    /// Camera Raw's GPU preview develop on this device; the first call starts building its
+    /// pipeline. `None` on a software adapter, without `Rgba32Float` render targets, after a
+    /// fault, or when the driver couldn't build the pipeline; the dialog then develops on the CPU.
+    pub(crate) fn camera_raw(&self) -> Option<crate::camera_raw_gpu::CameraRawGpu> {
+        if self.fault().is_some() {
+            return None;
+        }
+        if !self.camera_raw_started.swap(true, Ordering::AcqRel) {
+            crate::camera_raw_gpu::Pass::start(&self.rs.adapter, &self.rs.device, &self.camera_raw);
+        }
+        if matches!(self.camera_raw.get(), Some(None)) {
+            return None;
+        }
+        Some(crate::camera_raw_gpu::CameraRawGpu::new(self.rs.device.clone(), self.rs.queue.clone(), self.health.clone(), self.camera_raw.clone()))
+    }
+
+    /// Whether [`Self::camera_raw`] started building the pass.
+    #[cfg(test)]
+    pub(crate) fn camera_raw_started(&self) -> bool {
+        self.camera_raw_started.load(Ordering::Acquire)
+    }
+
+    /// Waits until the pass is built or refused.
+    #[cfg(test)]
+    pub(crate) fn wait_camera_raw_pass(&self) {
+        let _ = self.camera_raw.wait();
+    }
+
+    /// Builds Camera Raw's pass even where [`Self::camera_raw`] wouldn't (egui_kittest's software
+    /// adapter), so tests drive the GPU develop.
+    #[cfg(test)]
+    pub(crate) fn force_camera_raw_pass(&self) {
+        self.camera_raw_started.store(true, Ordering::Release);
+        let _ = self.camera_raw.set(crate::camera_raw_gpu::Pass::build_on(&self.rs.device));
+    }
+
     /// Why the GPU can't be used any more (`None` while it can).
     pub fn fault(&self) -> Option<photocraft_gpu::Fault> {
         self.health.fault()
@@ -990,15 +1029,15 @@ fn device_limits_for(backend: wgpu::Backend, supported: wgpu::Limits) -> wgpu::L
     wgpu::Limits { max_texture_dimension_2d: supported.max_texture_dimension_2d, max_buffer_size: supported.max_buffer_size, ..base }
 }
 
-/// Milliseconds since first call (monotonic). Always 0 on wasm, where `std::time` is unavailable.
+/// Milliseconds since the process (or page) started, from a monotonic clock.
+///
+/// `web_time::Instant` is `std::time::Instant` natively and `performance.now()` on wasm, so frame
+/// caps, autosave intervals, preference retry backoff, stroke traces and screenshot deadlines all
+/// measure durations the same way on both. The old wasm value was a constant 0, which made every
+/// interval comparison (`now >= deadline`) permanently false on the web.
 pub fn now_ms() -> f64 {
-    #[cfg(not(target_arch = "wasm32"))]
-    {
-        static START: std::sync::OnceLock<std::time::Instant> = std::sync::OnceLock::new();
-        START.get_or_init(std::time::Instant::now).elapsed().as_secs_f64() * 1000.0
-    }
-    #[cfg(target_arch = "wasm32")]
-    0.0
+    static START: std::sync::OnceLock<web_time::Instant> = std::sync::OnceLock::new();
+    START.get_or_init(web_time::Instant::now).elapsed().as_secs_f64() * 1000.0
 }
 
 /// UI-thread timings (CPU side), exponentially smoothed.
diff --git a/crates/ui-egui/src/gpu_status.rs b/crates/ui-egui/src/gpu_status.rs
index e00c384790..9ddd08bee1 100644
--- a/crates/ui-egui/src/gpu_status.rs
+++ b/crates/ui-egui/src/gpu_status.rs
@@ -263,7 +263,7 @@ pub fn show_fallback(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let t = crate::theme::Tokens::get(ctx);
     let mut choice = None;
     egui::Window::new(tl!("Switched to CPU rendering"))
-        .id(egui::Id::new("gpu-fallback-warning"))
+        .id(egui::Id::unique("gpu-fallback-warning"))
         .collapsible(false)
         .resizable(false)
         .default_width(440.0)
diff --git a/crates/ui-egui/src/gradient_ui.rs b/crates/ui-egui/src/gradient_ui.rs
index 5265c86066..a1d7574244 100644
--- a/crates/ui-egui/src/gradient_ui.rs
+++ b/crates/ui-egui/src/gradient_ui.rs
@@ -451,7 +451,7 @@ fn line(painter: &egui::Painter, a: Pos2, b: Pos2) {
     painter.line_segment([a, b], Stroke::new(1.5, Color32::WHITE));
 }
 
-fn diamond(painter: &egui::Painter, c: Pos2, r: f32, fill: Color32, outline: Color32) {
+pub(crate) fn diamond(painter: &egui::Painter, c: Pos2, r: f32, fill: Color32, outline: Color32) {
     let pts = vec![pos2(c.x, c.y - r), pos2(c.x + r, c.y), pos2(c.x, c.y + r), pos2(c.x - r, c.y)];
     painter.add(egui::Shape::convex_polygon(pts, fill, Stroke::new(1.0, outline)));
 }
@@ -513,7 +513,7 @@ pub fn draw_overlay(app: &PhotocraftApp, painter: &egui::Painter, xf: &ViewXform
 // ---------------------------------------------------------------- options bar
 
 /// A ramp of RGBA stops over a checkerboard in `r`.
-fn paint_ramp(p: &egui::Painter, r: Rect, sample: impl Fn(f32) -> [f32; 4]) {
+pub(crate) fn paint_ramp(p: &egui::Painter, r: Rect, sample: impl Fn(f32) -> [f32; 4]) {
     // The tessellator snaps the checker's rects to pixels but not the mesh: snap both alike, or a
     // half-pixel offset leaves a row of checker showing under the ramp (#4577).
     let r = r.round_to_pixels(p.pixels_per_point());
@@ -565,7 +565,7 @@ pub fn paint_thumbnail(ui: &egui::Ui, layer: LayerId, f: &Fill, rect: Rect) -> b
         return false;
     }
     let ctx = ui.ctx();
-    let key = egui::Id::new(("gradient-thumb", layer.0));
+    let key = egui::Id::unique(("gradient-thumb", layer.0));
     let cached: Option<(Fill, egui::TextureHandle)> = ctx.data(|d| d.get_temp(key));
     let tex = match cached {
         Some((cf, t)) if cf == *f => t,
@@ -596,7 +596,7 @@ pub fn preset_swatch(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> bool {
     paint_ramp(ui.painter(), r, |u| photocraft_algo::paint::sample_stops(&stops, u));
     ui.painter().rect_stroke(r, 0.0, Stroke::new(1.0, t.field_border), StrokeKind::Outside);
     // Name the control for accessibility (and so tests and agents can find it).
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Gradient picker")));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Gradient picker")));
     resp.on_hover_text(tl!("Click to edit the gradient")).clicked()
 }
 
@@ -622,7 +622,7 @@ pub fn editor_window(app: &mut PhotocraftApp, ctx: &egui::Context) {
     // Resolved before the closure so `app` is borrowed only once inside it.
     let layer = selected_gradient(app);
     egui::Window::new(tl!("Gradient Editor"))
-        .id(egui::Id::new("gradient-editor"))
+        .id(egui::Id::unique("gradient-editor"))
         .open(&mut open)
         .collapsible(false)
         .resizable(true)
@@ -745,8 +745,8 @@ impl Sink {
     /// Uniqueness for the drag state.
     fn key(self) -> egui::Id {
         match self {
-            Sink::Layer(id) => egui::Id::new(("gradient-stops-drag", id.0)),
-            Sink::Preset => egui::Id::new(("gradient-stops-drag", "preset")),
+            Sink::Layer(id) => egui::Id::unique(("gradient-stops-drag", id.0)),
+            Sink::Preset => egui::Id::unique(("gradient-stops-drag", "preset")),
         }
     }
     fn cmd(self) -> &'static str {
@@ -887,7 +887,7 @@ fn stop_strip(ui: &mut egui::Ui, key: egui::Id, f: &Fill, midpoints: bool, pendi
     let w = ui.available_width().max(120.0);
     let (outer, resp) = ui.allocate_exact_size(vec2(w, 58.0), Sense::click_and_drag());
     // Name the strip for accessibility (and so tests and agents can find it).
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), tl!("Gradient stops")));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tl!("Gradient stops")));
     let top = outer.top() + 16.0;
     let bar = Rect::from_min_max(pos2(outer.left() + 8.0, top), pos2(outer.right() - 8.0, top + 24.0));
     let x_of = |loc: f32| bar.left() + loc.clamp(0.0, 1.0) * bar.width();
diff --git a/crates/ui-egui/src/gradient_ui/properties_panel.rs b/crates/ui-egui/src/gradient_ui/properties_panel.rs
index d975102539..271118de40 100644
--- a/crates/ui-egui/src/gradient_ui/properties_panel.rs
+++ b/crates/ui-egui/src/gradient_ui/properties_panel.rs
@@ -87,7 +87,7 @@ fn numeric_row(ui: &mut egui::Ui, id: &str, name: &str, current: f32, range: std
     ui.push_id(id, |ui| {
         ui.horizontal(|ui| {
             let label = row_label(ui, name);
-            let key = ui.id().with("draft");
+            let key = ui.scope_id().with("draft");
             let mut value = ui.data(|d| d.get_temp::<f32>(key)).unwrap_or(current);
             let response = widgets::value_field(ui, &mut value, range, suffix, ui.available_width().min(88.0)).labelled_by(label.id);
             if response.dragged() || response.has_focus() {
@@ -130,7 +130,7 @@ fn style_button(ui: &mut egui::Ui, style: GradientStyle, selected: bool, name: &
     }
     ui.painter().add(egui::Shape::mesh(mesh));
     ui.painter().rect_stroke(preview, 0.0, Stroke::new(1.0, t.text_dim), StrokeKind::Outside);
-    response.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, ui.is_enabled(), selected, tl!(name)));
+    response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, ui.is_enabled(), selected, tl!(name)));
     response.on_hover_text(tl!(name))
 }
 
@@ -155,7 +155,7 @@ pub(super) fn stop_fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, sink: Sink
                 let rgb = color.to_rgb();
                 ui.painter().rect_filled(rect.shrink(2.0), Tokens::get(ui.ctx()).radius_sm, c32([rgb[0], rgb[1], rgb[2], 1.0]));
                 ui.painter().rect_stroke(rect, Tokens::get(ui.ctx()).radius_sm, Stroke::new(1.0, Tokens::get(ui.ctx()).field_border), StrokeKind::Inside);
-                response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), tl!("Color")));
+                response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tl!("Color")));
                 if response.on_hover_text(tl!("Color")).clicked() {
                     match sink {
                         Sink::Layer(id) => edit_stop_color(app, id, i),
@@ -202,7 +202,7 @@ pub(super) fn stop_fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, sink: Sink
         ui.add_space(72.0 + ui.spacing().item_spacing.x);
         ui.add_enabled_ui(count > 2, |ui| {
             let response = icons::button(ui, "trash", 24.0, false, "Delete");
-            response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), tl!("Delete")));
+            response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tl!("Delete")));
             if response.clicked() {
                 let _ = app.run(sink.cmd(), sink.params(json!({"action": "delete", "kind": kind, "index": index})));
                 ui.data_mut(|d| d.remove::<Marker>(key));
diff --git a/crates/ui-egui/src/guide_layout_ui.rs b/crates/ui-egui/src/guide_layout_ui.rs
index 894535e687..f44be59a84 100644
--- a/crates/ui-egui/src/guide_layout_ui.rs
+++ b/crates/ui-egui/src/guide_layout_ui.rs
@@ -190,9 +190,10 @@ fn check(ui: &mut egui::Ui, f: &mut Map<String, Value>, key: &str, label: &str,
     value
 }
 
-fn number(ui: &mut egui::Ui, f: &mut Map<String, Value>, key: &str, count: bool) {
+fn number(ui: &mut egui::Ui, f: &mut Map<String, Value>, key: &str, name: &str, count: bool) {
     let mut value = f.get(key).and_then(Value::as_f64).unwrap_or(0.0) as f32;
     if widgets::value_field(ui, &mut value, (if count { 1.0 } else { 0.0 })..=if count { 1000.0 } else { 300_000.0 }, if count { "" } else { "px" }, 68.0)
+        .accessible_name(tl!(name))
         .changed()
         // A disabled field still clamps its value into range (a zero count to 1); writing that
         // back would switch the axis on through its `positive` fallback (#5625).
@@ -202,14 +203,16 @@ fn number(ui: &mut egui::Ui, f: &mut Map<String, Value>, key: &str, count: bool)
     }
 }
 
-fn optional(ui: &mut egui::Ui, f: &mut Map<String, Value>, key: &str) {
+fn optional(ui: &mut egui::Ui, f: &mut Map<String, Value>, key: &str, label: egui::Id) {
     let mut value = match f.get(key) {
         Some(Value::String(s)) => s.clone(),
         Some(v) if v.is_number() => v.to_string(),
         _ => String::new(),
     };
     let t = Tokens::get(ui.ctx());
-    let response = ui.add(egui::TextEdit::singleline(&mut value).id_salt(key).desired_width(60.0).font(crate::theme::mono(12.0)).background_color(t.field));
+    let response = ui
+        .add(egui::TextEdit::singleline(&mut value).id_salt(key).desired_width(60.0).font(crate::theme::mono(12.0)).background_color(t.field))
+        .labelled_by(label);
     if ui.is_enabled() {
         crate::field_tab::register(ui.ctx(), response.id);
     }
@@ -242,13 +245,13 @@ fn axis(ui: &mut egui::Ui, f: &mut Map<String, Value>, rows: bool) {
         ui.add_enabled_ui(enabled, |ui| {
             egui::Grid::new(count).spacing([8.0, 6.0]).show(ui, |ui| {
                 ui.label(tl!("Number"));
-                number(ui, f, count, true);
+                number(ui, f, count, "Number", true);
                 ui.end_row();
-                ui.label(size_label);
-                optional(ui, f, size);
+                let size_label_resp = ui.label(size_label);
+                optional(ui, f, size, size_label_resp.id);
                 ui.end_row();
                 ui.label(tl!("Spacing"));
-                number(ui, f, gap, false);
+                number(ui, f, gap, "Spacing", false);
                 ui.end_row();
             });
         });
@@ -263,6 +266,7 @@ fn main_fields(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Value
         if widgets::dropdown(
             ui,
             "guide-preset",
+            tl!("Preset:"),
             &mut preset,
             &[("custom".into(), "Custom"), ("five".into(), "5 Columns, 3 Rows"), ("eight".into(), "8 Columns"), ("twelve".into(), "12 Columns")],
             222.0,
@@ -301,7 +305,7 @@ fn main_fields(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Value
         if !photocraft_engine::guide_layout::selected_artboards(&app.session).is_empty() {
             options.push(("selectedArtboards".into(), "Selected Artboards"));
         }
-        if widgets::dropdown(ui, "guide-target", &mut target, &options, 222.0) {
+        if widgets::dropdown(ui, "guide-target", tl!("Target"), &mut target, &options, 222.0) {
             f.insert("target".into(), json!(target));
         }
         ui.end_row();
@@ -313,7 +317,7 @@ fn main_fields(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Value
             ui.label(tl!("Color:"));
             let mut color = f.get("color").and_then(Value::as_str).unwrap_or("#4affff").to_string();
             let colors = color_options(&color);
-            if widgets::dropdown(ui, "guide-color", &mut color, &colors, 174.0) {
+            if widgets::dropdown(ui, "guide-color", tl!("Color"), &mut color, &colors, 174.0) {
                 f.insert("color".into(), json!(color));
             }
             let shown = rgb(&color).unwrap_or(Tokens::get(ui.ctx()).accent);
@@ -339,7 +343,7 @@ fn main_fields(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Value
                     ui.vertical(|ui| {
                         ui.label(label);
                         let mut n = value.as_f64().unwrap_or(0.0) as f32;
-                        if widgets::value_field(ui, &mut n, 0.0..=300_000.0, "px", 64.0).changed() {
+                        if widgets::value_field(ui, &mut n, 0.0..=300_000.0, "px", 64.0).accessible_name(label).changed() {
                             *value = json!(n);
                         }
                     });
diff --git a/crates/ui-egui/src/histogram_panel.rs b/crates/ui-egui/src/histogram_panel.rs
new file mode 100644
index 0000000000..74865f22da
--- /dev/null
+++ b/crates/ui-egui/src/histogram_panel.rs
@@ -0,0 +1,870 @@
+//! Histogram panel (Window › Histogram): Compact, Expanded and All Channels
+//! views, a channel and a source selector, statistics for the level under the pointer or a
+//! dragged tonal range, the cached-data warning and Uncached Refresh, and the adjusted histogram
+//! over the original while an adjustment previews.
+//!
+//! Histograms are counted off the UI thread (`tone::compute_histograms_at`) for the document
+//! revision, source and preview they describe, and kept until one of those changes; the panel
+//! shows the last one with the cached-data warning until the new one lands.
+
+use std::sync::Arc;
+
+use egui::{Color32, Rect, Sense, pos2, vec2};
+use photocraft_color::ColorMode;
+use photocraft_doc::adjust::ToneSpace;
+use photocraft_doc::{DocId, Document, LayerContent};
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, json};
+
+use crate::PhotocraftApp;
+use crate::theme::Tokens;
+use crate::tone::{self, HistSource, Histograms};
+
+/// Where the panel options are kept between launches (`prefs.dialogs`).
+const OPTIONS_PREF: &str = "histogramPanel";
+
+/// The panel's view (its menu's Compact / Expanded / All Channels View).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum HistView {
+    /// The histogram alone, of the entire image (Photoshop's default view).
+    #[default]
+    Compact,
+    /// The histogram with the channel and source selectors, refresh and statistics.
+    Expanded,
+    /// Expanded, plus one histogram per colour channel (no alpha, spot or mask channels).
+    AllChannels,
+}
+
+/// The Channel menu. Which entries a document offers depends on its colour mode
+/// ([`channel_options`]); one it lacks shows as its composite.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum HistChannel {
+    /// RGB, CMYK, Lab's Lightness or Gray.
+    #[default]
+    Composite,
+    Red,
+    Green,
+    Blue,
+    Cyan,
+    Magenta,
+    Yellow,
+    Black,
+    A,
+    B,
+    Luminosity,
+    /// The colour channels overlaid in their colours.
+    Colors,
+}
+
+/// What the histogram counts (the Source menu, shown for documents with several layers).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum HistSourceChoice {
+    /// The composite of every layer.
+    #[default]
+    EntireImage,
+    /// The selected layer on its own.
+    SelectedLayer,
+    /// The selected adjustment layer and every layer beneath it.
+    AdjustmentComposite,
+}
+
+/// The panel options (its menu and selectors), kept between launches.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct HistogramPanelState {
+    pub view: HistView,
+    /// Kept when the view changes (Expanded ↔ All Channels); in All Channels View it picks only
+    /// the top histogram.
+    pub channel: HistChannel,
+    /// Show Channels in Color: single channels in Expanded and All Channels View in their colour
+    /// (Compact View always colours them; Colors is always in colour).
+    pub show_channels_in_color: bool,
+    pub show_statistics: bool,
+    pub source: HistSourceChoice,
+}
+
+impl Default for HistogramPanelState {
+    fn default() -> Self {
+        Self {
+            view: HistView::Compact,
+            channel: HistChannel::Composite,
+            show_channels_in_color: false,
+            show_statistics: true,
+            source: HistSourceChoice::EntireImage,
+        }
+    }
+}
+
+/// Saves the panel options with the preferences.
+pub fn persist_options(app: &mut PhotocraftApp) {
+    if let Ok(value) = serde_json::to_value(app.ui.histogram_panel) {
+        app.session.prefs.edit(|p| {
+            p.dialogs.insert(OPTIONS_PREF.into(), value);
+        });
+    }
+}
+
+/// Restores the saved panel options; unreadable ones keep the defaults.
+pub fn restore_options(app: &mut PhotocraftApp) {
+    if let Some(v) = app.session.prefs().dialogs.get(OPTIONS_PREF)
+        && let Ok(state) = serde_json::from_value(v.clone())
+    {
+        app.ui.histogram_panel = state;
+    }
+}
+
+// ---------------------------------------------------------------------------------------------
+// Channels
+
+/// The channels a document in `mode` offers, with their labels, in menu order.
+pub fn channel_options(mode: ColorMode) -> Vec<(HistChannel, &'static str)> {
+    use HistChannel::*;
+    match tone_space(mode) {
+        _ if gray(mode) => vec![(Composite, "Gray")],
+        ToneSpace::Cmyk => vec![
+            (Composite, "CMYK"),
+            (Cyan, "Cyan"),
+            (Magenta, "Magenta"),
+            (Yellow, "Yellow"),
+            (Black, "Black"),
+            (Luminosity, "Luminosity"),
+            (Colors, "Colors"),
+        ],
+        ToneSpace::Lab => vec![(Composite, "Lightness"), (A, "a"), (B, "b"), (Luminosity, "Luminosity")],
+        ToneSpace::Rgb => vec![(Composite, "RGB"), (Red, "Red"), (Green, "Green"), (Blue, "Blue"), (Luminosity, "Luminosity"), (Colors, "Colors")],
+    }
+}
+
+fn gray(mode: ColorMode) -> bool {
+    matches!(mode, ColorMode::Grayscale | ColorMode::Bitmap | ColorMode::Duotone)
+}
+
+/// The space the panel counts a document of `mode` in.
+pub fn tone_space(mode: ColorMode) -> ToneSpace {
+    photocraft_engine::adjust_params::default_space(mode)
+}
+
+/// `want`, or the composite when a document of `mode` doesn't have it.
+pub fn resolve_channel(mode: ColorMode, want: HistChannel) -> HistChannel {
+    if channel_options(mode).iter().any(|(c, _)| *c == want) { want } else { HistChannel::Composite }
+}
+
+/// The single colour channels of a document of `mode` (All Channels View; Colors overlays them).
+pub fn color_channels(mode: ColorMode) -> &'static [HistChannel] {
+    use HistChannel::*;
+    match tone_space(mode) {
+        _ if gray(mode) => &[],
+        ToneSpace::Cmyk => &[Cyan, Magenta, Yellow, Black],
+        ToneSpace::Lab => &[A, B],
+        ToneSpace::Rgb => &[Red, Green, Blue],
+    }
+}
+
+/// The 256 bins of `channel` in `h` (counted in the space of a document of `mode`).
+pub fn bins(h: &Histograms, mode: ColorMode, channel: HistChannel) -> &[u32; 256] {
+    use HistChannel::*;
+    let i = match (tone_space(mode), channel) {
+        (_, Luminosity) => return &h.lum,
+        (ToneSpace::Rgb, Red) | (ToneSpace::Cmyk, Cyan) | (ToneSpace::Lab, A) => 1,
+        (ToneSpace::Rgb, Green) | (ToneSpace::Cmyk, Magenta) | (ToneSpace::Lab, B) => 2,
+        (ToneSpace::Rgb, Blue) | (ToneSpace::Cmyk, Yellow) => 3,
+        (ToneSpace::Cmyk, Black) => 4,
+        _ => 0,
+    };
+    &h[i]
+}
+
+/// The label a channel is listed under in a document of `mode`.
+pub fn channel_label(mode: ColorMode, channel: HistChannel) -> &'static str {
+    channel_options(mode).into_iter().find(|(c, _)| *c == channel).map_or("", |(_, l)| l)
+}
+
+/// The id of a channel (`ui.inspect`, the serde name).
+fn channel_id(channel: HistChannel) -> String {
+    serde_json::to_value(channel).ok().and_then(|v| v.as_str().map(str::to_string)).unwrap_or_default()
+}
+
+/// The colour a single channel draws in (saturated, as in All Channels View).
+pub fn channel_paint(channel: HistChannel) -> Option<Color32> {
+    use HistChannel::*;
+    Some(match channel {
+        Red => Color32::from_rgb(235, 30, 30),
+        Green => Color32::from_rgb(30, 235, 30),
+        Blue => Color32::from_rgb(40, 40, 240),
+        Cyan => Color32::from_rgb(0, 200, 235),
+        Magenta => Color32::from_rgb(230, 0, 160),
+        Yellow => Color32::from_rgb(240, 220, 0),
+        Black => Color32::from_gray(110),
+        A => Color32::from_rgb(220, 90, 140),
+        B => Color32::from_rgb(200, 180, 60),
+        _ => return None,
+    })
+}
+
+/// The level of `channel` at a straight RGBA 0..1 pixel, as the histogram bins it (the Color
+/// Sampler marks).
+pub fn channel_level(mode: ColorMode, channel: HistChannel, rgba: [f32; 4]) -> u8 {
+    use HistChannel::*;
+    let rgb = [rgba[0], rgba[1], rgba[2]].map(|v| if v.is_nan() { 0.0 } else { v.clamp(0.0, 1.0) });
+    let q = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
+    let lum = || q(rgb.iter().zip(tone::LUMINOSITY).map(|(v, w)| v * w).sum());
+    match (tone_space(mode), channel) {
+        (_, Luminosity) => lum(),
+        (ToneSpace::Rgb, Red) => q(rgb[0]),
+        (ToneSpace::Rgb, Green) => q(rgb[1]),
+        (ToneSpace::Rgb, Blue) => q(rgb[2]),
+        (ToneSpace::Rgb, _) => ((u16::from(q(rgb[0])) + u16::from(q(rgb[1])) + u16::from(q(rgb[2]))) / 3) as u8,
+        (ToneSpace::Cmyk, c) => {
+            let ink = photocraft_color::convert::rgb_to_cmyk(rgb);
+            let v = match c {
+                Cyan => ink[0],
+                Magenta => ink[1],
+                Yellow => ink[2],
+                Black => ink[3],
+                _ => ink.iter().sum::<f32>() / 4.0,
+            };
+            q(1.0 - v)
+        }
+        (ToneSpace::Lab, c) => {
+            let l = photocraft_color::convert::srgb_to_lab(rgb);
+            match c {
+                A => q((l[1] + 128.0) / 255.0),
+                B => q((l[2] + 128.0) / 255.0),
+                _ => q(l[0] / 100.0),
+            }
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------------------------
+// Statistics
+
+/// The Histogram statistics. Mean, Std Dev, Median and Pixels describe the whole
+/// histogram; Level, Count and Percentile the level under the pointer or the dragged range.
+#[derive(Clone, Copy, Debug, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Stats {
+    pub mean: f64,
+    pub std_dev: f64,
+    pub median: u8,
+    pub pixels: u64,
+    /// The inspected levels, `lo..=hi` (one level when they are equal), if any.
+    pub level: Option<[u8; 2]>,
+    /// Pixels at the inspected levels.
+    pub count: Option<u64>,
+    /// Percent of the pixels at or below the inspected level; for a range, in it.
+    pub percentile: Option<f64>,
+    /// Percent of the pixels at 0 and at 255: shadow and highlight clipping.
+    pub clipped: [f64; 2],
+}
+
+/// The statistics of `h`, inspecting `levels` (a level or a range, in either order). None when
+/// nothing was counted.
+pub fn stats(h: &[u32; 256], levels: Option<[u8; 2]>) -> Option<Stats> {
+    let n: u64 = h.iter().map(|v| u64::from(*v)).sum();
+    if n == 0 {
+        return None;
+    }
+    let nf = n as f64;
+    let mean = h.iter().enumerate().map(|(i, v)| i as f64 * f64::from(*v)).sum::<f64>() / nf;
+    let var = h.iter().enumerate().map(|(i, v)| (i as f64 - mean).powi(2) * f64::from(*v)).sum::<f64>() / nf;
+    let mut acc = 0u64;
+    let median = h
+        .iter()
+        .position(|v| {
+            acc += u64::from(*v);
+            acc * 2 >= n
+        })
+        .unwrap_or(0) as u8;
+    let level = levels.map(|[a, b]| [a.min(b), a.max(b)]);
+    let sum = |lo: u8, hi: u8| h.get(usize::from(lo)..=usize::from(hi)).map_or(0, |s| s.iter().map(|v| u64::from(*v)).sum::<u64>());
+    let count = level.map(|[lo, hi]| sum(lo, hi));
+    let percentile = level.map(|[lo, hi]| 100.0 * if lo == hi { sum(0, hi) } else { sum(lo, hi) } as f64 / nf);
+    let clipped = [100.0 * f64::from(h[0]) / nf, 100.0 * f64::from(h[255]) / nf];
+    Some(Stats { mean, std_dev: var.sqrt(), median, pixels: n, level, count, percentile, clipped })
+}
+
+// ---------------------------------------------------------------------------------------------
+// Computing and caching
+
+/// What one panel histogram was counted from.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct HistKey {
+    pub doc: DocId,
+    pub revision: u64,
+    /// `tone::tag` of the source and space.
+    pub source: u64,
+    /// The adjustment preview's display key; 0 for the document itself.
+    pub preview: u64,
+    /// The highest cache level allowed (1: an Uncached Refresh).
+    pub max_level: u32,
+}
+
+/// A counted panel histogram.
+#[derive(Clone, Debug)]
+pub struct PanelHist {
+    pub key: HistKey,
+    /// When it landed (ms), for throttling recounts while the document keeps changing.
+    pub at: f64,
+    pub hist: Arc<Histograms>,
+}
+
+/// A histogram being counted off the UI thread: its key, and the receiver of (key, ms, result).
+pub(crate) type HistJob = (HistKey, std::sync::mpsc::Receiver<(HistKey, f64, Arc<Histograms>)>);
+
+/// The source the panel counts for `choice` in `st`: Entire Image whenever the choice doesn't
+/// apply (a single layer, no selected layer, or Adjustment Composite without an adjustment layer
+/// selected).
+pub fn resolve_source(st: &photocraft_engine::DocState, choice: HistSourceChoice) -> (HistSourceChoice, HistSource) {
+    if st.doc.layer_count() < 2 {
+        return (HistSourceChoice::EntireImage, tone::IMAGE);
+    }
+    let selected = st.active_layer.and_then(|id| st.doc.layer(id));
+    match (choice, selected) {
+        (HistSourceChoice::SelectedLayer, Some(l)) => (choice, HistSource::Layer(l.id)),
+        (HistSourceChoice::AdjustmentComposite, Some(l)) if matches!(l.content, LayerContent::Adjustment(_)) => (choice, HistSource::UpTo(l.id)),
+        _ => (HistSourceChoice::EntireImage, tone::IMAGE),
+    }
+}
+
+/// Whether Adjustment Composite applies to `st` (an adjustment layer is selected).
+fn adjustment_selected(st: &photocraft_engine::DocState) -> bool {
+    st.active_layer.and_then(|id| st.doc.layer(id)).is_some_and(|l| matches!(l.content, LayerContent::Adjustment(_)))
+}
+
+/// Preferences › Performance › Cache Levels: the highest level the panel counts at by default.
+fn max_cache_level(app: &PhotocraftApp) -> u32 {
+    app.session.prefs().performance.cache_levels.clamp(1, tone::MAX_CACHE_LEVEL)
+}
+
+/// The source the panel counts: Compact View shows no Source menu and represents the entire image.
+fn source_choice(opts: &HistogramPanelState) -> HistSourceChoice {
+    if opts.view == HistView::Compact { HistSourceChoice::EntireImage } else { opts.source }
+}
+
+/// The key of the document's histogram the panel wants now, with the space and source it counts.
+fn committed_key(app: &PhotocraftApp) -> Option<(HistKey, ToneSpace, HistSource)> {
+    let st = app.session.active()?;
+    let (doc, revision) = (st.doc.id, st.revision);
+    let space = tone_space(st.doc.mode);
+    let (_, source) = resolve_source(st, source_choice(&app.ui.histogram_panel));
+    let max_level = if app.hist_uncached == Some((doc, revision)) { 1 } else { max_cache_level(app) };
+    Some((HistKey { doc, revision, source: tone::tag(source, space), preview: 0, max_level }, space, source))
+}
+
+/// The document an open adjustment previews on the canvas (an Image › Adjustments dialog through
+/// its preview layer, or an adjustment layer's Properties drag) and its display key.
+fn adjustment_preview(app: &mut PhotocraftApp) -> Option<(Arc<Document>, u64)> {
+    let idx = app.session.active_index()?;
+    if let Some(shown) = crate::adjust_preview::display_doc(app, idx) {
+        return Some(shown);
+    }
+    app.live_adjust.as_ref()?;
+    let (doc, key) = crate::canvas::display_doc(app, idx);
+    (key != 0).then_some((doc, key))
+}
+
+/// What the panel wants shown now: the document's histogram key, and the preview's document and
+/// key while an adjustment previews.
+struct Want {
+    committed: HistKey,
+    preview: Option<(Arc<Document>, HistKey)>,
+    space: ToneSpace,
+    source: HistSource,
+}
+
+fn want(app: &mut PhotocraftApp) -> Option<Want> {
+    let preview = adjustment_preview(app);
+    let (committed, space, source) = committed_key(app)?;
+    let preview = preview.map(|(d, k)| (d, HistKey { preview: k | 1, ..committed }));
+    Some(Want { committed, preview, space, source })
+}
+
+/// Brings the panel's histograms up to date as far as one frame should: lands a finished count,
+/// keeps entries a view-only revision didn't invalidate, and starts the next count (at most one at
+/// a time, at most every 250 ms per entry). `ctx` repaints when a worker delivers.
+pub fn update(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    // A finished worker lands its histogram in the slot its key names. A worker that died
+    // without sending clears the job so the next frame schedules a new one.
+    if let Some((_, rx)) = &app.hist_job {
+        match rx.try_recv() {
+            Ok((key, ms, hist)) => {
+                app.perf.span("histogram", ms);
+                // egui's clock works on every target; `gpu_canvas::now_ms` is always 0 on wasm32.
+                let entry = PanelHist { key, at: ctx.input(|i| i.time) * 1000.0, hist };
+                if key.preview == 0 {
+                    app.doc_hist = Some(entry);
+                } else {
+                    app.doc_hist_preview = Some(entry);
+                }
+                app.hist_job = None;
+            }
+            Err(std::sync::mpsc::TryRecvError::Disconnected) => app.hist_job = None,
+            Err(std::sync::mpsc::TryRecvError::Empty) => {}
+        }
+    }
+    // A revision that changed no pixels (selecting a layer, say) keeps the histogram of the one
+    // before (#125), and an Uncached Refresh with it.
+    if let Some(st) = app.session.active()
+        && tone::view_only(st)
+    {
+        let (doc, rev) = (st.doc.id, st.revision);
+        if app.hist_uncached == Some((doc, rev.wrapping_sub(1))) {
+            app.hist_uncached = Some((doc, rev));
+        }
+        if let Some(e) = app.doc_hist.as_mut()
+            && e.key.doc == doc
+            && e.key.revision.wrapping_add(1) == rev
+        {
+            e.key.revision = rev;
+        }
+    }
+    let Some(want) = want(app) else { return };
+    if want.preview.is_none() {
+        app.doc_hist_preview = None;
+    }
+    if app.hist_job.is_some() {
+        ctx.request_repaint_after(std::time::Duration::from_millis(30));
+        return;
+    }
+    let now = ctx.input(|i| i.time) * 1000.0;
+    let due = |e: &Option<PanelHist>| e.as_ref().is_none_or(|e| e.key.doc != want.committed.doc || now - e.at > 250.0);
+    let stale = |e: &Option<PanelHist>, k: &HistKey| e.as_ref().is_none_or(|e| e.key != *k);
+    // An Uncached Refresh is asked for, so it doesn't wait out the throttle (Cache Levels 1 alone
+    // counts at level 1 too, and still waits).
+    let forced = app.hist_uncached == Some((want.committed.doc, want.committed.revision));
+    let job = if stale(&app.doc_hist, &want.committed) {
+        (forced || due(&app.doc_hist)).then(|| (app.session.active().map(|st| st.doc.clone()), want.committed))
+    } else if let Some((doc, key)) = &want.preview
+        && stale(&app.doc_hist_preview, key)
+    {
+        due(&app.doc_hist_preview).then(|| (Some(doc.clone()), *key))
+    } else {
+        None
+    };
+    match job {
+        Some((Some(doc), key)) => spawn(app, ctx, doc, key, want.source, want.space),
+        Some((None, _)) => {}
+        None if stale(&app.doc_hist, &want.committed) || want.preview.as_ref().is_some_and(|(_, k)| stale(&app.doc_hist_preview, k)) => {
+            ctx.request_repaint_after(std::time::Duration::from_millis(260));
+        }
+        None => {}
+    }
+}
+
+/// Counts `doc` for `key` on a worker thread (inline on the web, where there are none, or when a
+/// spawn fails), delivered through `app.hist_job`.
+fn spawn(app: &mut PhotocraftApp, ctx: &egui::Context, doc: Arc<Document>, key: HistKey, source: HistSource, space: ToneSpace) {
+    let (tx, rx) = std::sync::mpsc::channel();
+    #[cfg(not(target_arch = "wasm32"))]
+    let spawned = {
+        let doc = doc.clone();
+        let tx = tx.clone();
+        let ctx = ctx.clone();
+        std::thread::Builder::new()
+            .name("histogram".into())
+            .spawn(move || {
+                let t0 = crate::gpu_canvas::now_ms();
+                let h = Arc::new(tone::compute_histograms_at(&doc, source, space, key.max_level));
+                let _ = tx.send((key, crate::gpu_canvas::now_ms() - t0, h));
+                ctx.request_repaint();
+            })
+            .is_ok()
+    };
+    #[cfg(target_arch = "wasm32")]
+    let spawned = {
+        let _ = ctx;
+        false
+    };
+    if !spawned {
+        let t0 = crate::gpu_canvas::now_ms();
+        let h = Arc::new(tone::compute_histograms_at(&doc, source, space, key.max_level));
+        let _ = tx.send((key, crate::gpu_canvas::now_ms() - t0, h));
+    }
+    app.hist_job = Some((key, rx));
+}
+
+/// Uncached Refresh: recount the active document's current state at cache level 1 (every pixel).
+pub fn uncached_refresh(app: &mut PhotocraftApp) {
+    if let Some(st) = app.session.active() {
+        app.hist_uncached = Some((st.doc.id, st.revision));
+    }
+}
+
+/// The histogram the panel shows now: the preview's while an adjustment previews (with the
+/// document's as the original), else the document's. `stale` when it isn't the one wanted yet.
+struct Shown {
+    hist: Arc<Histograms>,
+    original: Option<Arc<Histograms>>,
+    stale: bool,
+    mode: ColorMode,
+    layers: usize,
+    adjustment: bool,
+}
+
+fn shown(app: &mut PhotocraftApp) -> Option<Shown> {
+    let want = want(app)?;
+    let st = app.session.active()?;
+    let (mode, layers, adjustment) = (st.doc.mode, st.doc.layer_count(), adjustment_selected(st));
+    let same_doc = |e: &PanelHist| e.key.doc == want.committed.doc;
+    let committed = app.doc_hist.as_ref().filter(|e| same_doc(e));
+    let preview = app.doc_hist_preview.as_ref().filter(|e| same_doc(e) && want.preview.is_some());
+    Some(match (preview, committed) {
+        (Some(p), c) => Shown {
+            hist: p.hist.clone(),
+            original: c.map(|c| c.hist.clone()),
+            stale: want.preview.as_ref().is_none_or(|(_, k)| *k != p.key),
+            mode,
+            layers,
+            adjustment,
+        },
+        (None, Some(c)) => Shown { hist: c.hist.clone(), original: None, stale: c.key != want.committed || want.preview.is_some(), mode, layers, adjustment },
+        (None, None) => return None,
+    })
+}
+
+// ---------------------------------------------------------------------------------------------
+// Drawing
+
+/// One histogram and its colour, for [`draw_overlaid`].
+type Layer<'a> = (&'a [u32; 256], Color32);
+
+/// The colour of a band covered by `covering`: additive for light channels (red over green is
+/// yellow, all three grey), multiplied for inks (cyan over magenta is blue).
+fn mix(covering: impl Iterator<Item = Color32>, multiply: bool) -> Color32 {
+    if multiply {
+        covering.fold(Color32::WHITE, |a, b| {
+            Color32::from_rgb(
+                (u16::from(a.r()) * u16::from(b.r()) / 255) as u8,
+                (u16::from(a.g()) * u16::from(b.g()) / 255) as u8,
+                (u16::from(a.b()) * u16::from(b.b()) / 255) as u8,
+            )
+        })
+    } else {
+        covering.fold(Color32::BLACK, |a, b| Color32::from_rgb(a.r().saturating_add(b.r()), a.g().saturating_add(b.g()), a.b().saturating_add(b.b())))
+    }
+}
+
+/// Draws `layers` overlaid on one shared scale, each outlined like [`tone::draw_histogram`]
+/// (straight lines between the bin centres, down to the baseline at both ends). Where several
+/// cover a band it takes their [`mix`]ed colour. Each span between two centres is split where
+/// outlines cross, so the channel order is constant within every piece and the bands are exact
+/// trapezoids: no steps, and no draw-order-dependent blending.
+fn draw_overlaid(p: &egui::Painter, r: Rect, layers: &[Layer<'_>], multiply: bool) {
+    p.add(overlaid_mesh(r, layers, multiply));
+}
+
+fn overlaid_mesh(r: Rect, layers: &[Layer<'_>], multiply: bool) -> egui::Mesh {
+    let top = layers.iter().map(|(h, _)| tone::histogram_scale_top(h)).fold(1.0f32, f32::max);
+    // Outline points: the left baseline, the 256 bin centres, the right baseline (heights 0..1).
+    let xs: Vec<f32> =
+        std::iter::once(r.left()).chain((0..256).map(|i| r.left() + (i as f32 + 0.5) / 256.0 * r.width())).chain(std::iter::once(r.right())).collect();
+    let height = |h: &[u32; 256], i: usize| if i == 0 || i > 256 { 0.0 } else { (h.get(i - 1).copied().unwrap_or(0) as f32 / top).min(1.0) };
+    let mut mesh = egui::Mesh::default();
+    let y = |v: f32| r.bottom() - v * r.height();
+    for i in 0..xs.len().saturating_sub(1) {
+        let (Some(&x0), Some(&x1)) = (xs.get(i), xs.get(i + 1)) else { continue };
+        let a: Vec<f32> = layers.iter().map(|(h, _)| height(h, i)).collect();
+        let b: Vec<f32> = layers.iter().map(|(h, _)| height(h, i + 1)).collect();
+        // Where any two outlines cross within the span (as a fraction of it).
+        let mut cuts = vec![0.0f32, 1.0];
+        for j in 0..layers.len() {
+            for k in j + 1..layers.len() {
+                let (Some(aj), Some(bj), Some(ak), Some(bk)) = (a.get(j), b.get(j), a.get(k), b.get(k)) else { continue };
+                let d = (bj - aj) - (bk - ak);
+                if d.abs() > f32::EPSILON {
+                    let t = (ak - aj) / d;
+                    if t > 0.0 && t < 1.0 {
+                        cuts.push(t);
+                    }
+                }
+            }
+        }
+        cuts.sort_by(f32::total_cmp);
+        for w in cuts.windows(2) {
+            let (t0, t1) = (w[0], w[1]);
+            if t1 - t0 <= f32::EPSILON {
+                continue;
+            }
+            let at = |t: f32| -> Vec<f32> { a.iter().zip(&b).map(|(a, b)| a + (b - a) * t).collect() };
+            let (left, right, mid) = (at(t0), at(t1), at((t0 + t1) / 2.0));
+            let mut order: Vec<usize> = (0..layers.len()).collect();
+            order.sort_by(|&m, &n| mid.get(m).copied().unwrap_or(0.0).total_cmp(&mid.get(n).copied().unwrap_or(0.0)));
+            let (px0, px1) = (x0 + (x1 - x0) * t0, x0 + (x1 - x0) * t1);
+            // Bottom up: each band is covered by the channels at least that tall.
+            let (mut below_l, mut below_r) = (0.0f32, 0.0f32);
+            for (n, &c) in order.iter().enumerate() {
+                let (Some(&tl), Some(&tr)) = (left.get(c), right.get(c)) else { continue };
+                if tl > below_l || tr > below_r {
+                    let color = mix(order.iter().skip(n).filter_map(|&m| layers.get(m).map(|l| l.1)), multiply);
+                    let v = mesh.vertices.len() as u32;
+                    for q in [pos2(px0, y(below_l)), pos2(px0, y(tl)), pos2(px1, y(tr)), pos2(px1, y(below_r))] {
+                        mesh.colored_vertex(q, color);
+                    }
+                    mesh.add_triangle(v, v + 1, v + 2);
+                    mesh.add_triangle(v, v + 2, v + 3);
+                }
+                (below_l, below_r) = (tl.max(below_l), tr.max(below_r));
+            }
+        }
+    }
+    mesh
+}
+
+/// The colour a single-channel graph draws in: its channel colour when colourised, else the
+/// composite grey.
+fn graph_color(channel: HistChannel, colored: bool, t: &Tokens) -> Color32 {
+    let grey = if t.pro { Color32::from_gray(215) } else { Color32::from_gray(70) };
+    if colored { channel_paint(channel).unwrap_or(grey) } else { grey }
+}
+
+/// Draws `channel` of `h` in `r` (Colors overlays the colour channels).
+fn draw_channel(p: &egui::Painter, r: Rect, h: &Histograms, mode: ColorMode, channel: HistChannel, colored: bool, t: &Tokens) {
+    if channel == HistChannel::Colors {
+        let layers: Vec<Layer<'_>> = color_channels(mode).iter().filter_map(|c| Some((bins(h, mode, *c), channel_paint(*c)?))).collect();
+        draw_overlaid(p, r, &layers, tone_space(mode) == ToneSpace::Cmyk);
+    } else {
+        tone::draw_histogram(p, r, bins(h, mode, channel), graph_color(channel, colored, t));
+    }
+}
+
+/// The histogram graph with its marks and pointer interaction. Returns the levels under the
+/// pointer (hover) for the statistics.
+fn graph(app: &mut PhotocraftApp, ui: &mut egui::Ui, s: &Shown, channel: HistChannel, colored: bool, height: f32) -> Option<u8> {
+    let t = Tokens::get(ui.ctx());
+    let w = ui.available_width();
+    let (r, resp) = ui.allocate_exact_size(vec2(w, height), Sense::click_and_drag());
+    let p = ui.painter_at(r);
+    p.rect_filled(r, 0.0, t.field);
+    let level_at = |x: f32| (((x - r.left()) / r.width().max(1.0)) * 256.0).floor().clamp(0.0, 255.0) as u8;
+    let x_of = |l: u8| r.left() + (f32::from(l) + 0.5) / 256.0 * r.width();
+    // The selected range behind the bars.
+    if let Some([a, b]) = app.ui.histogram_range {
+        let (lo, hi) = (a.min(b), a.max(b));
+        let band = Rect::from_x_y_ranges(r.left() + f32::from(lo) / 256.0 * r.width()..=r.left() + (f32::from(hi) + 1.0) / 256.0 * r.width(), r.y_range());
+        p.rect_filled(band, 0.0, t.accent.gamma_multiply(0.35));
+    }
+    draw_channel(&p, r, &s.hist, s.mode, channel, colored, &t);
+    // The original histogram outlined over the adjusted one while an adjustment previews.
+    if let Some(o) = &s.original {
+        outline(&p, r, bins(o, s.mode, if channel == HistChannel::Colors { HistChannel::Composite } else { channel }), t.text);
+    }
+    // The Color Samplers' levels.
+    let mark_channel = if channel == HistChannel::Colors { HistChannel::Composite } else { channel };
+    for v in crate::panels::sampler_readouts(app).iter() {
+        let rgb = v["rgb"].as_array().map(|a| a.iter().filter_map(Value::as_f64).map(|c| (c / 255.0) as f32).collect::<Vec<_>>()).unwrap_or_default();
+        let (Some(&red), Some(&green), Some(&blue)) = (rgb.first(), rgb.get(1), rgb.get(2)) else { continue };
+        let x = x_of(channel_level(s.mode, mark_channel, [red, green, blue, 1.0]));
+        p.line_segment([pos2(x, r.bottom() - 9.0), pos2(x, r.bottom())], egui::Stroke::new(1.5, t.text));
+        p.text(pos2(x + 2.0, r.bottom() - 9.0), egui::Align2::LEFT_BOTTOM, v["number"].to_string(), egui::FontId::proportional(9.0), t.text);
+    }
+    // The cached-data warning: click it (or double-click the graph) for an Uncached Refresh.
+    if s.stale || s.hist.level > 1 {
+        let icon = Rect::from_min_size(r.right_top() + vec2(-18.0, 2.0), vec2(16.0, 16.0));
+        crate::icons::paint(ui, icon, "triangle-alert", 12.0, t.warning);
+        let warn =
+            ui.interact(icon, ui.scope_id().with("hist-cached-warning"), Sense::click()).on_hover_text(tl!("Click to refresh histogram with uncached data"));
+        if warn.clicked() {
+            uncached_refresh(app);
+        }
+    }
+    if resp.double_clicked() {
+        uncached_refresh(app);
+    }
+    let pointer = resp.interact_pointer_pos().or_else(|| resp.hover_pos());
+    let id = ui.scope_id().with("hist-drag-from");
+    if resp.drag_started()
+        && let Some(pos) = resp.interact_pointer_pos()
+    {
+        ui.data_mut(|d| d.insert_temp(id, level_at(pos.x)));
+    }
+    if resp.dragged()
+        && let (Some(from), Some(pos)) = (ui.data(|d| d.get_temp::<u8>(id)), pointer)
+    {
+        app.ui.histogram_range = Some([from, level_at(pos.x)]);
+    } else if resp.clicked() {
+        app.ui.histogram_range = None;
+    }
+    pointer.filter(|_| resp.hovered() || resp.dragged()).map(|pos| level_at(pos.x))
+}
+
+/// The outline of `h` (the original histogram over an adjusted one).
+fn outline(p: &egui::Painter, r: Rect, h: &[u32; 256], color: Color32) {
+    let top = tone::histogram_scale_top(h);
+    let pts: Vec<_> = h
+        .iter()
+        .enumerate()
+        .map(|(i, v)| pos2(r.left() + (i as f32 + 0.5) / 256.0 * r.width(), r.bottom() - (*v as f32 / top).min(1.0) * r.height()))
+        .collect();
+    p.add(egui::Shape::line(pts, egui::Stroke::new(1.0, color.gamma_multiply(0.8))));
+}
+
+/// The statistics grid: Mean, Std Dev, Median, Pixels | Level, Count, Percentile, Cache Level.
+fn statistics(ui: &mut egui::Ui, h: &Histograms, mode: ColorMode, channel: HistChannel, levels: Option<[u8; 2]>, t: &Tokens) {
+    let ch = if channel == HistChannel::Colors { HistChannel::Composite } else { channel };
+    let Some(s) = stats(bins(h, mode, ch), levels) else { return };
+    let level = match s.level {
+        Some([a, b]) if a == b => a.to_string(),
+        Some([a, b]) => format!("{a}..{b}"),
+        None => String::new(),
+    };
+    let rows = [
+        (tl!("Mean:"), format!("{:.2}", s.mean), tl!("Level:"), level),
+        (tl!("Std Dev:"), format!("{:.2}", s.std_dev), tl!("Count:"), s.count.map(|c| c.to_string()).unwrap_or_default()),
+        (tl!("Median:"), s.median.to_string(), tl!("Percentile:"), s.percentile.map(|p| format!("{p:.2}")).unwrap_or_default()),
+        (tl!("Pixels:"), s.pixels.to_string(), tl!("Cache Level:"), h.level.max(1).to_string()),
+    ];
+    let mono = crate::theme::mono(11.5);
+    egui::Grid::new("hist-stats").num_columns(4).spacing(vec2(6.0, 2.0)).show(ui, |ui| {
+        for (k1, v1, k2, v2) in rows {
+            for (k, v) in [(k1, v1), (k2, v2)] {
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    ui.label(egui::RichText::new(k).color(t.text_dim).size(11.5));
+                });
+                ui.label(egui::RichText::new(v).font(mono.clone()).color(t.text));
+            }
+            ui.end_row();
+        }
+    });
+}
+
+/// Histogram panel (Window › Histogram).
+pub fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
+    let t = Tokens::get(ui.ctx());
+    if app.session.active().is_none() {
+        ui.label(egui::RichText::new(tl!("No document")).color(t.text_faint));
+        return;
+    }
+    update(app, ui.ctx());
+    let Some(s) = shown(app) else {
+        ui.label(egui::RichText::new(tl!("Calculating…")).color(t.text_faint));
+        return;
+    };
+    let opts = app.ui.histogram_panel;
+    let channel = resolve_channel(s.mode, opts.channel);
+    if opts.view == HistView::Compact {
+        // Compact View: the graph alone; a single channel is always in its colour.
+        graph(app, ui, &s, channel, true, 100.0);
+        return;
+    }
+    let mut changed = false;
+    ui.horizontal(|ui| {
+        ui.label(egui::RichText::new(tl!("Channel:")).color(t.text_dim).size(12.0));
+        let mut ch = channel;
+        let options = channel_options(s.mode);
+        if crate::widgets::dropdown(ui, "histogram-panel-ch", tl!("Channel"), &mut ch, &options, 110.0) {
+            app.ui.histogram_panel.channel = ch;
+            changed = true;
+        }
+        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            if crate::icons::button(ui, "rotate-cw", 20.0, false, tl!("Uncached Refresh")).clicked() {
+                uncached_refresh(app);
+            }
+        });
+    });
+    let colored = opts.show_channels_in_color;
+    let hover = graph(app, ui, &s, channel, colored, 100.0);
+    // Source: only for documents with several layers.
+    if s.layers > 1 {
+        ui.horizontal(|ui| {
+            ui.label(egui::RichText::new(tl!("Source:")).color(t.text_dim).size(12.0));
+            let mut src = opts.source;
+            let mut options = vec![(HistSourceChoice::EntireImage, "Entire Image"), (HistSourceChoice::SelectedLayer, "Selected Layer")];
+            if s.adjustment {
+                options.push((HistSourceChoice::AdjustmentComposite, "Adjustment Composite"));
+            } else if src == HistSourceChoice::AdjustmentComposite {
+                src = HistSourceChoice::EntireImage;
+            }
+            if crate::widgets::dropdown(ui, "histogram-panel-src", tl!("Source"), &mut src, &options, 150.0) {
+                app.ui.histogram_panel.source = src;
+                changed = true;
+            }
+        });
+    }
+    if opts.show_statistics {
+        ui.add_space(4.0);
+        let levels = app.ui.histogram_range.or_else(|| hover.map(|l| [l, l]));
+        statistics(ui, &s.hist, s.mode, channel, levels, &t);
+    }
+    if opts.view == HistView::AllChannels {
+        for c in color_channels(s.mode) {
+            ui.add_space(4.0);
+            ui.label(egui::RichText::new(tl!(channel_label(s.mode, *c))).color(t.text).size(11.5));
+            let w = ui.available_width();
+            let (r, _) = ui.allocate_exact_size(vec2(w, 90.0), Sense::hover());
+            let p = ui.painter_at(r);
+            p.rect_filled(r, 0.0, t.field);
+            tone::draw_histogram(&p, r, bins(&s.hist, s.mode, *c), graph_color(*c, colored, &t));
+        }
+    }
+    if changed {
+        persist_options(app);
+    }
+}
+
+/// The Histogram items of the panel menu.
+pub fn panel_menu(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
+    if ui.add_enabled(app.session.active().is_some(), egui::Button::new(tl!("Uncached Refresh"))).clicked() {
+        uncached_refresh(app);
+        ui.close();
+    }
+    ui.separator();
+    let mut changed = false;
+    for (view, label) in [(HistView::Compact, "Compact View"), (HistView::Expanded, "Expanded View"), (HistView::AllChannels, "All Channels View")] {
+        if ui.radio(app.ui.histogram_panel.view == view, tl!(label)).clicked() {
+            // The channel is one setting for every view, so it is kept.
+            app.ui.histogram_panel.view = view;
+            changed = true;
+        }
+    }
+    ui.separator();
+    let mut stats_on = app.ui.histogram_panel.show_statistics;
+    if crate::widgets::checkbox(ui, &mut stats_on, tl!("Show Statistics")).changed() {
+        app.ui.histogram_panel.show_statistics = stats_on;
+        changed = true;
+    }
+    let mut color = app.ui.histogram_panel.show_channels_in_color;
+    if crate::widgets::checkbox(ui, &mut color, tl!("Show Channels in Color")).changed() {
+        app.ui.histogram_panel.show_channels_in_color = color;
+        changed = true;
+    }
+    if changed {
+        persist_options(app);
+        ui.close();
+    }
+}
+
+/// The panel's state for `ui.inspect` (`histogram`): its options as they apply to the active
+/// document, and the shown histogram's statistics for the selected range.
+pub fn inspect(app: &PhotocraftApp) -> Value {
+    let opts = app.ui.histogram_panel;
+    let Some(st) = app.session.active() else { return json!({"options": opts}) };
+    let mode = st.doc.mode;
+    let channel = resolve_channel(mode, opts.channel);
+    let (source, _) = resolve_source(st, source_choice(&opts));
+    let preview = app.doc_hist_preview.as_ref().filter(|e| e.key.doc == st.doc.id);
+    let entry = preview.or(app.doc_hist.as_ref()).filter(|e| e.key.doc == st.doc.id);
+    let committed = committed_key(app).map(|(k, _, _)| k);
+    let ch = if channel == HistChannel::Colors { HistChannel::Composite } else { channel };
+    json!({
+        "options": opts,
+        "channel": channel_id(channel),
+        "channels": channel_options(mode).iter().map(|(c, _)| channel_id(*c)).collect::<Vec<_>>(),
+        "source": source,
+        "sourceShown": st.doc.layer_count() > 1 && opts.view != HistView::Compact,
+        "range": app.ui.histogram_range,
+        "preview": preview.is_some(),
+        "revision": entry.map(|e| e.key.revision),
+        "current": entry.zip(committed).is_some_and(|(e, k)| e.key == HistKey { preview: e.key.preview, ..k }),
+        "cacheLevel": entry.map(|e| e.hist.level.max(1)),
+        "maxCacheLevel": max_cache_level(app),
+        "stats": entry.and_then(|e| stats(bins(&e.hist, mode, ch), app.ui.histogram_range)),
+    })
+}
+
+#[cfg(test)]
+#[path = "histogram_panel_tests.rs"]
+mod tests;
diff --git a/crates/ui-egui/src/histogram_panel_tests.rs b/crates/ui-egui/src/histogram_panel_tests.rs
new file mode 100644
index 0000000000..f5d660006b
--- /dev/null
+++ b/crates/ui-egui/src/histogram_panel_tests.rs
@@ -0,0 +1,418 @@
+use super::*;
+use crate::PhotocraftApp;
+use serde_json::json;
+
+fn app_with(params: Value) -> PhotocraftApp {
+    let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+    app.run("file.new", params).unwrap();
+    app
+}
+
+/// One panel frame through a minimal egui pass.
+fn frame(app: &mut PhotocraftApp) {
+    let ctx = egui::Context::default();
+    ctx.begin_pass(Default::default());
+    let mut ui =
+        egui::Ui::new(ctx.clone(), egui::Id::unique("hist-test"), egui::UiBuilder::new().max_rect(Rect::from_min_size(egui::Pos2::ZERO, vec2(300.0, 900.0))));
+    show(app, &mut ui);
+    ctx.end_pass().textures_delta.clear();
+}
+
+/// Frames until the panel shows the histogram it wants (the throttle skipped), or panics after
+/// 60 s: an uncached count of the 18 MP document below takes seconds in a debug build on a loaded
+/// CI runner, and the loop returns as soon as the histogram lands.
+fn settle(app: &mut PhotocraftApp) {
+    let t0 = std::time::Instant::now();
+    loop {
+        for e in [app.doc_hist.as_mut(), app.doc_hist_preview.as_mut()].into_iter().flatten() {
+            e.at = -1e12;
+        }
+        frame(app);
+        let done = app.hist_job.is_none() && shown(app).is_some_and(|s| !s.stale);
+        if done {
+            return;
+        }
+        assert!(t0.elapsed() < std::time::Duration::from_secs(60), "the histogram never settled");
+        std::thread::sleep(std::time::Duration::from_millis(2));
+    }
+}
+
+fn ui_set(app: &mut PhotocraftApp, ctx: &egui::Context, params: Value) -> Value {
+    let (req, _rx) = crate::control::ControlRequest::new("ui.set", params);
+    match crate::control::handle(app, ctx, &req) {
+        crate::control::Outcome::Done(v) => v,
+        _ => panic!("ui.set: expected an immediate reply"),
+    }
+}
+
+fn inspect_stats(app: &PhotocraftApp) -> Value {
+    inspect(app)["stats"].clone()
+}
+
+#[test]
+fn stats_match_their_definitions() {
+    let mut h = [0u32; 256];
+    h[0] = 25;
+    h[100] = 50;
+    h[255] = 25;
+    let s = stats(&h, None).unwrap();
+    assert_eq!(s.pixels, 100);
+    assert!((s.mean - (5000.0 + 6375.0) / 100.0).abs() < 1e-9);
+    assert_eq!(s.median, 100);
+    assert_eq!(s.clipped, [25.0, 25.0], "a quarter of the pixels clip at each end");
+    // One level: its count and the percent at or below it.
+    let one = stats(&h, Some([100, 100])).unwrap();
+    assert_eq!((one.count, one.percentile), (Some(50), Some(75.0)));
+    // A dragged range (either direction): the count and percent within it.
+    let range = stats(&h, Some([200, 50])).unwrap();
+    assert_eq!((range.level, range.count, range.percentile), (Some([50, 200]), Some(50), Some(50.0)));
+    assert!(stats(&[0; 256], Some([0, 255])).is_none(), "an empty histogram has no statistics");
+    assert!(stats(&h, None).unwrap().std_dev > 0.0);
+}
+
+#[test]
+fn channels_follow_the_colour_mode() {
+    let ids = |m| channel_options(m).into_iter().map(|(c, _)| c).collect::<Vec<_>>();
+    use HistChannel::*;
+    assert_eq!(ids(ColorMode::Rgb), [Composite, Red, Green, Blue, Luminosity, Colors]);
+    assert_eq!(ids(ColorMode::Cmyk), [Composite, Cyan, Magenta, Yellow, Black, Luminosity, Colors]);
+    assert_eq!(ids(ColorMode::Lab), [Composite, A, B, Luminosity]);
+    assert_eq!(ids(ColorMode::Grayscale), [Composite]);
+    assert_eq!(resolve_channel(ColorMode::Cmyk, Red), Composite, "a channel the mode lacks shows its composite");
+    assert_eq!(resolve_channel(ColorMode::Rgb, Red), Red);
+    assert!(color_channels(ColorMode::Grayscale).is_empty(), "All Channels lists colour channels only");
+    assert_eq!(color_channels(ColorMode::Rgb), [Red, Green, Blue]);
+    // Pointer marks bin pixels the way the histogram does.
+    let px = [1.0, 0.5, 0.0, 1.0];
+    assert_eq!(channel_level(ColorMode::Rgb, Red, px), 255);
+    assert_eq!(channel_level(ColorMode::Rgb, Green, px), 128);
+    assert_eq!(channel_level(ColorMode::Rgb, Composite, px), 127);
+    assert_eq!(channel_level(ColorMode::Rgb, Luminosity, px), ((0.30 + 0.59 * 0.5) * 255.0f32).round() as u8);
+    assert_eq!(channel_level(ColorMode::Rgb, Blue, [f32::NAN, 0.0, 2.0, 1.0]), 255, "hostile samples clamp, never panic");
+}
+
+#[test]
+fn luminosity_and_rgb_channels_are_counted() {
+    let mut app = app_with(json!({"width": 40, "height": 20}));
+    app.run("select.rect", json!({"x": 0, "y": 0, "width": 20, "height": 20})).unwrap();
+    app.run("edit.fill", json!({"color": "#ff0000"})).unwrap();
+    let doc = &app.session.active().unwrap().doc;
+    let h = tone::compute_histograms(doc, tone::IMAGE, ToneSpace::Rgb);
+    assert_eq!(bins(&h, doc.mode, HistChannel::Red)[255], 800);
+    assert_eq!(bins(&h, doc.mode, HistChannel::Green)[0], 400);
+    let red_lum = (0.30f32 * 255.0).round() as usize;
+    assert_eq!(h.lum[red_lum], 400, "red is 30% luminosity");
+    assert_eq!(h.lum[255], 400, "white is full luminosity");
+}
+
+#[test]
+fn sources_count_the_image_the_layer_or_the_adjustment_composite() {
+    let mut app = app_with(json!({"width": 32, "height": 32})); // white
+    app.run("layer.newAdjustmentLayer.invert", json!({})).unwrap();
+    app.run("layer.new.layer", json!({})).unwrap();
+    app.run("select.rect", json!({"x": 0, "y": 0, "width": 16, "height": 32})).unwrap();
+    app.run("edit.fill", json!({"color": "#808080"})).unwrap();
+    let st = app.session.active().unwrap();
+    let invert = st.doc.layers[1].id;
+    let doc = &st.doc;
+    let image = tone::compute_histograms(doc, tone::IMAGE, ToneSpace::Rgb);
+    assert_eq!((image[0][0], image[0][128]), (512, 512), "black (inverted white) and the grey above it");
+    let upto = tone::compute_histograms(doc, HistSource::UpTo(invert), ToneSpace::Rgb);
+    assert_eq!(upto[0][0], 1024, "the adjustment composite hides the grey layer above");
+    // The panel offers Adjustment Composite only with an adjustment layer selected.
+    assert_eq!(resolve_source(st, HistSourceChoice::AdjustmentComposite).0, HistSourceChoice::EntireImage);
+    assert_eq!(resolve_source(st, HistSourceChoice::SelectedLayer).1, HistSource::Layer(st.active_layer.unwrap()));
+    app.run("layer.select", json!({"layer": invert.0})).unwrap();
+    let st = app.session.active().unwrap();
+    assert_eq!(st.active_layer, Some(invert));
+    assert_eq!(resolve_source(st, HistSourceChoice::AdjustmentComposite), (HistSourceChoice::AdjustmentComposite, HistSource::UpTo(invert)));
+    // A single-layer document counts the entire image whatever is chosen.
+    let one = app_with(json!({"width": 8, "height": 8}));
+    let st = one.session.active().unwrap();
+    assert_eq!(resolve_source(st, HistSourceChoice::SelectedLayer).0, HistSourceChoice::EntireImage);
+}
+
+#[test]
+fn cache_level_follows_size_and_the_preference_cap() {
+    let big = app_with(json!({"width": 6000, "height": 3000}));
+    let doc = &big.session.active().unwrap().doc;
+    let auto = tone::cache_level(doc, tone::MAX_CACHE_LEVEL);
+    assert!(auto > 1, "a large document counts a proxy, level {auto}");
+    assert_eq!(tone::cache_level(doc, 2), 2, "capped by Cache Levels");
+    assert_eq!(tone::cache_level(doc, 0), 1, "out-of-range caps clamp");
+    let exact = tone::compute_histograms_at(doc, tone::IMAGE, ToneSpace::Rgb, 1);
+    assert_eq!(exact.level, 1);
+    assert_eq!(exact[0][255], 6000 * 3000, "level 1 counts every pixel");
+    let small = app_with(json!({"width": 64, "height": 64}));
+    assert_eq!(tone::cache_level(&small.session.active().unwrap().doc, 8), 1, "small documents are exact");
+}
+
+#[test]
+fn panel_counts_off_thread_and_recounts_after_an_edit() {
+    let mut app = app_with(json!({"width": 64, "height": 48}));
+    settle(&mut app);
+    let s = inspect_stats(&app);
+    assert_eq!(s["pixels"], 64 * 48);
+    assert_eq!(s["median"], 255);
+    assert_eq!(inspect(&app)["current"], true);
+    app.run("edit.fill", json!({"color": "#000000"})).unwrap();
+    assert_eq!(inspect(&app)["current"], false, "stale until recounted");
+    frame(&mut app);
+    // The old histogram stays shown, marked stale, while the new one counts.
+    assert!(shown(&mut app).is_some());
+    settle(&mut app);
+    assert_eq!(inspect_stats(&app)["median"], 0, "refreshed without a manual refresh");
+}
+
+#[test]
+fn a_dead_histogram_worker_clears_the_job() {
+    let mut app = app_with(json!({"width": 64, "height": 48}));
+    let st = app.session.active().unwrap();
+    let key = HistKey { doc: st.doc.id, revision: st.revision, source: 0, preview: 0, max_level: 4 };
+    let (tx, rx) = std::sync::mpsc::channel();
+    drop(tx);
+    app.hist_job = Some((key, rx));
+    let ctx = egui::Context::default();
+    update(&mut app, &ctx);
+    assert!(app.doc_hist.is_none(), "nothing landed from the dead worker");
+    // …and the next count was scheduled in its place.
+    assert!(app.hist_job.is_some());
+}
+
+#[test]
+fn uncached_refresh_counts_every_pixel_for_the_current_state() {
+    let mut app = app_with(json!({"width": 6000, "height": 3000}));
+    app.run("prefs.set", json!({"path": "performance.cacheLevels", "value": 8})).unwrap();
+    settle(&mut app);
+    assert!(inspect(&app)["cacheLevel"].as_u64().unwrap() > 1, "cached first");
+    uncached_refresh(&mut app);
+    settle(&mut app);
+    assert_eq!(inspect(&app)["cacheLevel"], 1);
+    assert_eq!(inspect_stats(&app)["pixels"], 6000u64 * 3000);
+    // Cache Levels caps what the panel counts at.
+    app.run("prefs.set", json!({"path": "performance.cacheLevels", "value": 2})).unwrap();
+    app.run("edit.fill", json!({"color": "#000000"})).unwrap();
+    settle(&mut app);
+    assert_eq!(inspect(&app)["cacheLevel"], 2);
+    assert_eq!(inspect(&app)["maxCacheLevel"], 2);
+}
+
+#[test]
+fn adjustment_preview_is_counted_over_the_original() {
+    let mut app = app_with(json!({"width": 32, "height": 32})); // white
+    app.run("layer.newAdjustmentLayer.levels", json!({})).unwrap();
+    settle(&mut app);
+    assert_eq!(inspect_stats(&app)["median"], 255);
+    let id = app.session.active().unwrap().active_layer.unwrap();
+    app.live_adjust = Some((id, json!({"outWhite": 100})));
+    settle(&mut app);
+    assert_eq!(inspect(&app)["preview"], true);
+    assert_eq!(inspect_stats(&app)["median"], 100, "the previewed levels");
+    let s = shown(&mut app).unwrap();
+    let original = s.original.expect("the original is kept for the overlay");
+    assert_eq!(original[0][255], 1024, "the original is the image before the preview");
+    app.live_adjust = None;
+    settle(&mut app);
+    assert_eq!(inspect(&app)["preview"], false);
+    assert_eq!(inspect_stats(&app)["median"], 255);
+}
+
+#[test]
+fn views_keep_the_channel_and_the_menu_toggles_options() {
+    use egui_kittest::Harness;
+    use egui_kittest::kittest::Queryable;
+    let mut app = app_with(json!({"width": 16, "height": 16}));
+    app.ui.histogram_panel.channel = HistChannel::Green;
+    let mut h = Harness::builder().with_size(vec2(260.0, 320.0)).build_ui_state(|ui, app: &mut PhotocraftApp| panel_menu(app, ui), app);
+    h.run_steps(2);
+    h.get_by_label("All Channels View").click();
+    h.run_steps(2);
+    assert_eq!(h.state().ui.histogram_panel.view, HistView::AllChannels);
+    assert_eq!(h.state().ui.histogram_panel.channel, HistChannel::Green, "the channel is kept");
+    h.get_by_label("Show Channels in Color").click();
+    h.run_steps(2);
+    assert!(h.state().ui.histogram_panel.show_channels_in_color);
+    h.get_by_label("Show Statistics").click();
+    h.run_steps(2);
+    assert!(!h.state().ui.histogram_panel.show_statistics);
+    // Kept with the preferences.
+    let mut again = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+    let saved = h.state().session.prefs().dialogs.get(OPTIONS_PREF).cloned().unwrap();
+    again.session.prefs.edit(|p| {
+        p.dialogs.insert(OPTIONS_PREF.into(), saved);
+    });
+    restore_options(&mut again);
+    assert_eq!(again.ui.histogram_panel.view, HistView::AllChannels);
+    assert!(again.ui.histogram_panel.show_channels_in_color);
+}
+
+#[test]
+fn every_view_and_channel_draws_without_panicking() {
+    for mode in ["rgb", "cmyk", "lab", "grayscale"] {
+        let mut app = app_with(json!({"width": 24, "height": 24, "mode": mode}));
+        app.run("layer.new.layer", json!({})).unwrap();
+        settle(&mut app);
+        for view in [HistView::Compact, HistView::Expanded, HistView::AllChannels] {
+            for channel in [HistChannel::Composite, HistChannel::Red, HistChannel::Cyan, HistChannel::A, HistChannel::Luminosity, HistChannel::Colors] {
+                for range in [[200, 10], [0, 255]] {
+                    app.ui.histogram_panel.view = view;
+                    app.ui.histogram_panel.channel = channel;
+                    app.ui.histogram_range = Some(range);
+                    frame(&mut app);
+                }
+            }
+        }
+        assert!(inspect(&app)["stats"]["count"].is_u64(), "{mode}: the range has a count");
+    }
+}
+
+#[test]
+fn overlaid_colors_mix_where_channels_overlap() {
+    let ctx = egui::Context::default();
+    ctx.begin_pass(Default::default());
+    let p = ctx.layer_painter(egui::LayerId::background());
+    let h = [100u32; 256];
+    draw_overlaid(&p, Rect::from_min_size(egui::Pos2::ZERO, vec2(256.0, 50.0)), &[(&h, Color32::RED), (&h, Color32::GREEN)], false);
+    draw_overlaid(&p, Rect::from_min_size(egui::Pos2::ZERO, vec2(256.0, 50.0)), &[], true);
+    ctx.end_pass().textures_delta.clear();
+}
+
+#[test]
+fn ui_set_drives_the_panel() {
+    let mut app = app_with(json!({"width": 16, "height": 16}));
+    let ctx = egui::Context::default();
+    let r = ui_set(
+        &mut app,
+        &ctx,
+        json!({"histogramPanel": {"view": "allChannels", "channel": "luminosity"}, "histogramRange": [10, 20], "histogramRefresh": true}),
+    );
+    assert_eq!(r["ok"], true, "{r}");
+    assert_eq!(app.ui.histogram_panel.view, HistView::AllChannels);
+    assert_eq!(app.ui.histogram_panel.channel, HistChannel::Luminosity);
+    assert_eq!(app.ui.histogram_range, Some([10, 20]));
+    assert!(app.hist_uncached.is_some());
+    for bad in [
+        json!({"histogramPanel": {"view": "tiny"}}),
+        json!({"histogramPanel": {"nope": 1}}),
+        json!({"histogramRange": [0, 300]}),
+        json!({"histogramRefresh": "yes"}),
+    ] {
+        let r = ui_set(&mut app, &ctx, bad.clone());
+        assert_eq!(r["ok"], false, "{bad}: {r}");
+    }
+    assert_eq!(app.ui.histogram_panel.view, HistView::AllChannels, "a rejected call changes nothing");
+}
+
+/// The Colors overlay follows the same outline as a single channel: straight lines between bin
+/// centres, not one flat step per level, and its bands tile without gaps where outlines cross.
+#[test]
+fn colors_overlay_is_a_continuous_outline_not_steps() {
+    let r = Rect::from_min_size(egui::Pos2::ZERO, vec2(512.0, 100.0));
+    let ramp: [u32; 256] = std::array::from_fn(|i| i as u32 * 10);
+    let fall: [u32; 256] = std::array::from_fn(|i| (255 - i) as u32 * 10);
+    let mesh = overlaid_mesh(r, &[(&ramp, Color32::RED), (&fall, Color32::GREEN)], false);
+    let quads: Vec<&[egui::epaint::Vertex]> = mesh.vertices.chunks(4).collect();
+    assert!(!quads.is_empty());
+    // Every band's top edge slopes on a ramp: no flat steps.
+    let sloped = quads.iter().filter(|q| (q[1].pos.y - q[2].pos.y).abs() > 1e-4).count();
+    assert!(sloped * 10 > quads.len() * 9, "{sloped} of {} bands slope", quads.len());
+    // The two ramps cross mid-way: there the overlap is yellow and each side keeps its own colour.
+    let colors: std::collections::HashSet<_> = mesh.vertices.iter().map(|v| v.color).collect();
+    assert!(colors.contains(&Color32::from_rgb(255, 255, 0)) && colors.contains(&Color32::RED) && colors.contains(&Color32::GREEN));
+    // Nothing is drawn above the taller outline at any x.
+    for q in &quads {
+        for v in q.iter() {
+            assert!(v.pos.y >= r.top() - 1e-3 && v.pos.y <= r.bottom() + 1e-3);
+        }
+    }
+}
+
+/// A white Background under a black layer, with the Background selected: the entire image is
+/// black, the selected layer white.
+fn black_over_white_background_selected() -> PhotocraftApp {
+    let mut app = app_with(json!({"width": 32, "height": 32}));
+    app.run("layer.new.layer", json!({})).unwrap();
+    app.run("edit.fill", json!({"color": "#000000"})).unwrap();
+    let background = app.session.active().unwrap().doc.layers[0].id;
+    app.run("layer.select", json!({"layer": background.0})).unwrap();
+    app
+}
+
+/// Preferences › Cache Levels 1 counts at level 1 like an Uncached Refresh, but only the refresh
+/// was asked for: edits in a row still wait out the 250 ms throttle.
+#[test]
+fn cache_levels_one_still_throttles_recounts_and_an_uncached_refresh_does_not() {
+    let mut app = app_with(json!({"width": 64, "height": 48}));
+    app.run("prefs.set", json!({"path": "performance.cacheLevels", "value": 1})).unwrap();
+    settle(&mut app);
+    // The count just landed, so the next edit falls inside the throttle.
+    app.doc_hist.as_mut().unwrap().at = 0.0;
+    app.run("edit.fill", json!({"color": "#000000"})).unwrap();
+    frame(&mut app);
+    assert!(app.hist_job.is_none(), "an edit within 250 ms of the last count waits");
+    uncached_refresh(&mut app);
+    frame(&mut app);
+    assert!(app.hist_job.is_some(), "an Uncached Refresh counts at once");
+}
+
+/// The Levels, Curves and Threshold dialogs count uncapped: their proxy is as small as before
+/// Cache Levels (about 768 pixels on the longest side), and only a cap halves by powers of two.
+#[test]
+fn uncapped_counts_keep_their_proxy_and_a_cap_reduces_by_powers_of_two() {
+    let big = app_with(json!({"width": 6000, "height": 3000}));
+    let doc = &big.session.active().unwrap().doc;
+    let pixels = |h: &Histograms| h[0].iter().map(|&c| u64::from(c)).sum::<u64>();
+    // 6000 / 768 = 7: a 7x proxy, 858 x 429 (rounded up), not an 8x one.
+    let auto = tone::compute_histograms(doc, tone::IMAGE, ToneSpace::Rgb);
+    assert_eq!(pixels(&auto), 858 * 429);
+    let capped = tone::compute_histograms_at(doc, tone::IMAGE, ToneSpace::Rgb, 3);
+    assert_eq!(capped.level, 3);
+    assert_eq!(pixels(&capped), 1500 * 750, "level 3 is a 4x proxy");
+}
+
+/// Photoshop opens the panel in Compact View, which shows no Source menu and represents the
+/// entire image whatever Source the Expanded View was left at.
+#[test]
+fn compact_view_is_the_default_and_counts_the_entire_image() {
+    assert_eq!(HistogramPanelState::default().view, HistView::Compact);
+    let mut app = black_over_white_background_selected();
+    app.ui.histogram_panel = HistogramPanelState { source: HistSourceChoice::SelectedLayer, ..Default::default() };
+    settle(&mut app);
+    let i = inspect(&app);
+    assert_eq!(i["source"], "entireImage");
+    assert_eq!(i["stats"]["median"], 0, "the black layer over the Background, not the Background alone");
+    app.ui.histogram_panel.view = HistView::Expanded;
+    settle(&mut app);
+    assert_eq!(inspect(&app)["source"], "selectedLayer");
+    assert_eq!(inspect_stats(&app)["median"], 255, "Expanded View counts the chosen Source");
+}
+
+/// `current` says whether the shown histogram is the one the panel wants: a Source change makes
+/// it stale until the recount lands, though the document's revision didn't move.
+#[test]
+fn inspect_current_follows_the_source_not_only_the_revision() {
+    let mut app = black_over_white_background_selected();
+    app.ui.histogram_panel.view = HistView::Expanded;
+    settle(&mut app);
+    assert_eq!(inspect(&app)["current"], true);
+    let ctx = egui::Context::default();
+    let r = ui_set(&mut app, &ctx, json!({"histogramPanel": {"source": "selectedLayer"}}));
+    assert_eq!(r["ok"], true, "{r}");
+    assert_eq!(inspect(&app)["current"], false, "the entire image's histogram is not the selected layer's");
+    settle(&mut app);
+    assert_eq!(inspect(&app)["current"], true);
+    assert_eq!(inspect_stats(&app)["median"], 255);
+}
+
+/// `preview` reports only the active document's preview, not one left from another document.
+#[test]
+fn inspect_preview_is_the_active_documents() {
+    let mut app = app_with(json!({"width": 16, "height": 16}));
+    settle(&mut app);
+    let mut other = app.doc_hist.clone().unwrap();
+    other.key.preview = 1;
+    app.run("file.new", json!({"width": 8, "height": 8})).unwrap();
+    assert_ne!(app.session.active().unwrap().doc.id, other.key.doc);
+    app.doc_hist_preview = Some(other);
+    assert_eq!(inspect(&app)["preview"], false);
+}
diff --git a/crates/ui-egui/src/history_menu_ui.rs b/crates/ui-egui/src/history_menu_ui.rs
index da77f9d2fb..6e3e197662 100644
--- a/crates/ui-egui/src/history_menu_ui.rs
+++ b/crates/ui-egui/src/history_menu_ui.rs
@@ -132,11 +132,11 @@ mod tests {
     fn close_hides_the_history_panel() {
         let mut app = app();
         app.run("window.panel.activate", json!({"panel": "history"})).unwrap();
-        assert!(app.ui.docking.as_ref().unwrap().contains(&"history".to_string()));
+        assert!(app.ui.docking.as_ref().unwrap().layout.contains(&"history".to_string()));
         let mut h = harness(app);
         click(&mut h, "Close");
         assert!(!h.state().ui.status_error, "{}", h.state().ui.status);
-        let layout = h.state().ui.docking.clone().unwrap();
+        let layout = h.state().ui.docking.clone().unwrap().layout;
         assert!(!layout.contains(&"history".to_string()), "the History panel is closed");
     }
 
diff --git a/crates/ui-egui/src/history_panel_select_tests.rs b/crates/ui-egui/src/history_panel_select_tests.rs
index 8a591a739a..85be286d6a 100644
--- a/crates/ui-egui/src/history_panel_select_tests.rs
+++ b/crates/ui-egui/src/history_panel_select_tests.rs
@@ -154,6 +154,7 @@ fn scrolling_away_survives_a_change_that_adds_no_state() {
     h.event(egui::Event::PointerMoved(view.center()));
     for _ in 0..3 {
         h.event(egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
             unit: egui::MouseWheelUnit::Line,
             delta: vec2(0.0, 3.0),
             phase: egui::TouchPhase::Move,
@@ -184,6 +185,7 @@ fn clicking_a_snapshot_keeps_it_in_view() {
     h.event(egui::Event::PointerMoved(view.center()));
     for _ in 0..10 {
         h.event(egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
             unit: egui::MouseWheelUnit::Line,
             delta: vec2(0.0, 5.0),
             phase: egui::TouchPhase::Move,
@@ -210,6 +212,7 @@ fn a_new_state_at_the_history_limit_still_scrolls_into_view() {
     h.event(egui::Event::PointerMoved(view.center()));
     for _ in 0..3 {
         h.event(egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
             unit: egui::MouseWheelUnit::Line,
             delta: vec2(0.0, 3.0),
             phase: egui::TouchPhase::Move,
diff --git a/crates/ui-egui/src/hold_keys.rs b/crates/ui-egui/src/hold_keys.rs
index 8b8bef092c..824b2dccbe 100644
--- a/crates/ui-egui/src/hold_keys.rs
+++ b/crates/ui-egui/src/hold_keys.rs
@@ -230,7 +230,7 @@ pub fn repositions(t: Tool) -> bool {
 }
 
 fn latch_id() -> egui::Id {
-    egui::Id::new("pc-temporary-tool")
+    egui::Id::unique("pc-temporary-tool")
 }
 
 /// The temporary tool for this canvas frame: the held one, except while a selection is being
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index e12ed4f59e..925d19568b 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -661,6 +661,10 @@
 	Fit Layer(s) on Screen	Přizpůsobit vrstvy obrazovce
 	Fit Artboard on Screen	Přizpůsobit kreslicí plochu obrazovce
 	100%	100 %
+	105%	105 %
+	110%	110 %
+	115%	115 %
+	120%	120 %
 	200%	200 %
 	75%	75 %
 	80%	80 %
@@ -1033,6 +1037,9 @@
 	Create new pattern from the selection	Vytvořit nový vzorek z výběru
 	Create new shape from the current path	Vytvořit nový tvar z aktuální cesty
 	Create new snapshot	Vytvořit nový snímek
+	From:	Z:
+	Full Document	Celý dokument
+	Merged Layers	Sloučené vrstvy
 	Create new tool preset	Vytvořit nové přednastavení nástroje
 	Crop Factor	Crop faktor
 	Ctrl	Ctrl
@@ -3581,6 +3588,8 @@ curves	Smooth	Vyhladit
 	Vanishing Point is not active	Úběžník není aktivní
 	Apply Vanishing Point ({key})	Použít úběžník ({key})
 	Fix the red plane first: its corners must form a convex quad	Nejprve opravte červenou rovinu: její rohy musí tvořit konvexní čtyřúhelník
+	Alt-click a plane to set the clone source	Klepnutím s Alt na rovinu nastavte zdroj klonování
+	Too many clone strokes: apply Vanishing Point first	Příliš mnoho tahů klonování: nejprve použijte Úběžník
 # Select and Mask view modes (#1754)
 	Onion Skin	Cibulová slupka
 	Marching Ants	Pochodující mravenci
@@ -3851,6 +3860,17 @@ navigator	Zoom	Zvětšení
 	Sent to {printer}	Odesláno do {printer}
 	set in Print Settings…	nastavuje se v nastavení tisku…
 	ICO is limited to 256 × 256 pixels	ICO je omezen na 256 × 256 pixelů
+	Calibration	Kalibrace
+	Red Primary	Červená základní
+	Green Primary	Zelená základní
+	Blue Primary	Modrá základní
+	Write xmp sidecars	Zapisovat přidružené soubory XMP
+	Set the tone sliders from the image	Nastavit posuvníky tónů podle obrazu
+	Settings from {name}	Nastavení z {name}
+	Settings from {name}; {count} not supported: {names}	Nastavení z {name}; {count} nepodporováno: {names}
+	Could not write {name}: {error}	Nelze zapsat {name}: {error}
+	Kept {name}: written by another application	Soubor {name} ponechán: zapsala ho jiná aplikace
+	Shadow Tint	Odstín stínů
 # PhotoCraft release checks.
 	Check for Updates…	Zkontrolovat aktualizace…
 	PhotoCraft Updates	Aktualizace PhotoCraft
@@ -4166,3 +4186,18 @@ cameraRaw	Dehaze	Odstranění oparu
 	Grayscale Ramp	Přechod stupňů šedi
 	Current Colors	Aktuální barvy
 	Make Ramp Web Safe	Omezit pruh na webové barvy
+# Art History Brush (#213).
+	Art History Brush	Štětec umělecké historie
+	Art History Brush Tool	Nástroj štětec umělecké historie
+	Tight Short	Těsný krátký
+	Tight Medium	Těsný střední
+	Tight Long	Těsný dlouhý
+	Loose Medium	Volný střední
+	Loose Long	Volný dlouhý
+	Dab	Šmouha
+	Tight Curl	Těsná smyčka
+	Loose Curl	Volná smyčka
+	Stylized dabs from a history state	Stylizované šmouhy ze stavu historie
+
+# Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
+	Aspect Ratio	Poměr stran
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index bf290176a8..6558daa51d 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -660,6 +660,10 @@
 	Fit Layer(s) on Screen	Ebenen auf den Bildschirm einpassen
 	Fit Artboard on Screen	Zeichenbereich auf den Bildschirm einpassen
 	100%	100 %
+	105%	105 %
+	110%	110 %
+	115%	115 %
+	120%	120 %
 	200%	200 %
 	Print Size	Druckgröße
 	Pixel Aspect Ratio	Pixel-Seitenverhältnis
@@ -1014,6 +1018,10 @@
 	Create new pattern from the selection	Neues Muster aus der Auswahl erstellen
 	Create new shape from the current path	Neue Form aus dem aktuellen Pfad erstellen
 	Create new snapshot	Neuen Snapshot erstellen
+	From:	Von:
+	Full Document	Gesamtes Dokument
+	Merged Layers	Zusammengefügte Ebenen
+	New Snapshot	Neuer Snapshot
 	Create new style (from the selected type)	Neuen Stil erstellen (aus dem ausgewählten Text)
 	Create new style from the selected layer	Neuen Stil aus der ausgewählten Ebene erstellen
 	Create new tool preset	Neue Werkzeugvorgabe erstellen
@@ -2775,6 +2783,8 @@ curves	Smooth	Glätten
 	Vanishing Point is not active	Fluchtpunkt ist nicht aktiv
 	Apply Vanishing Point ({key})	Fluchtpunkt anwenden ({key})
 	Fix the red plane first: its corners must form a convex quad	Korrigieren Sie zuerst die rote Ebene: Ihre Ecken müssen ein konvexes Viereck bilden
+	Alt-click a plane to set the clone source	Alt-Klick auf eine Ebene legt die Kopierquelle fest
+	Too many clone strokes: apply Vanishing Point first	Zu viele Kopierstriche: Wenden Sie zuerst Fluchtpunkt an
 # Select and Mask view modes (#1754)
 	Onion Skin	Zwiebelschicht
 	Marching Ants	Laufende Ameisen
@@ -3254,6 +3264,17 @@ curves	Smooth	Glätten
 	Sent to {printer}	An {printer} gesendet
 	set in Print Settings…	in den Druckeinstellungen festlegen…
 	ICO is limited to 256 × 256 pixels	ICO ist auf 256 × 256 Pixel begrenzt
+	Calibration	Kalibrierung
+	Red Primary	Rot-Primärfarbe
+	Green Primary	Grün-Primärfarbe
+	Blue Primary	Blau-Primärfarbe
+	Write xmp sidecars	XMP-Filialdateien schreiben
+	Set the tone sliders from the image	Tonwert-Regler aus dem Bild setzen
+	Settings from {name}	Einstellungen aus {name}
+	Settings from {name}; {count} not supported: {names}	Einstellungen aus {name}; {count} nicht unterstützt: {names}
+	Could not write {name}: {error}	{name} konnte nicht geschrieben werden: {error}
+	Kept {name}: written by another application	{name} beibehalten: von einer anderen Anwendung geschrieben
+	Shadow Tint	Schattentönung
 # PhotoCraft release checks.
 	Check for Updates…	Nach Updates suchen…
 	PhotoCraft Updates	PhotoCraft-Updates
@@ -3433,3 +3454,24 @@ curves	Smooth	Glätten
 	Grayscale Ramp	Graustufenbalken
 	Current Colors	Aktuelle Farben
 	Make Ramp Web Safe	Farbbalken auf Webfarben beschränken
+# Art History Brush (#213).
+	Art History Brush	Künstlerischer Protokollpinsel
+	Art History Brush Tool	Künstlerischer-Protokollpinsel-Werkzeug
+	Tight Short	Eng kurz
+	Tight Medium	Eng mittel
+	Tight Long	Eng lang
+	Loose Medium	Locker mittel
+	Loose Long	Locker lang
+	Dab	Tupfer
+	Tight Curl	Eng gewellt
+	Loose Curl	Locker gewellt
+	Stylized dabs from a history state	Stilisierte Tupfer aus einem Protokollzustand
+
+# Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
+	Aspect Ratio	Seitenverhältnis
+	Category	Kategorie
+	Color Table	Farbtabelle
+	Gamma	Gamma
+	Interpolation	Interpolation
+	Target	Ziel
+	Units	Einheiten
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 6db59bc44a..5f1a3d3538 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -761,6 +761,9 @@
 	Create new pattern from the selection	Δημιουργία μοτίβου από την επιλογή
 	Create new shape from the current path	Δημιουργία σχήματος από την τρέχουσα διαδρομή
 	Create new snapshot	Δημιουργία νέου στιγμιότυπου
+	From:	Από:
+	Full Document	Ολόκληρο έγγραφο
+	Merged Layers	Συγχωνευμένα επίπεδα
 	Create new style (from the selected type)	Δημιουργία στυλ από τον επιλεγμένο τύπο
 	Create new style from the selected layer	Δημιουργία στυλ από το επιλεγμένο επίπεδο
 	Current & Below	Τρέχον και υποκείμενα
@@ -3430,6 +3433,10 @@ cameraRaw	Yellow	Κίτρινο
 
 # Labels added on main since the first batch
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	180°	180°
 	200%	200%
 	3 x 3	3 x 3
@@ -3826,6 +3833,8 @@ curves	Smooth	Εξομάλυνση
 	Vanishing Point is not active	Το Σημείο φυγής δεν είναι ενεργό
 	Apply Vanishing Point ({key})	Εφαρμογή σημείου φυγής ({key})
 	Fix the red plane first: its corners must form a convex quad	Διορθώστε πρώτα το κόκκινο επίπεδο: οι γωνίες του πρέπει να σχηματίζουν κυρτό τετράπλευρο
+	Alt-click a plane to set the clone source	Alt-κλικ σε ένα επίπεδο για να ορίσετε την πηγή κλωνοποίησης
+	Too many clone strokes: apply Vanishing Point first	Πάρα πολλές πινελιές κλωνοποίησης: εφαρμόστε πρώτα το Σημείο φυγής
 # Select and Mask view modes (#1754)
 	Onion Skin	Φλούδα κρεμμυδιού
 	Marching Ants	Κινούμενο περίγραμμα
@@ -3937,6 +3946,17 @@ curves	Smooth	Εξομάλυνση
 	Sent to {printer}	Στάλθηκε στον {printer}
 	set in Print Settings…	ορίζεται στις ρυθμίσεις εκτύπωσης…
 	ICO is limited to 256 × 256 pixels	Το ICO περιορίζεται σε 256 × 256 εικονοστοιχεία
+	Calibration	Βαθμονόμηση
+	Red Primary	Κόκκινο πρωτεύον
+	Green Primary	Πράσινο πρωτεύον
+	Blue Primary	Μπλε πρωτεύον
+	Write xmp sidecars	Εγγραφή συνοδευτικών αρχείων XMP
+	Set the tone sliders from the image	Ορισμός των ρυθμιστικών τόνων από την εικόνα
+	Settings from {name}	Ρυθμίσεις από {name}
+	Settings from {name}; {count} not supported: {names}	Ρυθμίσεις από {name}· {count} δεν υποστηρίζονται: {names}
+	Could not write {name}: {error}	Αδυναμία εγγραφής του {name}: {error}
+	Kept {name}: written by another application	Το {name} διατηρήθηκε: γράφτηκε από άλλη εφαρμογή
+	Shadow Tint	Χροιά σκιών
 # PhotoCraft release checks.
 	Check for Updates…	Έλεγχος ενημερώσεων…
 	PhotoCraft Updates	Ενημερώσεις PhotoCraft
@@ -4120,3 +4140,17 @@ curves	Smooth	Εξομάλυνση
 	Grayscale Ramp	Διαβάθμιση του γκρι
 	Current Colors	Τρέχοντα χρώματα
 	Make Ramp Web Safe	Μόνο χρώματα ιστού στη διαβάθμιση
+# Art History Brush (#213).
+	Art History Brush Tool	Πινέλο ιστορικού τέχνης (Art History Brush Tool)
+	Tight Short	Σφιχτό κοντό
+	Tight Medium	Σφιχτό μεσαίο
+	Tight Long	Σφιχτό μακρύ
+	Loose Medium	Χαλαρό μεσαίο
+	Loose Long	Χαλαρό μακρύ
+	Dab	Πινελιά
+	Tight Curl	Σφιχτή μπούκλα
+	Loose Curl	Χαλαρή μπούκλα
+	Stylized dabs from a history state	Στυλιζαρισμένες πινελιές από μια κατάσταση ιστορικού
+
+# Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
+	Target	Στόχος
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index ac9d834020..879572c9f4 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -658,6 +658,10 @@
 	Fit Layer(s) on Screen	Encajar capas en pantalla
 	Fit Artboard on Screen	Encajar mesa de trabajo en pantalla
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	75%	75%
 	80%	80%
@@ -1023,6 +1027,9 @@
 	Create new pattern from the selection	Crear un motivo nuevo a partir de la selección
 	Create new shape from the current path	Crear una forma nueva a partir del trazado actual
 	Create new snapshot	Crear una instantánea nueva
+	From:	De:
+	Full Document	Documento completo
+	Merged Layers	Capas combinadas
 	Create new tool preset	Crear un ajuste preestablecido de herramienta nuevo
 	Crop Factor	Factor de recorte
 	Ctrl	Ctrl
@@ -2813,6 +2820,8 @@ curves	Smooth	Suavizar
 	Vanishing Point is not active	Punto de fuga no está activo
 	Apply Vanishing Point ({key})	Aplicar punto de fuga ({key})
 	Fix the red plane first: its corners must form a convex quad	Corrija primero el plano rojo: sus esquinas deben formar un cuadrilátero convexo
+	Alt-click a plane to set the clone source	Haga Alt-clic en un plano para definir el origen de clonación
+	Too many clone strokes: apply Vanishing Point first	Demasiados trazos de clonación: aplique primero Punto de fuga
 # Select and Mask view modes (#1754)
 	Onion Skin	Papel cebolla
 	Marching Ants	Hormigas en marcha
@@ -4200,6 +4209,17 @@ navigator	Zoom	Zoom
 	Sent to {printer}	Enviado a {printer}
 	set in Print Settings…	se establece en Ajustes de impresión…
 	ICO is limited to 256 × 256 pixels	ICO está limitado a 256 × 256 píxeles
+	Calibration	Calibración
+	Red Primary	Primario rojo
+	Green Primary	Primario verde
+	Blue Primary	Primario azul
+	Write xmp sidecars	Escribir archivos XMP auxiliares
+	Set the tone sliders from the image	Ajustar los controles de tono a partir de la imagen
+	Settings from {name}	Ajustes de {name}
+	Settings from {name}; {count} not supported: {names}	Ajustes de {name}; {count} no compatibles: {names}
+	Could not write {name}: {error}	No se pudo escribir {name}: {error}
+	Kept {name}: written by another application	Se conservó {name}: lo escribió otra aplicación
+	Shadow Tint	Tinte de sombras
 # PhotoCraft release checks.
 	Check for Updates…	Buscar actualizaciones…
 	PhotoCraft Updates	Actualizaciones de PhotoCraft
@@ -4382,3 +4402,14 @@ navigator	Zoom	Zoom
 	Grayscale Ramp	Rampa de escala de grises
 	Current Colors	Colores actuales
 	Make Ramp Web Safe	Hacer rampa segura para web
+# Art History Brush (#213).
+	Art History Brush Tool	Herramienta Pincel histórico artístico
+	Tight Short	Corto apretado
+	Tight Medium	Medio apretado
+	Tight Long	Largo apretado
+	Loose Medium	Medio suelto
+	Loose Long	Largo suelto
+	Dab	Toque
+	Tight Curl	Rizo apretado
+	Loose Curl	Rizo suelto
+	Stylized dabs from a history state	Toques estilizados desde un estado del historial
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 90c1a1ca2e..9692437211 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -645,6 +645,10 @@
 	Fit Layer(s) on Screen	Adapter le(s) calque(s) à l'écran
 	Fit Artboard on Screen	Adapter le plan de travail à l'écran
 	100%	100 %
+	105%	105 %
+	110%	110 %
+	115%	115 %
+	120%	120 %
 	200%	200 %
 	75%	75 %
 	80%	80 %
@@ -1008,6 +1012,9 @@
 	Create new pattern from the selection	Créer un nouveau motif à partir de la sélection
 	Create new shape from the current path	Créer une nouvelle forme à partir du tracé actif
 	Create new snapshot	Créer un nouvel instantané
+	From:	À partir de :
+	Full Document	Document entier
+	Merged Layers	Calques fusionnés
 	Create new tool preset	Créer un nouveau préréglage d'outil
 	Crop Factor	Facteur de recadrage
 	Ctrl	Ctrl
@@ -3149,6 +3156,8 @@ curves	Smooth	Lisser
 	Vanishing Point is not active	Point de fuite n’est pas actif
 	Apply Vanishing Point ({key})	Appliquer le point de fuite ({key})
 	Fix the red plane first: its corners must form a convex quad	Corrigez d’abord le plan rouge : ses coins doivent former un quadrilatère convexe
+	Alt-click a plane to set the clone source	Alt-clic sur un plan pour définir la source de duplication
+	Too many clone strokes: apply Vanishing Point first	Trop de traits de duplication : appliquez d’abord Point de fuite
 # Select and Mask view modes (#1754)
 	Onion Skin	Pelure d'oignon
 	Marching Ants	Fourmis en marche
@@ -3247,6 +3256,17 @@ curves	Smooth	Lisser
 	Sent to {printer}	Envoyé à {printer}
 	set in Print Settings…	défini dans les paramètres d’impression…
 	ICO is limited to 256 × 256 pixels	Le format ICO est limité à 256 × 256 pixels
+	Calibration	Étalonnage
+	Red Primary	Primaire rouge
+	Green Primary	Primaire verte
+	Blue Primary	Primaire bleue
+	Write xmp sidecars	Écrire les fichiers annexes XMP
+	Set the tone sliders from the image	Régler les curseurs de tonalité d’après l’image
+	Settings from {name}	Réglages de {name}
+	Settings from {name}; {count} not supported: {names}	Réglages de {name} ; {count} non pris en charge : {names}
+	Could not write {name}: {error}	Impossible d’écrire {name} : {error}
+	Kept {name}: written by another application	{name} conservé : écrit par une autre application
+	Shadow Tint	Teinte des ombres
 # PhotoCraft release checks.
 	Check for Updates…	Rechercher des mises à jour…
 	PhotoCraft Updates	Mises à jour de PhotoCraft
@@ -4462,3 +4482,14 @@ shape	Appearance	Apparence
 	Grayscale Ramp	Barre de niveaux de gris
 	Current Colors	Couleurs actuelles
 	Make Ramp Web Safe	Limiter la barre aux couleurs Web
+# Art History Brush (#213).
+	Art History Brush Tool	Outil Pinceau d'historique artistique
+	Tight Short	Serré court
+	Tight Medium	Serré moyen
+	Tight Long	Serré long
+	Loose Medium	Lâche moyen
+	Loose Long	Lâche long
+	Dab	Touche
+	Tight Curl	Boucle serrée
+	Loose Curl	Boucle lâche
+	Stylized dabs from a history state	Touches stylisées depuis un état d'historique
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index 34d749f777..3d6ddab7cb 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -173,6 +173,10 @@
 	Fit Layer on Screen	स्क्रीन पर लेयर फ़िट करें
 	Actual Pixels	वास्तविक पिक्सेल
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	Rulers	रूलर्स
 	Snap	स्नैप
@@ -535,3 +539,27 @@ cameraRaw	Yellow	पीला
 	Missing delete command	हटाने का कमांड नहीं मिला
 	Invalid delete command	हटाने का कमांड अमान्य है
 	Layer deleted, but confirmation preference could not be saved: {error}	लेयर हटा दी गई, लेकिन पुष्टि की प्राथमिकता सहेजी नहीं जा सकी: {error}
+# Art History Brush (#213).
+	Art History Brush	आर्ट हिस्ट्री ब्रश
+	Style	शैली
+	Area	क्षेत्र
+	Tight Short	सघन छोटा
+	Tight Medium	सघन मध्यम
+	Tight Long	सघन लंबा
+	Loose Medium	ढीला मध्यम
+	Loose Long	ढीला लंबा
+	Dab	थपका
+	Tight Curl	सघन घुमाव
+	Loose Curl	ढीला घुमाव
+	Stylized dabs from a history state	इतिहास स्थिति से शैलीबद्ध थपके
+
+# Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
+	Aspect Ratio	पहलू अनुपात
+	Category	श्रेणी
+	Color Table	रंग तालिका
+	Gamma	गामा
+	Interpolation	इंटरपोलेशन
+	Profile	प्रोफ़ाइल
+	Target	लक्ष्य
+	Units	इकाइयाँ
+	Demosaic	डिमोज़ेक
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 1733e0ca5c..1931aaa2b0 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -423,6 +423,10 @@
 # Menus: Type, Filter, View, Window; UI and engine commands
 	(coming soon)	(hamarosan)
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	2-up Horizontal	2 nézet vízszintesen
 	2-up Vertical	2 nézet függőlegesen
 	200%	200%
@@ -3897,6 +3901,9 @@ cameraRaw	Yellow	Sárga
 	New document…     ⌘N	Új dokumentum…     ⌘N
 	New Layer from Brush	Új réteg ecsetből
 	New Path	Új útvonal
+	From:	Forrás:
+	Full Document	Teljes dokumentum
+	Merged Layers	Egyesített rétegek
 	New Snapshot	Új pillanatkép
 	New Snapshot…	Új pillanatkép…
 	History Options…	Előzménybeállítások…
@@ -4029,6 +4036,8 @@ cameraRaw	Yellow	Sárga
 	Amount:	Mérték:
 	Apply Vanishing Point ({key})	Enyészpont alkalmazása ({key})
 	Apply the removal ({key})	Eltávolítás alkalmazása ({key})
+	Alt-click a plane to set the clone source	Alt-kattintás egy síkra a klónforrás beállításához
+	Too many clone strokes: apply Vanishing Point first	Túl sok klónvonás: először alkalmazza az Enyészpontot
 	Drag to draw the curve · {key}-click draws a straight line	Húzással rajzold meg a görbét · {key}+kattintás: egyenes vonal
 	Draw to modify the curve	Rajzolj a görbe módosításához
 	Edit points to modify the curve	Szerkeszd a pontokat a görbe módosításához
@@ -4133,6 +4142,17 @@ cameraRaw	Yellow	Sárga
 	Color Indicates:	A szín jelzése:
 	Ink Characteristics	Festék jellemzői
 	Solidity:	Fedőképesség:
+	Calibration	Kalibrálás
+	Red Primary	Vörös alapszín
+	Green Primary	Zöld alapszín
+	Blue Primary	Kék alapszín
+	Write xmp sidecars	XMP kísérőfájlok írása
+	Set the tone sliders from the image	Tónuscsúszkák beállítása a kép alapján
+	Settings from {name}	Beállítások innen: {name}
+	Settings from {name}; {count} not supported: {names}	Beállítások innen: {name}; {count} nem támogatott: {names}
+	Could not write {name}: {error}	Nem sikerült írni: {name}: {error}
+	Kept {name}: written by another application	{name} megtartva: egy másik alkalmazás írta
+	Shadow Tint	Árnyék színezet
 	Redrawing	Újrarajzolás
 # Bevel & Emboss shading controls.
 	Highlight Mode	Csúcsfény módja
@@ -4335,3 +4355,14 @@ cameraRaw	Yellow	Sárga
 	Grayscale Ramp	Szürkeárnyalatos sáv
 	Current Colors	Aktuális színek
 	Make Ramp Web Safe	Sáv korlátozása webes színekre
+# Art History Brush (#213).
+	Art History Brush Tool	Művészi előzményecset eszköz
+	Tight Short	Szoros, rövid
+	Tight Medium	Szoros, közepes
+	Tight Long	Szoros, hosszú
+	Loose Medium	Laza, közepes
+	Loose Long	Laza, hosszú
+	Dab	Pötty
+	Tight Curl	Szoros göndör
+	Loose Curl	Laza göndör
+	Stylized dabs from a history state	Stilizált pöttyök egy előzményállapotból
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 05b77f764e..eb890e9bce 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -638,6 +638,10 @@
 	Fit Layer(s) on Screen	Pas Layer di Layar
 	Fit Artboard on Screen	Pas Artboard di Layar
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	75%	75%
 	80%	80%
@@ -1018,6 +1022,9 @@
 	Create new pattern from the selection	Buat pola baru dari seleksi
 	Create new shape from the current path	Buat bentuk baru dari path saat ini
 	Create new snapshot	Buat snapshot baru
+	From:	Dari:
+	Full Document	Seluruh Dokumen
+	Merged Layers	Layer Gabungan
 	Create new tool preset	Buat preset alat baru
 	Crop Factor	Faktor Crop
 	Ctrl	Ctrl
@@ -2249,7 +2256,7 @@
 	Quick Selection	Quick Selection
 	Magnetic Lasso	Magnetic Lasso
 	History Brush	History Brush
-	Art History Brush	Art History Brush
+	Art History Brush	Kuas riwayat artistik
 	Pattern Stamp	Stempel Pola
 	Spot Healing	Spot Healing
 	Red Eye	Red Eye
@@ -3152,6 +3159,8 @@ curves	Smooth	Haluskan
 	Vanishing Point is not active	Vanishing Point tidak aktif
 	Apply Vanishing Point ({key})	Terapkan Vanishing Point ({key})
 	Fix the red plane first: its corners must form a convex quad	Perbaiki bidang merah dulu: sudut-sudutnya harus membentuk segi empat cembung
+	Alt-click a plane to set the clone source	Alt-klik sebuah bidang untuk menetapkan sumber kloning
+	Too many clone strokes: apply Vanishing Point first	Terlalu banyak goresan kloning: terapkan Vanishing Point terlebih dahulu
 # Select and Mask view modes (#1754)
 	Onion Skin	Kulit Bawang
 	Marching Ants	Semut Berbaris
@@ -3250,6 +3259,17 @@ curves	Smooth	Haluskan
 	Sent to {printer}	Dikirim ke {printer}
 	set in Print Settings…	diatur di Pengaturan Cetak…
 	ICO is limited to 256 × 256 pixels	ICO dibatasi hingga 256 × 256 piksel
+	Calibration	Kalibrasi
+	Red Primary	Primer merah
+	Green Primary	Primer hijau
+	Blue Primary	Primer biru
+	Write xmp sidecars	Tulis berkas pendamping XMP
+	Set the tone sliders from the image	Atur penggeser nada dari gambar
+	Settings from {name}	Pengaturan dari {name}
+	Settings from {name}; {count} not supported: {names}	Pengaturan dari {name}; {count} tidak didukung: {names}
+	Could not write {name}: {error}	Tidak dapat menulis {name}: {error}
+	Kept {name}: written by another application	{name} dipertahankan: ditulis oleh aplikasi lain
+	Shadow Tint	Rona bayangan
 # PhotoCraft release checks.
 	Check for Updates…	Periksa Pembaruan…
 	PhotoCraft Updates	Pembaruan PhotoCraft
@@ -3435,3 +3455,21 @@ curves	Smooth	Haluskan
 	Grayscale Ramp	Gradasi Grayscale
 	Current Colors	Warna Saat Ini
 	Make Ramp Web Safe	Jadikan Gradasi Aman untuk Web
+# Art History Brush (#213).
+	Art History Brush Tool	Alat Kuas riwayat artistik
+	Tight Short	Rapet pendek
+	Tight Medium	Rapet sedang
+	Tight Long	Rapet panjang
+	Loose Medium	Longgar sedang
+	Loose Long	Longgar panjang
+	Dab	Cap
+	Tight Curl	Ikal rapat
+	Loose Curl	Ikal longgar
+	Area	Area
+	Stylized dabs from a history state	Cap bergaya dari sebuah keadaan riwayat
+
+# Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
+	Color Table	Tabel Warna
+	Gamma	Gamma
+	Profile	Profil
+	Target	Target
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index da6cce3d8f..661192d7b6 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -652,6 +652,10 @@
 	Fit Layer(s) on Screen	Adatta livello/i a schermo
 	Fit Artboard on Screen	Adatta tavola a schermo
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	75%	75%
 	80%	80%
@@ -1018,6 +1022,9 @@
 	Create new pattern from the selection	Crea nuovo pattern dalla selezione
 	Create new shape from the current path	Crea nuova forma dal tracciato corrente
 	Create new snapshot	Crea nuova istantanea
+	From:	Da:
+	Full Document	Documento intero
+	Merged Layers	Livelli uniti
 	Create new style (from the selected type)	Crea nuovo stile (dal testo selezionato)
 	Create new style from the selected layer	Crea nuovo stile dal livello selezionato
 	Create new tool preset	Crea nuovo predefinito strumento
@@ -2798,6 +2805,8 @@ curves	Smooth	Leviga
 	Vanishing Point is not active	Punto di fuga non è attivo
 	Apply Vanishing Point ({key})	Applica punto di fuga ({key})
 	Fix the red plane first: its corners must form a convex quad	Correggi prima il piano rosso: i suoi angoli devono formare un quadrilatero convesso
+	Alt-click a plane to set the clone source	Alt-clic su un piano per impostare l’origine della clonazione
+	Too many clone strokes: apply Vanishing Point first	Troppi tratti di clonazione: applica prima Punto di fuga
 # Select and Mask view modes (#1754)
 	Onion Skin	Velina
 	Marching Ants	Formiche in marcia
@@ -4203,6 +4212,17 @@ navigator	Zoom	Zoom
 	Sent to {printer}	Inviato a {printer}
 	set in Print Settings…	impostato nelle impostazioni di stampa…
 	ICO is limited to 256 × 256 pixels	ICO è limitato a 256 × 256 pixel
+	Calibration	Calibrazione
+	Red Primary	Primario rosso
+	Green Primary	Primario verde
+	Blue Primary	Primario blu
+	Write xmp sidecars	Scrivi file sidecar XMP
+	Set the tone sliders from the image	Imposta i cursori dei toni dall’immagine
+	Settings from {name}	Impostazioni da {name}
+	Settings from {name}; {count} not supported: {names}	Impostazioni da {name}; {count} non supportate: {names}
+	Could not write {name}: {error}	Impossibile scrivere {name}: {error}
+	Kept {name}: written by another application	{name} mantenuto: scritto da un’altra applicazione
+	Shadow Tint	Tinta ombre
 # PhotoCraft release checks.
 	Check for Updates…	Cerca aggiornamenti…
 	PhotoCraft Updates	Aggiornamenti di PhotoCraft
@@ -4537,3 +4557,14 @@ shape	Appearance	Aspetto
 	Grayscale Ramp	Barra scala di grigio
 	Current Colors	Colori correnti
 	Make Ramp Web Safe	Limita la barra ai colori web
+# Art History Brush (#213).
+	Art History Brush Tool	Strumento Pennello storia artistica
+	Tight Short	Corto stretto
+	Tight Medium	Medio stretto
+	Tight Long	Lungo stretto
+	Loose Medium	Medio largo
+	Loose Long	Lungo largo
+	Dab	Tocco
+	Tight Curl	Riccio stretto
+	Loose Curl	Riccio largo
+	Stylized dabs from a history state	Tocchi stilizzati da uno stato della storia
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 5ac971b867..c5c0b02fc0 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -655,6 +655,10 @@
 	Fit Layer(s) on Screen	レイヤーを画面サイズに合わせる
 	Fit Artboard on Screen	アートボードを画面サイズに合わせる
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	75%	75%
 	80%	80%
@@ -1021,6 +1025,9 @@
 	Create new pattern from the selection	選択範囲から新規パターンを作成
 	Create new shape from the current path	現在のパスから新規シェイプを作成
 	Create new snapshot	新規スナップショットを作成
+	From:	作成元:
+	Full Document	ドキュメント全体
+	Merged Layers	結合されたレイヤー
 	Create new tool preset	新規ツールプリセットを作成
 	Crop Factor	切り抜き係数
 	Ctrl	Ctrl
@@ -3738,6 +3745,8 @@ curves	Smooth	スムーズ
 	Vanishing Point: click four corners to create a plane	消点: 4 つの角をクリックして面を作成します
 	Vanishing Point is not active	消点はアクティブではありません
 	Apply Vanishing Point ({key})	消点を適用({key})
+	Alt-click a plane to set the clone source	Alt キーを押しながら平面をクリックしてコピー元を設定
+	Too many clone strokes: apply Vanishing Point first	コピースタンプのストロークが多すぎます：先に消点を適用してください
 	Fix the red plane first: its corners must form a convex quad	先に赤い面を修正してください: 角が凸四角形になる必要があります
 # Select and Mask view modes (#1754)
 	Onion Skin	オニオンスキン
@@ -3918,6 +3927,17 @@ curves	Smooth	スムーズ
 	Reset All Locked Settings	ロックされた設定をすべて初期化
 	Copy Texture to Other Tools	テクスチャを他のツールにコピー
 	ICO is limited to 256 × 256 pixels	ICO は 256 × 256 ピクセルまでです
+	Calibration	キャリブレーション
+	Red Primary	レッド原色
+	Green Primary	グリーン原色
+	Blue Primary	ブルー原色
+	Write xmp sidecars	XMP サイドカーファイルを書き込む
+	Set the tone sliders from the image	画像からトーンスライダーを設定
+	Settings from {name}	{name} の設定
+	Settings from {name}; {count} not supported: {names}	{name} の設定; {count} 件は未対応: {names}
+	Could not write {name}: {error}	{name} を書き込めません: {error}
+	Kept {name}: written by another application	{name} はそのままにしました: 別のアプリケーションが書き込んだファイルです
+	Shadow Tint	シャドウの色かぶり補正
 # PhotoCraft release checks.
 	Check for Updates…	アップデートを確認…
 	PhotoCraft Updates	PhotoCraft のアップデート
@@ -4099,3 +4119,14 @@ curves	Smooth	スムーズ
 	Grayscale Ramp	グレースケールランプ
 	Current Colors	現在のカラー
 	Make Ramp Web Safe	ランプを Web セーフにする
+# Art History Brush (#213).
+	Art History Brush Tool	アートヒストリーブラシツール
+	Tight Short	タイト・ショート
+	Tight Medium	タイト・ミディアム
+	Tight Long	タイト・ロング
+	Loose Medium	ルーズ・ミディアム
+	Loose Long	ルーズ・ロング
+	Dab	ダブ
+	Tight Curl	タイトカール
+	Loose Curl	ルーズカール
+	Stylized dabs from a history state	履歴状態から様式化したダブを描きます
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 3a4dc62a46..2c730c1877 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -641,6 +641,10 @@
 	Fit Layer(s) on Screen	레이어를 화면에 맞추기
 	Fit Artboard on Screen	아트보드를 화면에 맞추기
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	Print Size	인쇄 크기
 	Pixel Aspect Ratio	픽셀 종횡비
@@ -1016,6 +1020,10 @@
 	Create new pattern from the selection	선택 영역으로 새 패턴 만들기
 	Create new shape from the current path	현재 패스로 새 모양 만들기
 	Create new snapshot	새 스냅샷 만들기
+	From:	원본:
+	Full Document	전체 문서
+	Merged Layers	병합된 레이어
+	New Snapshot	새 스냅샷
 	Create new style (from the selected type)	새 스타일 만들기(선택한 문자에서)
 	Create new style from the selected layer	선택한 레이어로 새 스타일 만들기
 	Create new tool preset	새 도구 사전 설정 만들기
@@ -3340,6 +3348,8 @@ curves	Smooth	매끄럽게
 	Vanishing Point is not active	소실점이 활성화되어 있지 않습니다
 	Apply Vanishing Point ({key})	소실점 적용 ({key})
 	Fix the red plane first: its corners must form a convex quad	먼저 빨간색 평면을 수정하십시오: 모서리가 볼록 사각형을 이루어야 합니다
+	Alt-click a plane to set the clone source	Alt 키를 누른 채 평면을 클릭하여 복제 소스를 설정하십시오
+	Too many clone strokes: apply Vanishing Point first	복제 획이 너무 많습니다. 먼저 소실점을 적용하십시오
 # Select and Mask view modes (#1754)
 	Onion Skin	어니언 스킨
 	Marching Ants	점선 윤곽
@@ -3441,6 +3451,17 @@ curves	Smooth	매끄럽게
 	Sent to {printer}	{printer}(으)로 전송됨
 	set in Print Settings…	인쇄 설정에서 지정…
 	ICO is limited to 256 × 256 pixels	ICO는 256 × 256픽셀로 제한됩니다
+	Calibration	보정
+	Red Primary	빨강 원색
+	Green Primary	녹색 원색
+	Blue Primary	파랑 원색
+	Write xmp sidecars	XMP 사이드카 파일 쓰기
+	Set the tone sliders from the image	이미지에서 톤 슬라이더 설정
+	Settings from {name}	{name}의 설정
+	Settings from {name}; {count} not supported: {names}	{name}의 설정; {count}개 미지원: {names}
+	Could not write {name}: {error}	{name}을(를) 쓸 수 없음: {error}
+	Kept {name}: written by another application	{name}을(를) 유지함: 다른 응용 프로그램이 작성한 파일
+	Shadow Tint	그림자 색조
 # PhotoCraft release checks.
 	Check for Updates…	업데이트 확인…
 	PhotoCraft Updates	PhotoCraft 업데이트
@@ -3631,3 +3652,21 @@ curves	Smooth	매끄럽게
 	Grayscale Ramp	회색 음영 램프
 	Current Colors	현재 색상
 	Make Ramp Web Safe	램프를 웹 안전 색상으로 만들기
+# Art History Brush (#213).
+	Art History Brush	아트 히스토리 브러시
+	Art History Brush Tool	아트 히스토리 브러시 도구
+	Tight Short	타이트 숏
+	Tight Medium	타이트 미디엄
+	Tight Long	타이트 롱
+	Loose Medium	루즈 미디엄
+	Loose Long	루즈 롱
+	Dab	찍기
+	Tight Curl	타이트 컬
+	Loose Curl	루즈 컬
+	Stylized dabs from a history state	작업 내역 상태에서 양식화된 찍기
+
+# Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
+	Aspect Ratio	종횡비
+	Category	카테고리
+	Target	대상
+	Units	단위
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index 22b9ff60c4..38f378a7b7 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -409,7 +409,7 @@ pub fn language_scope(lang: Lang) -> impl Drop {
 pub fn sync_context(ctx: &egui::Context, language: &str) {
     let lang = Lang::from_pref(language);
     set_current(lang);
-    let id = egui::Id::new("photocraft-ui-language");
+    let id = egui::Id::unique("photocraft-ui-language");
     let changed = ctx.data(|data| data.get_temp::<Lang>(id) != Some(lang));
     if changed {
         ctx.data_mut(|data| data.insert_temp(id, lang));
diff --git a/crates/ui-egui/src/i18n/nl.tsv b/crates/ui-egui/src/i18n/nl.tsv
index b24097f29d..a8539cd159 100644
--- a/crates/ui-egui/src/i18n/nl.tsv
+++ b/crates/ui-egui/src/i18n/nl.tsv
@@ -645,6 +645,10 @@
 	Fit Layer(s) on Screen	Laag/lagen passend in scherm
 	Fit Artboard on Screen	Tekengebied passend in scherm
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	Print Size	Afdrukgrootte
 	Pixel Aspect Ratio	Pixelverhouding
@@ -1000,6 +1004,9 @@
 	Create new pattern from the selection	Nieuw patroon maken van de selectie
 	Create new shape from the current path	Nieuwe vorm maken van het huidige pad
 	Create new snapshot	Nieuwe momentopname maken
+	From:	Van:
+	Full Document	Volledig document
+	Merged Layers	Samengevoegde lagen
 	Create new style (from the selected type)	Nieuwe stijl maken (van de geselecteerde tekst)
 	Create new style from the selected layer	Nieuwe stijl maken van de geselecteerde laag
 	Create new tool preset	Nieuwe gereedschapsvoorinstelling maken
@@ -3882,6 +3889,8 @@ curves	Smooth	Vloeiend maken
 	Vanishing Point is not active	Verdwijnpunt is niet actief
 	Apply Vanishing Point ({key})	Verdwijnpunt toepassen ({key})
 	Fix the red plane first: its corners must form a convex quad	Herstel eerst het rode vlak: de hoeken moeten een convexe vierhoek vormen
+	Alt-click a plane to set the clone source	Alt-klik op een vlak om de kloonbron in te stellen
+	Too many clone strokes: apply Vanishing Point first	Te veel kloonstreken: pas eerst Verdwijnpunt toe
 # Select and Mask view modes (#1754)
 	Onion Skin	Uienschil
 	Marching Ants	Mierenmars
@@ -3999,6 +4008,17 @@ curves	Smooth	Vloeiend maken
 	Sent to {printer}	Verzonden naar {printer}
 	set in Print Settings…	instellen in de afdrukinstellingen…
 	ICO is limited to 256 × 256 pixels	ICO is beperkt tot 256 × 256 pixels
+	Calibration	Kalibratie
+	Red Primary	Primair rood
+	Green Primary	Primair groen
+	Blue Primary	Primair blauw
+	Write xmp sidecars	XMP-sidecarbestanden schrijven
+	Set the tone sliders from the image	Toonschuifregelaars instellen op basis van de afbeelding
+	Settings from {name}	Instellingen uit {name}
+	Settings from {name}; {count} not supported: {names}	Instellingen uit {name}; {count} niet ondersteund: {names}
+	Could not write {name}: {error}	Kan {name} niet schrijven: {error}
+	Kept {name}: written by another application	{name} behouden: geschreven door een andere toepassing
+	Shadow Tint	Schaduwtint
 # PhotoCraft release checks.
 	Check for Updates…	Controleren op updates…
 	PhotoCraft Updates	PhotoCraft-updates
@@ -4180,3 +4200,14 @@ curves	Smooth	Vloeiend maken
 	Grayscale Ramp	Grijswaardenbalk
 	Current Colors	Huidige kleuren
 	Make Ramp Web Safe	Balk beperken tot webkleuren
+# Art History Brush (#213).
+	Art History Brush Tool	Artistiek historiepenseel
+	Tight Short	Strak kort
+	Tight Medium	Strak middel
+	Tight Long	Strak lang
+	Loose Medium	Los middel
+	Loose Long	Los lang
+	Dab	Tik
+	Tight Curl	Strakke krul
+	Loose Curl	Losse krul
+	Stylized dabs from a history state	Gestileerde tikken uit een historiestatus
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index f6334bbc51..6b2ad286a0 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -654,6 +654,10 @@
 	Fit Layer(s) on Screen	Dopasuj warstwy do ekranu
 	Fit Artboard on Screen	Dopasuj obszar roboczy do ekranu
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	75%	75%
 	80%	80%
@@ -1035,6 +1039,9 @@
 	Create new pattern from the selection	Utwórz nowy wzór z zaznaczenia
 	Create new shape from the current path	Utwórz nowy kształt z bieżącej ścieżki
 	Create new snapshot	Utwórz nową migawkę
+	From:	Z:
+	Full Document	Cały dokument
+	Merged Layers	Scalone warstwy
 	Create new style (from the selected type)	Utwórz nowy styl (z zaznaczonego tekstu)
 	Create new style from the selected layer	Utwórz nowy styl z zaznaczonej warstwy
 	Create new tool preset	Utwórz nowe ustawienie wstępne narzędzia
@@ -3757,6 +3764,8 @@ curves	Smooth	Wygładź
 	Vanishing Point is not active	Punkt zbieżności nie jest aktywny
 	Apply Vanishing Point ({key})	Zastosuj punkt zbieżności ({key})
 	Fix the red plane first: its corners must form a convex quad	Najpierw popraw czerwoną płaszczyznę: jej narożniki muszą tworzyć czworokąt wypukły
+	Alt-click a plane to set the clone source	Kliknij płaszczyznę z Alt, aby ustawić źródło klonowania
+	Too many clone strokes: apply Vanishing Point first	Zbyt wiele pociągnięć klonowania: najpierw zastosuj Punkt zbieżności
 # Select and Mask view modes (#1754)
 	Onion Skin	Skórka cebuli
 	Marching Ants	Maszerujące mrówki
@@ -3854,6 +3863,17 @@ curves	Smooth	Wygładź
 	Sent to {printer}	Wysłano do {printer}
 	set in Print Settings…	ustawiane w ustawieniach druku…
 	ICO is limited to 256 × 256 pixels	ICO jest ograniczony do 256 × 256 pikseli
+	Calibration	Kalibracja
+	Red Primary	Czerwień podstawowa
+	Green Primary	Zieleń podstawowa
+	Blue Primary	Niebieski podstawowy
+	Write xmp sidecars	Zapisuj pliki poboczne XMP
+	Set the tone sliders from the image	Ustaw suwaki tonów na podstawie obrazu
+	Settings from {name}	Ustawienia z {name}
+	Settings from {name}; {count} not supported: {names}	Ustawienia z {name}; nieobsługiwane: {count}: {names}
+	Could not write {name}: {error}	Nie można zapisać {name}: {error}
+	Kept {name}: written by another application	Zachowano {name}: zapisany przez inną aplikację
+	Shadow Tint	Tinta cieni
 # PhotoCraft release checks.
 	Check for Updates…	Sprawdź aktualizacje…
 	PhotoCraft Updates	Aktualizacje PhotoCraft
@@ -4037,3 +4057,17 @@ curves	Smooth	Wygładź
 	Grayscale Ramp	Pasek skali szarości
 	Current Colors	Bieżące kolory
 	Make Ramp Web Safe	Ogranicz pasek do kolorów internetowych
+# Art History Brush (#213).
+	Art History Brush Tool	Narzędzie Pędzel historii artystycznej
+	Tight Short	Ścisły krótki
+	Tight Medium	Ścisły średni
+	Tight Long	Ścisły długi
+	Loose Medium	Luźny średni
+	Loose Long	Luźny długi
+	Dab	Plama
+	Tight Curl	Ścisły lok
+	Loose Curl	Luźny lok
+	Stylized dabs from a history state	Stylizowane plamy ze stanu historii
+
+# Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
+	Target	Cel
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index ce433e2010..098ca1f8a6 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -638,6 +638,10 @@
 	Fit Layer(s) on Screen	Ajustar camada(s) à tela
 	Fit Artboard on Screen	Ajustar prancheta à tela
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	75%	75%
 	80%	80%
@@ -1001,6 +1005,9 @@
 	Create new pattern from the selection	Criar novo padrão a partir da seleção
 	Create new shape from the current path	Criar nova forma a partir do demarcador atual
 	Create new snapshot	Criar novo instantâneo
+	From:	De:
+	Full Document	Documento inteiro
+	Merged Layers	Camadas mescladas
 	Create new style (from the selected type)	Criar novo estilo (a partir do texto selecionado)
 	Create new style from the selected layer	Criar novo estilo a partir da camada selecionada
 	Create new tool preset	Criar nova predefinição de ferramenta
@@ -3151,6 +3158,8 @@ curves	Smooth	Suavizar
 	Vanishing Point is not active	Ponto de fuga não está ativo
 	Apply Vanishing Point ({key})	Aplicar ponto de fuga ({key})
 	Fix the red plane first: its corners must form a convex quad	Corrija primeiro o plano vermelho: seus cantos devem formar um quadrilátero convexo
+	Alt-click a plane to set the clone source	Clique com Alt em um plano para definir a origem da clonagem
+	Too many clone strokes: apply Vanishing Point first	Traços de clonagem demais: aplique Ponto de fuga primeiro
 # Select and Mask view modes (#1754)
 	Onion Skin	Papel vegetal
 	Marching Ants	Formigas marchando
@@ -4029,6 +4038,17 @@ layerLabel	No Color	Sem cor
 	Sent to {printer}	Enviado para {printer}
 	set in Print Settings…	definido nas configurações de impressão…
 	ICO is limited to 256 × 256 pixels	ICO é limitado a 256 × 256 pixels
+	Calibration	Calibração
+	Red Primary	Primária vermelha
+	Green Primary	Primária verde
+	Blue Primary	Primária azul
+	Write xmp sidecars	Gravar arquivos auxiliares XMP
+	Set the tone sliders from the image	Definir os controles de tom a partir da imagem
+	Settings from {name}	Configurações de {name}
+	Settings from {name}; {count} not supported: {names}	Configurações de {name}; {count} sem suporte: {names}
+	Could not write {name}: {error}	Não foi possível gravar {name}: {error}
+	Kept {name}: written by another application	{name} mantido: gravado por outro aplicativo
+	Shadow Tint	Matiz das sombras
 # PhotoCraft release checks.
 	Check for Updates…	Verificar atualizações…
 	PhotoCraft Updates	Atualizações do PhotoCraft
@@ -4350,3 +4370,14 @@ layerLabel	No Color	Sem cor
 	Grayscale Ramp	Rampa de tons de cinza
 	Current Colors	Cores atuais
 	Make Ramp Web Safe	Tornar rampa segura para a Web
+# Art History Brush (#213).
+	Art History Brush Tool	Ferramenta Pincel do histórico da arte
+	Tight Short	Curto cerrado
+	Tight Medium	Médio cerrado
+	Tight Long	Longo cerrado
+	Loose Medium	Médio solto
+	Loose Long	Longo solto
+	Dab	Toque
+	Tight Curl	Curva cerrada
+	Loose Curl	Curva solta
+	Stylized dabs from a history state	Toques estilizados a partir de um estado do histórico
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index ef957f3408..d3e6033306 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -449,6 +449,10 @@
 	Zoom Out	Уменьшить
 	Fit on Screen	По размеру экрана
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	75%	75%
 	80%	80%
@@ -2910,6 +2914,9 @@ fontWeight	Italic	Курсив
 	Create new document from current state	Создать новый документ из текущего состояния
 	Create new fill or adjustment layer	Создать новый слой-заливку или корректирующий слой
 	Create new snapshot	Создать новый снимок
+	From:	Из:
+	Full Document	Весь документ
+	Merged Layers	Объединённые слои
 	Delete Cropped Pixels	Удалить отсечённые пикселы
 	Delete current state	Удалить текущее состояние
 	Delete layer	Удалить слой
@@ -3074,6 +3081,8 @@ curves	Smooth	Сгладить
 	Vanishing Point is not active	Точка схода не активна
 	Apply Vanishing Point ({key})	Применить точку схода ({key})
 	Fix the red plane first: its corners must form a convex quad	Сначала исправьте красную плоскость: ее углы должны образовывать выпуклый четырехугольник
+	Alt-click a plane to set the clone source	Щёлкните плоскость с Alt, чтобы задать источник клонирования
+	Too many clone strokes: apply Vanishing Point first	Слишком много мазков клонирования: сначала примените «Точку схода»
 # Select and Mask view modes (#1754)
 	Onion Skin	Калька
 	Marching Ants	Бегущие муравьи
@@ -3193,6 +3202,17 @@ curves	Smooth	Сгладить
 	Sent to {printer}	Отправлено на {printer}
 	set in Print Settings…	задаётся в параметрах печати…
 	ICO is limited to 256 × 256 pixels	ICO ограничен размером 256 × 256 пикселей
+	Calibration	Калибровка
+	Red Primary	Красный основной
+	Green Primary	Зелёный основной
+	Blue Primary	Синий основной
+	Write xmp sidecars	Записывать сопутствующие файлы XMP
+	Set the tone sliders from the image	Установить ползунки тона по изображению
+	Settings from {name}	Настройки из {name}
+	Settings from {name}; {count} not supported: {names}	Настройки из {name}; не поддерживается: {count}: {names}
+	Could not write {name}: {error}	Не удалось записать {name}: {error}
+	Kept {name}: written by another application	{name} сохранён без изменений: записан другим приложением
+	Shadow Tint	Оттенок теней
 # History panel › History Brush source (#2966)
 	Paints from the History panel's source state	Рисует из исходного состояния панели «История»
 	Sets the source for the history brush	Задаёт источник для кисти истории
@@ -4623,3 +4643,14 @@ shape	Appearance	Оформление
 	Grayscale Ramp	Шкала градаций серого
 	Current Colors	Текущие цвета
 	Make Ramp Web Safe	Сделать шкалу безопасной для web
+# Art History Brush (#213).
+	Art History Brush Tool	Инструмент «Кисть истории искусств»
+	Tight Short	Плотный короткий
+	Tight Medium	Плотный средний
+	Tight Long	Плотный длинный
+	Loose Medium	Свободный средний
+	Loose Long	Свободный длинный
+	Dab	Мазок
+	Tight Curl	Плотный завиток
+	Loose Curl	Свободный завиток
+	Stylized dabs from a history state	Стилизованные мазки из состояния истории
diff --git a/crates/ui-egui/src/i18n/sr.tsv b/crates/ui-egui/src/i18n/sr.tsv
index 73e25758a9..6a6dfb425f 100644
--- a/crates/ui-egui/src/i18n/sr.tsv
+++ b/crates/ui-egui/src/i18n/sr.tsv
@@ -629,6 +629,10 @@
 	Fit Layer(s) on Screen	Uklopi sloj(eve) u ekran
 	Fit Artboard on Screen	Uklopi radnu tablu u ekran
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	75%	75%
 	80%	80%
@@ -2286,6 +2290,9 @@
 	Create Snapshot	Napravi snimak stanja
 	Delete Snapshot	Obriši snimak stanja
 	New Snapshot	Novi snimak stanja
+	From:	Od:
+	Full Document	Ceo dokument
+	Merged Layers	Spojeni slojevi
 	New Snapshot…	Novi snimak stanja…
 	History Options…	Opcije istorije…
 	Snapshot 1	Snimak stanja 1
@@ -3078,6 +3085,8 @@ curves	Smooth	Izgladi
 	Vanishing Point is not active	Tačka nestajanja nije aktivna
 	Apply Vanishing Point ({key})	Primeni tačku nestajanja ({key})
 	Fix the red plane first: its corners must form a convex quad	Prvo ispravite crvenu ravan: njeni uglovi moraju činiti konveksan četvorougao
+	Alt-click a plane to set the clone source	Alt-kliknite ravan da postavite izvor kloniranja
+	Too many clone strokes: apply Vanishing Point first	Previše poteza kloniranja: prvo primenite tačku nestajanja
 # Select and Mask view modes (#1754)
 	Onion Skin	Prozirni prikaz
 	Marching Ants	Pokretne crtice
@@ -4267,6 +4276,17 @@ shape	Appearance	Izgled
 	Color Indicates:	Boja označava:
 	Ink Characteristics	Karakteristike mastila
 	Solidity:	Punoća:
+	Calibration	Kalibracija
+	Red Primary	Crvena primarna
+	Green Primary	Zelena primarna
+	Blue Primary	Plava primarna
+	Write xmp sidecars	Upisuj prateće XMP datoteke
+	Set the tone sliders from the image	Postavi klizače tona prema slici
+	Settings from {name}	Podešavanja iz {name}
+	Settings from {name}; {count} not supported: {names}	Podešavanja iz {name}; {count} nije podržano: {names}
+	Could not write {name}: {error}	Nije moguće upisati {name}: {error}
+	Kept {name}: written by another application	{name} je zadržan: upisala ga je druga aplikacija
+	Shadow Tint	Nijansa senki
 	Redrawing	Ponovno iscrtavanje
 
 # Bevel & Emboss shading controls.
@@ -4493,3 +4513,14 @@ shape	Appearance	Izgled
 	Grayscale Ramp	Skala nijansi sive
 	Current Colors	Trenutne boje
 	Make Ramp Web Safe	Učini skalu bezbednom za veb
+# Art History Brush (#213).
+	Art History Brush Tool	Alatka umetnička četkica istorije
+	Tight Short	Usko kratko
+	Tight Medium	Usko srednje
+	Tight Long	Usko dugo
+	Loose Medium	Labavo srednje
+	Loose Long	Labavo dugo
+	Dab	Mrlja
+	Tight Curl	Usko uvijeno
+	Loose Curl	Labavo uvijeno
+	Stylized dabs from a history state	Stilizovane mrlje iz stanja istorije
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index 281cd28f1e..d725b8c9ac 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -629,6 +629,10 @@
 	Fit Layer(s) on Screen	Katmanları Ekrana Sığdır
 	Fit Artboard on Screen	Çalışma Yüzeyini Ekrana Sığdır
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	Print Size	Baskı Boyutu
 	Pixel Aspect Ratio	Piksel En Boy Oranı
@@ -2708,6 +2712,9 @@ cameraRaw	Color	Renk
 	Color indicates	Renk şunu gösterir:
 	Create Snapshot	Anlık Görüntü Oluştur
 	Delete Snapshot	Anlık Görüntüyü Sil
+	From:	Kaynak:
+	Full Document	Tam Belge
+	Merged Layers	Birleştirilmiş Katmanlar
 	New Snapshot	Yeni Anlık Görüntü
 	New Snapshot…	Yeni Anlık Görüntü…
 	History Options…	Geçmiş Seçenekleri…
@@ -3830,6 +3837,8 @@ cameraData	Lens	Lens
 	Draw to modify the curve	Eğriyi değiştirmek için çiz
 	Edit points to modify the curve	Eğriyi değiştirmek için noktaları düzenle
 	Fix the red plane first: its corners must form a convex quad	Önce kırmızı düzlemi düzeltin: köşeleri dışbükey bir dörtgen oluşturmalı
+	Alt-click a plane to set the clone source	Klon kaynağını ayarlamak için bir düzleme Alt+tıklayın
+	Too many clone strokes: apply Vanishing Point first	Çok fazla klon darbesi: önce Kaybolma Noktası'nı uygulayın
 	Grid Size:	Izgara Boyutu:
 	Light Blue	Açık Mavi
 	Light Gray	Açık Gri
@@ -3945,6 +3954,17 @@ cameraData	Lens	Lens
 	Color Indicates:	Rengin Gösterdiği:
 	Ink Characteristics	Mürekkep Özellikleri
 	Solidity:	Doluluk:
+	Calibration	Kalibrasyon
+	Red Primary	Kırmızı ana renk
+	Green Primary	Yeşil ana renk
+	Blue Primary	Mavi ana renk
+	Write xmp sidecars	XMP yan dosyalarını yaz
+	Set the tone sliders from the image	Ton kaydırıcılarını görüntüden ayarla
+	Settings from {name}	{name} ayarları
+	Settings from {name}; {count} not supported: {names}	{name} ayarları; {count} desteklenmiyor: {names}
+	Could not write {name}: {error}	{name} yazılamadı: {error}
+	Kept {name}: written by another application	{name} korundu: başka bir uygulama tarafından yazılmış
+	Shadow Tint	Gölge tonu
 	Redrawing	Yeniden çiziliyor
 # Bevel & Emboss shading controls.
 	Highlight Mode	Vurgu Modu
@@ -4149,3 +4169,14 @@ cameraData	Lens	Lens
 	Grayscale Ramp	Gri Tonlama Şeridi
 	Current Colors	Geçerli Renkler
 	Make Ramp Web Safe	Şeridi Web Renkleriyle Sınırla
+# Art History Brush (#213).
+	Art History Brush Tool	Sanat Tarihi Fırçası Aracı
+	Tight Short	Sıkı Kısa
+	Tight Medium	Sıkı Orta
+	Tight Long	Sıkı Uzun
+	Loose Medium	Gevşek Orta
+	Loose Long	Gevşek Uzun
+	Dab	Benek
+	Tight Curl	Sıkı Kıvrım
+	Loose Curl	Gevşek Kıvrım
+	Stylized dabs from a history state	Bir geçmiş durumundan stilize benekler
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 82540b4754..777f03f60a 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -426,6 +426,10 @@
 	Zoom Out	Зменшити
 	Fit on Screen	Умістити на екрані
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	75%	75%
 	80%	80%
@@ -2760,6 +2764,9 @@ fontWeight	Italic	Курсивний
 	Create new document from current state	Створити новий документ із поточного стану
 	Create new fill or adjustment layer	Створити новий шар заливки або корекції
 	Create new snapshot	Створити новий знімок стану
+	From:	З:
+	Full Document	Увесь документ
+	Merged Layers	Об'єднані шари
 	Delete Cropped Pixels	Видаляти обрізані пікселі
 	Delete current state	Видалити поточний стан
 
@@ -3815,6 +3822,8 @@ curves	Smooth	Згладити
 	Vanishing Point is not active	Точка сходження не активна
 	Apply Vanishing Point ({key})	Застосувати точку сходження ({key})
 	Fix the red plane first: its corners must form a convex quad	Спершу виправте червону площину: її кути мають утворювати опуклий чотирикутник
+	Alt-click a plane to set the clone source	Клацніть площину з Alt, щоб задати джерело клонування
+	Too many clone strokes: apply Vanishing Point first	Забагато мазків клонування: спочатку застосуйте «Точку сходження»
 # Select and Mask view modes (#1754)
 	Onion Skin	Калька
 	Marching Ants	Мурашки
@@ -3939,6 +3948,17 @@ curves	Smooth	Згладити
 	Sent to {printer}	Надіслано на {printer}
 	set in Print Settings…	задається в параметрах друку…
 	ICO is limited to 256 × 256 pixels	ICO обмежено розміром 256 × 256 пікселів
+	Calibration	Калібрування
+	Red Primary	Червоний основний
+	Green Primary	Зелений основний
+	Blue Primary	Синій основний
+	Write xmp sidecars	Записувати супутні файли XMP
+	Set the tone sliders from the image	Встановити повзунки тону за зображенням
+	Settings from {name}	Налаштування з {name}
+	Settings from {name}; {count} not supported: {names}	Налаштування з {name}; не підтримується: {count}: {names}
+	Could not write {name}: {error}	Не вдалося записати {name}: {error}
+	Kept {name}: written by another application	{name} залишено без змін: записаний іншою програмою
+	Shadow Tint	Відтінок тіней
 # PhotoCraft release checks.
 	Check for Updates…	Перевірити оновлення…
 	PhotoCraft Updates	Оновлення PhotoCraft
@@ -4130,3 +4150,17 @@ curves	Smooth	Згладити
 	Grayscale Ramp	Шкала градацій сірого
 	Current Colors	Поточні кольори
 	Make Ramp Web Safe	Зробити шкалу безпечною для вебу
+# Art History Brush (#213).
+	Art History Brush Tool	Інструмент «Художній пензель історії»
+	Tight Short	Щільний короткий
+	Tight Medium	Щільний середній
+	Tight Long	Щільний довгий
+	Loose Medium	Вільний середній
+	Loose Long	Вільний довгий
+	Dab	Мазок
+	Tight Curl	Щільний завиток
+	Loose Curl	Вільний завиток
+	Stylized dabs from a history state	Стилізовані мазки зі стану історії
+
+# Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
+	Target	Ціль
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index ddef986df6..397b02d38d 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -578,6 +578,10 @@
 
 # Phase 3.5 — View menu
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	32-bit Preview Options…	Tùy chọn xem trước 32-bit…
 	Anamorphic 2:1 (2)	Anamorphic 2:1 (2)
@@ -981,6 +985,10 @@
 	Frame from Layers…	Frame từ các lớp…
 	Create new document from current state	Tạo tài liệu mới từ trạng thái hiện tại
 	Create new snapshot	Tạo ảnh chụp trạng thái mới
+	From:	Từ:
+	Full Document	Toàn bộ tài liệu
+	Merged Layers	Các lớp đã gộp
+	New Snapshot	Ảnh chụp trạng thái mới
 	Delete current state	Xóa trạng thái hiện tại
 	No properties	Không có thuộc tính
 	Hide Properties	Ẩn Thuộc tính
@@ -2454,6 +2462,8 @@ shape	Appearance	Diện mạo
 	Fill with {mode}-neutral color (black)	Tô bằng màu trung tính của {mode} (đen)
 	Fill with {mode}-neutral color (white)	Tô bằng màu trung tính của {mode} (trắng)
 	Fix the red plane first: its corners must form a convex quad	Hãy sửa mặt phẳng đỏ trước: các góc phải tạo thành tứ giác lồi
+	Alt-click a plane to set the clone source	Nhấp Alt vào một mặt phẳng để đặt nguồn sao chép
+	Too many clone strokes: apply Vanishing Point first	Quá nhiều nét sao chép: hãy áp dụng Điểm tụ trước
 	Float Panel	Thả nổi bảng
 	Functions	Hàm
 	Grid Size:	Cỡ lưới:
@@ -3702,6 +3712,17 @@ curves	Smooth	Làm mượt
 	Sent to {printer}	Đã gửi tới {printer}
 	set in Print Settings…	đặt trong thiết lập in…
 	ICO is limited to 256 × 256 pixels	ICO giới hạn ở 256 × 256 pixel
+	Calibration	Hiệu chuẩn
+	Red Primary	Màu đỏ cơ bản
+	Green Primary	Màu lục cơ bản
+	Blue Primary	Màu lam cơ bản
+	Write xmp sidecars	Ghi tệp phụ XMP
+	Set the tone sliders from the image	Đặt các thanh trượt tông từ ảnh
+	Settings from {name}	Thiết lập từ {name}
+	Settings from {name}; {count} not supported: {names}	Thiết lập từ {name}; {count} không được hỗ trợ: {names}
+	Could not write {name}: {error}	Không thể ghi {name}: {error}
+	Kept {name}: written by another application	Đã giữ {name}: do ứng dụng khác ghi
+	Shadow Tint	Sắc độ bóng tối
 	Check for Updates…	Kiểm tra bản cập nhật…
 	PhotoCraft Updates	Bản cập nhật PhotoCraft
 	Checking for updates…	Đang kiểm tra bản cập nhật…
@@ -3913,3 +3934,18 @@ curves	Smooth	Làm mượt
 	Grayscale Ramp	Dải thang xám
 	Current Colors	Màu hiện tại
 	Make Ramp Web Safe	Giới hạn dải màu ở màu web
+# Art History Brush (#213).
+	Art History Brush	Cọ lịch sử nghệ thuật
+	Art History Brush Tool	Công cụ Cọ lịch sử nghệ thuật
+	Tight Short	Chặt ngắn
+	Tight Medium	Chặt vừa
+	Tight Long	Chặt dài
+	Loose Medium	Lỏng vừa
+	Loose Long	Lỏng dài
+	Dab	Chấm
+	Tight Curl	Xoắn chặt
+	Loose Curl	Xoắn lỏng
+	Stylized dabs from a history state	Các chấm cách điệu từ một trạng thái lịch sử
+
+# Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
+	Aspect Ratio	Tỷ lệ khung hình
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index d08bb7acd2..e6b9080ae6 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -661,6 +661,10 @@
 	Fit Layer(s) on Screen	使图层适合屏幕
 	Fit Artboard on Screen	使画板适合屏幕
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	75%	75%
 	80%	80%
@@ -1045,6 +1049,10 @@
 	Create new pattern from the selection	从选区创建图案
 	Create new shape from the current path	从当前路径创建形状
 	Create new snapshot	创建快照
+	From:	自：
+	Full Document	完整文档
+	Merged Layers	合并的图层
+	New Snapshot	新建快照
 	Create new tool preset	创建工具预设
 	Crop Factor	裁切系数
 	Ctrl	Ctrl
@@ -2780,6 +2788,9 @@ curves	Smooth	平滑
 	Vanishing Point is not active	消失点未处于活动状态
 	Apply Vanishing Point ({key})	应用消失点（{key}）
 	Fix the red plane first: its corners must form a convex quad	请先修正红色平面：其四个角必须构成凸四边形
+	Alt-click a plane to set the clone source	按住 Alt 键单击平面以设置仿制源
+	Too many clone strokes: apply Vanishing Point first	仿制描边过多：请先应用消失点
+	Stamp	图章
 # Select and Mask view modes (#1754)
 	Onion Skin	洋葱皮
 	Marching Ants	蚂蚁线
@@ -2888,6 +2899,17 @@ curves	Smooth	平滑
 	Sent to {printer}	已发送到 {printer}
 	set in Print Settings…	在打印设置中设置…
 	ICO is limited to 256 × 256 pixels	ICO 最大为 256 × 256 像素
+	Calibration	校准
+	Red Primary	红原色
+	Green Primary	绿原色
+	Blue Primary	蓝原色
+	Write xmp sidecars	写入 XMP 附属文件
+	Set the tone sliders from the image	根据图像设置色调滑块
+	Settings from {name}	来自 {name} 的设置
+	Settings from {name}; {count} not supported: {names}	来自 {name} 的设置；{count} 项不支持：{names}
+	Could not write {name}: {error}	无法写入 {name}：{error}
+	Kept {name}: written by another application	已保留 {name}：由其他应用程序写入
+	Shadow Tint	阴影色调
 # PhotoCraft release checks.
 	Check for Updates…	检查更新…
 	PhotoCraft Updates	PhotoCraft 更新
@@ -3089,3 +3111,26 @@ curves	Smooth	平滑
 	Exported {path}	已导出 {path}
 	Exported {n} files	已导出 {n} 个文件
 	Driver: {driver}	驱动程序：{driver}
+# Art History Brush (#213).
+	Art History Brush	艺术历史画笔
+	Art History Brush Tool	艺术历史画笔工具
+	Tight Short	紧密短
+	Tight Medium	紧密中
+	Tight Long	紧密长
+	Loose Medium	宽松中
+	Loose Long	宽松长
+	Dab	点涂
+	Tight Curl	紧密卷曲
+	Loose Curl	宽松卷曲
+	Area	区域
+	Stylized dabs from a history state	从历史状态绘制风格化点涂
+
+# Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
+	Aspect Ratio	长宽比
+	Category	类别
+	Color Table	颜色表
+	Gamma	伽马
+	Interpolation	插值
+	Profile	配置文件
+	Target	目标
+	Units	单位
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index dd05b6ad5b..1586d47bf8 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -666,6 +666,10 @@
 	Fit Layer(s) on Screen	使圖層符合螢幕
 	Fit Artboard on Screen	使工作區域符合螢幕
 	100%	100%
+	105%	105%
+	110%	110%
+	115%	115%
+	120%	120%
 	200%	200%
 	75%	75%
 	80%	80%
@@ -1033,6 +1037,10 @@
 	Create new pattern from the selection	從選取範圍建立新圖樣
 	Create new shape from the current path	從目前路徑建立新形狀
 	Create new snapshot	建立新快照
+	From:	自：
+	Full Document	完整文件
+	Merged Layers	合併的圖層
+	New Snapshot	新增快照
 	Create new tool preset	建立新工具預設集
 	Crop Factor	裁切係數
 	Ctrl	Ctrl
@@ -2729,6 +2737,9 @@ curves	Smooth	平滑
 	Vanishing Point is not active	消失點未啟用
 	Apply Vanishing Point ({key})	套用消失點 ({key})
 	Fix the red plane first: its corners must form a convex quad	請先修正紅色平面：其四個角必須構成凸四邊形
+	Alt-click a plane to set the clone source	按住 Alt 鍵按一下平面以設定仿製來源
+	Too many clone strokes: apply Vanishing Point first	仿製筆畫過多：請先套用消失點
+	Stamp	印章
 # Select and Mask view modes (#1754)
 	Onion Skin	洋蔥皮
 	Marching Ants	螞蟻線
@@ -2852,6 +2863,17 @@ curves	Smooth	平滑
 	Sent to {printer}	已傳送至 {printer}
 	set in Print Settings…	在列印設定中設定…
 	ICO is limited to 256 × 256 pixels	ICO 最大為 256 × 256 像素
+	Calibration	校準
+	Red Primary	紅原色
+	Green Primary	綠原色
+	Blue Primary	藍原色
+	Write xmp sidecars	寫入 XMP 附屬檔案
+	Set the tone sliders from the image	根據影像設定色調滑桿
+	Settings from {name}	來自 {name} 的設定
+	Settings from {name}; {count} not supported: {names}	來自 {name} 的設定；{count} 項不支援：{names}
+	Could not write {name}: {error}	無法寫入 {name}：{error}
+	Kept {name}: written by another application	已保留 {name}：由其他應用程式寫入
+	Shadow Tint	陰影色調
 # PhotoCraft release checks.
 	Check for Updates…	檢查更新…
 	PhotoCraft Updates	PhotoCraft 更新
@@ -3045,3 +3067,26 @@ curves	Smooth	平滑
 	Grayscale Ramp	灰階色帶
 	Current Colors	目前色彩
 	Make Ramp Web Safe	讓色帶成為網頁安全色
+# Art History Brush (#213).
+	Art History Brush	藝術歷史畫筆
+	Art History Brush Tool	藝術歷史畫筆工具
+	Tight Short	緊密短
+	Tight Medium	緊密中
+	Tight Long	緊密長
+	Loose Medium	寬鬆中
+	Loose Long	寬鬆長
+	Dab	點塗
+	Tight Curl	緊密捲曲
+	Loose Curl	寬鬆捲曲
+	Area	區域
+	Stylized dabs from a history state	從歷史狀態繪製風格化點塗
+
+# Egui 0.37 migration controls (Aspect Ratio, Category, Color Table, Gamma, Interpolation, Profile, Target, Units, Demosaic)
+	Aspect Ratio	外觀比例
+	Category	類別
+	Color Table	色彩表
+	Gamma	Gamma
+	Interpolation	內插
+	Profile	描述檔
+	Target	目標
+	Units	單位
diff --git a/crates/ui-egui/src/icons.rs b/crates/ui-egui/src/icons.rs
index bb1bba202b..f1bd354a1c 100644
--- a/crates/ui-egui/src/icons.rs
+++ b/crates/ui-egui/src/icons.rs
@@ -39,7 +39,7 @@ pub fn paint(ui: &egui::Ui, rect: Rect, name: &str, size: f32, tint: Color32) {
 /// cursor (`CursorIcon::None`).
 pub fn cursor(ctx: &egui::Context, name: &str, p: egui::Pos2, hot: Vec2, size: f32) {
     let rect = Rect::from_min_size(p - hot * size, Vec2::splat(size));
-    let area = egui::Area::new(egui::Id::new("pc-icon-cursor")).order(egui::Order::Tooltip).fixed_pos(rect.min).constrain(false).interactable(false);
+    let area = egui::Area::new(egui::Id::unique("pc-icon-cursor")).order(egui::Order::Tooltip).fixed_pos(rect.min).constrain(false).interactable(false);
     area.show(ctx, |ui| {
         let outline = image(name, size, Color32::from_black_alpha(200));
         for (dx, dy) in [(-1.0, 0.0), (1.0, 0.0), (0.0, -1.0), (0.0, 1.0), (-1.0, -1.0), (1.0, 1.0), (-1.0, 1.0), (1.0, -1.0)] {
@@ -64,7 +64,7 @@ pub fn cursor_copy_badge(ctx: &egui::Context, p: egui::Pos2) {
 fn badge(ctx: &egui::Context, name: &str, p: egui::Pos2, doubled: bool) {
     const SIZE: f32 = 12.0;
     let rect = Rect::from_center_size(p + egui::vec2(20.0, 19.0), Vec2::splat(SIZE));
-    let area = egui::Area::new(egui::Id::new("pc-cursor-badge")).order(egui::Order::Tooltip).fixed_pos(rect.min).constrain(false).interactable(false);
+    let area = egui::Area::new(egui::Id::unique("pc-cursor-badge")).order(egui::Order::Tooltip).fixed_pos(rect.min).constrain(false).interactable(false);
     area.show(ctx, |ui| {
         let outline = image(name, SIZE, Color32::from_black_alpha(220));
         let halo = [(-1.0, 0.0), (1.0, 0.0), (0.0, -1.0), (0.0, 1.0), (-1.0, -1.0), (1.0, 1.0), (-1.0, 1.0), (1.0, -1.0)];
@@ -127,6 +127,7 @@ pub fn tool_icon(t: Tool) -> &'static str {
         Tool::CloneStamp => "stamp",
         Tool::PatternStamp => "grid-3x3",
         Tool::HistoryBrush => "clock",
+        Tool::ArtHistoryBrush => "sparkles",
         Tool::Blur => "droplet",
         Tool::Sharpen => "triangle",
         Tool::Smudge => "pointer",
@@ -211,7 +212,7 @@ pub fn rail_button(ui: &mut egui::Ui, name: &str, box_size: f32, on: bool, toolt
     }
     let tint = if on || resp.hovered() { t.text } else { t.text_faint };
     paint(ui, rect, name, (box_size * 0.52).round(), tint);
-    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, ui.is_enabled(), on, tl!(tooltip)));
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, ui.is_enabled(), on, tl!(tooltip)));
     resp.on_hover_text(tl!(tooltip))
 }
 
diff --git a/crates/ui-egui/src/input_tests.rs b/crates/ui-egui/src/input_tests.rs
index 89dc5e5483..4826872457 100644
--- a/crates/ui-egui/src/input_tests.rs
+++ b/crates/ui-egui/src/input_tests.rs
@@ -166,7 +166,13 @@ fn clicking_outside_a_dialog_keeps_it_open_and_the_canvas_pans_and_zooms() {
 
     // Scrolling over the canvas pans it.
     let c0 = h.state().ui.views[0].center;
-    h.event(egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Point, delta: vec2(0.0, -40.0), phase: egui::TouchPhase::Move, modifiers: Modifiers::NONE });
+    h.event(egui::Event::MouseWheel {
+        source: egui::MouseWheelSource::Unknown,
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(0.0, -40.0),
+        phase: egui::TouchPhase::Move,
+        modifiers: Modifiers::NONE,
+    });
     h.run_steps(8);
     let c1 = h.state().ui.views[0].center;
     assert!(c1[1] > c0[1], "scroll pans under a dialog: {c0:?} -> {c1:?}");
@@ -421,7 +427,16 @@ fn command_click_under_curves_adds_one_point_per_press_not_per_frame() {
 /// with ⌘/Ctrl), one history step per press; ⌘/Ctrl+←/→ moves by word; Alt+Shift+→ extends
 /// the selection by a word.
 fn wheel(h: &Harness<'static, PhotocraftApp>, dy: f32, modifiers: Modifiers) {
-    h.event_modifiers(egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: vec2(0.0, dy), phase: egui::TouchPhase::Move, modifiers }, modifiers);
+    h.event_modifiers(
+        egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: egui::MouseWheelUnit::Line,
+            delta: vec2(0.0, dy),
+            phase: egui::TouchPhase::Move,
+            modifiers,
+        },
+        modifiers,
+    );
 }
 
 /// The document point under screen point `p` (no flip).
@@ -492,6 +507,8 @@ fn the_wheel_reaches_12800_percent_and_stops_dead_there() {
 #[test]
 fn alt_scroll_zooms_in_steps_around_the_pointer() {
     let mut h = harness();
+    // Animated Zoom off: a notch is one instant step (the default eases it, see the next test).
+    h.state_mut().session.edit_prefs(|p| p.general.animated_zoom = false);
     let r = h.state().last_canvas_rect;
     let p = pos2(r.center().x + 120.0, r.center().y - 70.0);
     h.hover_at(p);
@@ -535,6 +552,44 @@ fn alt_scroll_zooms_in_steps_around_the_pointer() {
     assert!((zoom(&h) / z2 - 1.25).abs() < 1e-3, "pinch zooms: {z2} -> {}", zoom(&h));
 }
 
+/// Animated Zoom on (the default): a notch eases in over several frames but is still ×1.1 in
+/// total, around the pointer.
+#[test]
+fn animated_alt_scroll_zoom_still_lands_on_one_step_around_the_pointer() {
+    let mut h = harness();
+    assert!(h.state().session.prefs().general.animated_zoom, "on by default");
+    let r = h.state().last_canvas_rect;
+    let p = pos2(r.center().x + 120.0, r.center().y - 70.0);
+    h.hover_at(p);
+    h.run_steps(2);
+    let (z0, d0) = (zoom(&h), doc_at(&h, p));
+    wheel(&h, 1.0, Modifiers::ALT);
+    h.run_steps(40);
+    let (z1, d1) = (zoom(&h), doc_at(&h, p));
+    assert!((z1 / z0 - 1.1).abs() < 1e-3, "one ⌥ notch is ×1.1: {z0} -> {z1}");
+    assert!((d1[0] - d0[0]).abs() < 0.05 && (d1[1] - d0[1]).abs() < 0.05, "centred on the pointer: {d0:?} -> {d1:?}");
+}
+
+/// Animated Zoom on: notches flicked past 12800 % stop there, and the first notch back zooms out
+/// at once by its ×1/1.1. The rest of the notches the limit swallowed must not eat it.
+#[test]
+fn the_first_animated_notch_back_from_the_limit_zooms_out() {
+    let mut h = harness();
+    {
+        let v = &mut h.state_mut().ui.views[0];
+        (v.zoom, v.fit_pending) = (crate::zoom_levels::MAX / 1.05, false);
+    }
+    let r = h.state().last_canvas_rect;
+    h.hover_at(r.center());
+    h.run_steps(2);
+    wheel(&h, 3.0, Modifiers::ALT);
+    h.step();
+    assert_eq!(zoom(&h), crate::zoom_levels::MAX, "the flick reaches the limit");
+    wheel(&h, -1.0, Modifiers::ALT);
+    h.run_steps(40);
+    assert!((zoom(&h) - crate::zoom_levels::MAX / 1.1).abs() < 1e-2, "one notch back: {}", zoom(&h));
+}
+
 #[test]
 fn alt_scroll_zooms_while_a_temporary_tool_is_held() {
     let mut h = harness();
diff --git a/crates/ui-egui/src/jobs_ui.rs b/crates/ui-egui/src/jobs_ui.rs
index 980aff20eb..d66932dafc 100644
--- a/crates/ui-egui/src/jobs_ui.rs
+++ b/crates/ui-egui/src/jobs_ui.rs
@@ -615,6 +615,10 @@ pub(crate) fn after_open(
         notices::io_warnings(app, &opened, &crate::camera_raw_ui::without_develop_note(warnings));
     } else {
         notices::io_warnings(app, &opened, warnings);
+        // A raw that opened without the dialog is developed by its sidecar / Camera Raw Defaults.
+        if let Some(index) = app.session.active_index() {
+            crate::camera_raw_ui::opened_without_dialog(app, index, name, path, warnings);
+        }
     }
     // Script events bound to "Open Document".
     photocraft_engine::automate_cmds::document_opened(&mut app.session);
@@ -744,7 +748,7 @@ pub fn dialog(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let t = Tokens::get(ctx);
     let mut cancel_it = false;
     // Photoshop doesn't dim the window behind its progress dialog either.
-    let modal = egui::Modal::new(egui::Id::new("job-progress")).backdrop_color(Color32::from_black_alpha(36)).show(ctx, |ui| {
+    let modal = egui::Modal::new(egui::Id::unique("job-progress")).backdrop_color(Color32::from_black_alpha(36)).show(ctx, |ui| {
         ui.set_width(360.0);
         ui.label(RichText::new(tl!(&j.label)).font(crate::theme::semibold(15.0)));
         ui.add_space(4.0);
@@ -789,7 +793,7 @@ pub struct OpenCardRects {
 }
 
 fn open_card_rects_id() -> egui::Id {
-    egui::Id::new("open-card-rects")
+    egui::Id::unique("open-card-rects")
 }
 
 /// The opening card's parts as drawn last frame, if it was shown.
@@ -813,7 +817,7 @@ pub fn open_card(app: &mut PhotocraftApp, ui: &mut egui::Ui, job: JobId) {
     ui.painter().rect_filled(area, 0.0, t.canvas);
     // Centre the card at the height its content needed last frame; the background is painted
     // once the rows are laid out, so a taller content (a long translation) still gets a card.
-    let height_id = egui::Id::new(("open-card-height", job));
+    let height_id = egui::Id::unique(("open-card-height", job));
     let height = ui.ctx().data(|d| d.get_temp::<f32>(height_id)).unwrap_or(OPEN_CARD_MIN_HEIGHT);
     let card = Rect::from_center_size(area.center(), vec2(OPEN_CARD_WIDTH, height));
     let fill = ui.painter().add(egui::Shape::Noop);
diff --git a/crates/ui-egui/src/jobs_ui_tests.rs b/crates/ui-egui/src/jobs_ui_tests.rs
index b9ff0f00a5..6b58786a85 100644
--- a/crates/ui-egui/src/jobs_ui_tests.rs
+++ b/crates/ui-egui/src/jobs_ui_tests.rs
@@ -483,9 +483,13 @@ fn save_in_background_off_blocks_the_app_until_the_file_is_written() {
     assert_eq!(r["pending"], true, "the same background job does the work");
     h.run_steps(1);
     // The dialog is up from the first frame (no delay), titled with the save, then its stage.
+    // A new modal's accessibility tree can take a second pass to appear under kittest.
+    let t = Instant::now();
+    while h.query_by_label("Saving fg.psd").is_none() && t.elapsed() < Duration::from_secs(30) {
+        h.step();
+    }
     h.get_by_label("Saving fg.psd");
     h.get_by_label("Esc to cancel");
-    let t = Instant::now();
     while h.query_by_label("Encoding").is_none() && t.elapsed() < Duration::from_secs(30) {
         h.step();
     }
diff --git a/crates/ui-egui/src/jpeg_options_ui.rs b/crates/ui-egui/src/jpeg_options_ui.rs
index 3066efe9b2..025bcd2b9e 100644
--- a/crates/ui-egui/src/jpeg_options_ui.rs
+++ b/crates/ui-egui/src/jpeg_options_ui.rs
@@ -196,7 +196,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let Some(p) = &mut app.jpeg_options else { return };
     let (mut ok, mut cancel) = (false, false);
     let (mut quality, mut format) = (p.quality, p.format);
-    let modal = egui::Modal::new(egui::Id::new("jpeg-options")).show(ctx, |ui| {
+    let modal = egui::Modal::new(egui::Id::unique("jpeg-options")).show(ctx, |ui| {
         ui.set_max_width(360.0);
         ui.label(egui::RichText::new(tl!("JPEG Options")).font(crate::theme::semibold(15.0)));
         ui.add_space(4.0);
@@ -204,18 +204,19 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         ui.add_space(8.0);
         crate::widgets::section_label(ui, tl!("Image Options"));
         ui.horizontal(|ui| {
-            ui.label(tl!("Quality"));
-            ui.add(egui::DragValue::new(&mut quality).range(0..=MAX_QUALITY).speed(0.1));
+            let quality_caption = ui.label(tl!("Quality"));
+            ui.add(egui::DragValue::new(&mut quality).range(0..=MAX_QUALITY).speed(0.1)).labelled_by(quality_caption.id);
             // Photoshop's presets: picking one sets the quality it starts at.
-            egui::ComboBox::from_id_salt("jpeg-quality-preset").selected_text(quality_label(quality)).show_ui(ui, |ui| {
+            let preset = egui::ComboBox::from_id_salt("jpeg-quality-preset").selected_text(quality_label(quality)).show_ui(ui, |ui| {
                 for q in [3, 5, 8, 10] {
                     if ui.selectable_label(quality_label(quality) == quality_label(q), quality_label(q)).clicked() {
                         quality = q;
                     }
                 }
             });
+            let _ = preset.response.accessible_name(tl!("Preset"));
         });
-        ui.add(egui::Slider::new(&mut quality, 0..=MAX_QUALITY).show_value(false));
+        ui.add(egui::Slider::new(&mut quality, 0..=MAX_QUALITY).show_value(false)).accessible_name(tl!("Quality"));
         ui.add_space(8.0);
         crate::widgets::section_label(ui, tl!("Format Options"));
         ui.radio_value(&mut format, JpegFormat::Baseline, tl!("Baseline (\"Standard\")"));
diff --git a/crates/ui-egui/src/kys_import.rs b/crates/ui-egui/src/kys_import.rs
index 75f46a775b..c58499620f 100644
--- a/crates/ui-egui/src/kys_import.rs
+++ b/crates/ui-egui/src/kys_import.rs
@@ -222,7 +222,7 @@ pub fn show_offer(app: &mut PhotocraftApp, ctx: &egui::Context) {
     );
     let mut answer = None;
     egui::Window::new(tl!("Import keyboard shortcuts?"))
-        .id(egui::Id::new("kys-offer"))
+        .id(egui::Id::unique("kys-offer"))
         .collapsible(false)
         .resizable(false)
         .default_width(440.0)
diff --git a/crates/ui-egui/src/layer_filter_ui.rs b/crates/ui-egui/src/layer_filter_ui.rs
index e933d0c165..82c17e650e 100644
--- a/crates/ui-egui/src/layer_filter_ui.rs
+++ b/crates/ui-egui/src/layer_filter_ui.rs
@@ -123,7 +123,7 @@ pub fn bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     ui.horizontal(|ui| {
         ui.spacing_mut().item_spacing.x = 2.0;
         let by = [(FilterBy::Kind, tl!("Kind")), (FilterBy::Name, tl!("Name")), (FilterBy::Mode, tl!("Mode"))];
-        widgets::dropdown(ui, "layer-filter-by", &mut app.ui.layer_filter_by, &by, 64.0);
+        widgets::dropdown(ui, "layer-filter-by", tl!("Kind"), &mut app.ui.layer_filter_by, &by, 64.0);
         ui.add_space(4.0);
         match app.ui.layer_filter_by {
             FilterBy::Kind => {
@@ -146,12 +146,12 @@ pub fn bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             }
             FilterBy::Name => {
                 let width = ui.available_width().max(48.0);
-                widgets::text_field(ui, ui.id().with("layer-filter-name"), &mut app.ui.layer_filter_name, tl!("Search"), width, false);
+                widgets::text_field(ui, ui.scope_id().with("layer-filter-name"), &mut app.ui.layer_filter_name, tl!("Search"), width, false);
             }
             FilterBy::Mode => {
                 let modes: Vec<(BlendMode, &str)> = std::iter::once(BlendMode::PassThrough).chain(BlendMode::LAYER_MODES).map(|m| (m, m.label())).collect();
                 let width = ui.available_width().max(96.0);
-                widgets::dropdown(ui, "layer-filter-mode", &mut app.ui.layer_filter_mode, &modes, width);
+                widgets::dropdown(ui, "layer-filter-mode", tl!("Mode"), &mut app.ui.layer_filter_mode, &modes, width);
             }
         }
     });
diff --git a/crates/ui-egui/src/layer_menu_ui.rs b/crates/ui-egui/src/layer_menu_ui.rs
index a26b2f1b32..0ea4db41ea 100644
--- a/crates/ui-egui/src/layer_menu_ui.rs
+++ b/crates/ui-egui/src/layer_menu_ui.rs
@@ -289,8 +289,8 @@ pub(crate) fn color_choices(app: &crate::PhotocraftApp, ui: &mut egui::Ui, l: &L
 fn color_button(ui: &mut egui::Ui, color: LabelColor, checked: bool) -> egui::Response {
     use egui::{Atom, Rect, Stroke, StrokeKind, vec2};
     let t = crate::theme::Tokens::get(ui.ctx());
-    let check_id = ui.id().with(("label-check", color.id()));
-    let swatch_id = ui.id().with(("label-swatch", color.id()));
+    let check_id = egui::IdSalt::new(("label-check", color.id()));
+    let swatch_id = egui::IdSalt::new(("label-swatch", color.id()));
     let name = color_name(color);
     let button = egui::Button::new((Atom::custom(check_id, vec2(14.0, 16.0)), Atom::custom(swatch_id, vec2(16.0, 16.0)), name, Atom::grow())).atom_ui(ui);
     if checked && let Some(rect) = button.rect(check_id) {
@@ -309,7 +309,7 @@ fn color_button(ui: &mut egui::Ui, color: LabelColor, checked: bool) -> egui::Re
             p.line_segment([r.right_top(), r.left_bottom()], stroke);
         }
     }
-    button.response.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, ui.is_enabled(), checked, name));
+    button.response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, ui.is_enabled(), checked, name));
     button.response
 }
 
@@ -553,7 +553,7 @@ mod tests {
         let ctx = egui::Context::default();
         crate::PhotocraftApp::setup_context(&ctx, crate::theme::ThemeKind::ALL[0]);
         let screen = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(800.0, 300.0));
-        let id = egui::Id::new("layer-menu-probe");
+        let id = egui::Id::unique("layer-menu-probe");
         let mut content = 0.0;
         for _ in 0..4 {
             let input = egui::RawInput { screen_rect: Some(screen), ..Default::default() };
diff --git a/crates/ui-egui/src/layer_menu_ui/color_tests.rs b/crates/ui-egui/src/layer_menu_ui/color_tests.rs
index 88c11dfd2c..4bc114ae5f 100644
--- a/crates/ui-egui/src/layer_menu_ui/color_tests.rs
+++ b/crates/ui-egui/src/layer_menu_ui/color_tests.rs
@@ -41,9 +41,9 @@ fn layer_color_context_menu_edits_the_clicked_layer_and_preserves_multi_selectio
         let (mut h, red, other) = harness(crate::theme::ThemeKind::Pro, ppp);
         let at = row(&h, red).center();
         click(&mut h, at, PointerButton::Secondary, Modifiers::NONE);
-        let at = h.get_by_label("Color ⏵").rect().center();
+        let at = h.query_all_by_role_and_label(egui::accesskit::Role::Button, "Color").last().expect("the Color submenu").rect().center();
         click(&mut h, at, PointerButton::Primary, Modifiers::NONE);
-        let at = h.get_by_label("Seafoam").rect().center();
+        let at = h.get_by_role_and_label(egui::accesskit::Role::Button, "Seafoam").rect().center();
         click(&mut h, at, PointerButton::Primary, Modifiers::NONE);
         let st = h.state().session.active().unwrap();
         assert_eq!(st.active_layer, Some(red));
@@ -55,9 +55,9 @@ fn layer_color_context_menu_edits_the_clicked_layer_and_preserves_multi_selectio
         assert_eq!(common_color(h.state(), clicked, true), None);
         let at = row(&h, red).center();
         click(&mut h, at, PointerButton::Secondary, Modifiers::NONE);
-        let at = h.get_by_label("Color ⏵").rect().center();
+        let at = h.query_all_by_role_and_label(egui::accesskit::Role::Button, "Color").last().expect("the Color submenu").rect().center();
         click(&mut h, at, PointerButton::Primary, Modifiers::NONE);
-        let at = h.get_by_label("Indigo").rect().center();
+        let at = h.get_by_role_and_label(egui::accesskit::Role::Button, "Indigo").rect().center();
         click(&mut h, at, PointerButton::Primary, Modifiers::NONE);
         let st = h.state().session.active().unwrap();
         assert_eq!(st.selected_layers().len(), 2);
@@ -119,7 +119,7 @@ fn right_clicking_eye_opens_color_choices_without_toggling_visibility() {
     let r = row(&h, red);
     let eye = pos2(r.left() + 17.0, r.center().y);
     click(&mut h, eye, PointerButton::Secondary, Modifiers::NONE);
-    let blue = h.get_by_label("Blue").rect().center();
+    let blue = h.get_by_role_and_label(egui::accesskit::Role::Button, "Blue").rect().center();
     click(&mut h, blue, PointerButton::Primary, Modifiers::NONE);
 
     let st = h.state().session.active().unwrap();
@@ -136,6 +136,6 @@ fn layer_color_menu_marks_only_the_common_color() {
         }
     });
     h.run();
-    assert_eq!(h.get_by_label("Blue").accesskit_node().toggled(), Some(egui::accesskit::Toggled::True));
-    assert_eq!(h.get_by_label("Red").accesskit_node().toggled(), Some(egui::accesskit::Toggled::False));
+    assert_eq!(h.get_by_role_and_label(egui::accesskit::Role::Button, "Blue").accesskit_node().toggled(), Some(egui::accesskit::Toggled::True));
+    assert_eq!(h.get_by_role_and_label(egui::accesskit::Role::Button, "Red").accesskit_node().toggled(), Some(egui::accesskit::Toggled::False));
 }
diff --git a/crates/ui-egui/src/layer_pick_ui.rs b/crates/ui-egui/src/layer_pick_ui.rs
index b75fe2b47b..3a3bf1efa1 100644
--- a/crates/ui-egui/src/layer_pick_ui.rs
+++ b/crates/ui-egui/src/layer_pick_ui.rs
@@ -62,7 +62,7 @@ pub fn choose(app: &mut PhotocraftApp, layer: u64) {
 }
 
 fn menu_id() -> egui::Id {
-    egui::Id::new("canvas-layer-menu")
+    egui::Id::unique("canvas-layer-menu")
 }
 
 /// Show the open menu. Escape or a click outside closes it.
diff --git a/crates/ui-egui/src/layer_props_ui.rs b/crates/ui-egui/src/layer_props_ui.rs
index 55852aeea1..778cb8f6cd 100644
--- a/crates/ui-egui/src/layer_props_ui.rs
+++ b/crates/ui-egui/src/layer_props_ui.rs
@@ -12,7 +12,8 @@ use crate::{PhotocraftApp, widgets};
 
 /// `edit.transform` params that scale the content box `b` = [x0, y0, x1, y1] to `w` x `h`, keeping
 /// the top-left corner (Photoshop's Properties W/H fields), or `layer.translate` params for X/Y.
-pub fn transform_params(layer: u64, b: [i32; 4], w: Option<f32>, h: Option<f32>, linked: bool) -> Option<Value> {
+/// `tol` is the smallest change, in px, that counts as an edit (see [`edit_tolerance`]).
+pub fn transform_params(layer: u64, b: [f64; 4], w: Option<f32>, h: Option<f32>, linked: bool, tol: f32) -> Option<Value> {
     let (bw, bh) = ((b[2] - b[0]) as f32, (b[3] - b[1]) as f32);
     if bw <= 0.0 || bh <= 0.0 {
         return None;
@@ -25,7 +26,7 @@ pub fn transform_params(layer: u64, b: [i32; 4], w: Option<f32>, h: Option<f32>,
             nw = (nh * bw / bh).max(1.0);
         }
     }
-    if (nw - bw).abs() < 0.5 && (nh - bh).abs() < 0.5 {
+    if (nw - bw).abs() < tol && (nh - bh).abs() < tol {
         return None;
     }
     let (x0, y0) = (b[0] as f32, b[1] as f32);
@@ -35,11 +36,27 @@ pub fn transform_params(layer: u64, b: [i32; 4], w: Option<f32>, h: Option<f32>,
 
 /// A number field that reports a value once committed (drag released, Enter, focus lost). `label` is its own
 /// label and the one stacked with it in the same column ("W" over "X"), which share a centre.
-fn field(ui: &mut egui::Ui, id: &str, label: (&str, &str), current: f32, width: f32, u: LenUnit, extent: f64) -> Option<f32> {
+/// The smallest W/H change, in px, that counts as an edit. A pixel frame is whole pixels: under
+/// half a pixel is noise. A shape's path is fractional and is scaled to exactly the typed size,
+/// so anything past the field's own rounding (half its last shown decimal) is an edit: 400.25 px
+/// typed as 400 applies, while focusing and leaving the field (which re-reads its rounded text)
+/// doesn't.
+fn edit_tolerance(layer: &Layer, u: LenUnit, extent: f64) -> f32 {
+    match &layer.content {
+        LayerContent::Shape(sh) if !sh.path.inverted => ((u.px(0.05, extent) - u.px(0.0, extent)).abs() as f32 + 1e-3).min(0.5),
+        _ => 0.5,
+    }
+}
+
+/// `len` is the unit shown and its 100% extent (for percent); `name` is the field's accessible name.
+// The explicit accessible name accompanies the existing numeric-field parameters.
+#[expect(clippy::too_many_arguments)]
+fn field(ui: &mut egui::Ui, id: &str, label: (&str, &str), name: &str, current: f32, width: f32, len: (LenUnit, f64), tol: f32) -> Option<f32> {
+    let (u, extent) = len;
     stacked_label(ui, tl!(label.0), &[tl!(label.0), tl!(label.1)], LABEL_W, 2.0);
     let key = ui.make_persistent_id(("layer-props-field", id));
     let mut v = ui.data(|d| d.get_temp::<f32>(key)).unwrap_or_else(|| u.shown(f64::from(current), extent));
-    let resp = widgets::value_field(ui, &mut v, -300_000.0..=300_000.0, u.unit.suffix(), width);
+    let resp = widgets::value_field(ui, &mut v, -300_000.0..=300_000.0, u.unit.suffix(), width).accessible_name(tl!(name));
     if resp.dragged() || resp.has_focus() {
         ui.data_mut(|d| d.insert_temp(key, v));
         return None;
@@ -49,7 +66,7 @@ fn field(ui: &mut egui::Ui, id: &str, label: (&str, &str), current: f32, width:
         return None;
     }
     let px = u.px(v, extent) as f32;
-    ((px - current).abs() >= 0.5).then_some(px)
+    ((px - current).abs() >= tol).then_some(px)
 }
 
 /// Lengths in the Units & Rulers unit, as Photoshop's Properties panel shows them (cm when the
@@ -116,6 +133,17 @@ fn align_glyph(ui: &egui::Ui, r: Rect, kind: &str, color: egui::Color32) {
     }
 }
 
+/// The box the Transform fields show and edit, [x0, y0, x1, y1]: the layer's pixel frame `px`,
+/// or for a shape its path's geometry, as Photoshop's Properties shows it, without the pixels its
+/// stroke adds around it; W/H then scale the path to exactly the typed size.
+fn frame(layer: &Layer, px: photocraft_geom::Rect) -> [f64; 4] {
+    let path = match &layer.content {
+        LayerContent::Shape(sh) if !sh.path.inverted => sh.path.control_bounds().filter(|c| c.2 > c.0 && c.3 > c.1),
+        _ => None,
+    };
+    path.map_or([f64::from(px.x0), f64::from(px.y0), f64::from(px.x1), f64::from(px.y1)], |c| [c.0, c.1, c.2, c.3])
+}
+
 /// Width of the link toggle between the W and H fields (the X/Y row leaves the same gap).
 const LINK_W: f32 = 20.0;
 
@@ -125,36 +153,36 @@ const LINK_W: f32 = 20.0;
 pub fn properties(app: &mut PhotocraftApp, ui: &mut egui::Ui, layer: &Layer) {
     let mut run: Vec<(String, Value)> = Vec::new();
     if let Some(s) = layer.surface() {
-        let b = app.layer_frame_bounds(layer, s);
+        let bb = frame(layer, app.layer_frame_bounds(layer, s));
         let u = LenUnit::of(app);
         let (dw, dh) = app.session.active().map_or((1.0, 1.0), |s| (f64::from(s.doc.size.width), f64::from(s.doc.size.height)));
+        let (tw, th) = (edit_tolerance(layer, u, dw), edit_tolerance(layer, u, dh));
         if section(ui, "transform", tl!("Transform")) {
-            let link_key = egui::Id::new("layer-props-link");
+            let link_key = egui::Id::unique("layer-props-link");
             let linked = ui.data(|d| d.get_temp::<bool>(link_key)).unwrap_or(true);
-            let bb = [b.x0, b.y0, b.x1, b.y1];
             // Two label+field columns with the link toggle between them, filling the panel.
             let w = ((ui.available_width() - 2.0 * (LABEL_W + LABEL_GAP) - LINK_W - 2.0 * LABEL_GAP) / 2.0).max(36.0);
             ui.horizontal(|ui| {
                 ui.spacing_mut().item_spacing.x = LABEL_GAP;
-                if let Some(v) = field(ui, "w", ("W", "X"), b.width() as f32, w, u, dw) {
-                    run.extend(transform_params(layer.id.0, bb, Some(v), None, linked).map(|p| ("edit.transform".to_string(), p)));
+                if let Some(v) = field(ui, "w", ("W", "X"), "Width", (bb[2] - bb[0]) as f32, w, (u, dw), tw) {
+                    run.extend(transform_params(layer.id.0, bb, Some(v), None, linked, tw).map(|p| ("edit.transform".to_string(), p)));
                 }
                 if crate::icons::button(ui, if linked { "link" } else { "unlink" }, LINK_W, linked, tl!("Link width and height")).clicked() {
                     ui.data_mut(|d| d.insert_temp(link_key, !linked));
                 }
-                if let Some(v) = field(ui, "h", ("H", "Y"), b.height() as f32, w, u, dh) {
-                    run.extend(transform_params(layer.id.0, bb, None, Some(v), linked).map(|p| ("edit.transform".to_string(), p)));
+                if let Some(v) = field(ui, "h", ("H", "Y"), "Height", (bb[3] - bb[1]) as f32, w, (u, dh), th) {
+                    run.extend(transform_params(layer.id.0, bb, None, Some(v), linked, th).map(|p| ("edit.transform".to_string(), p)));
                 }
             });
             ui.add_space(ROW_GAP);
             ui.horizontal(|ui| {
                 ui.spacing_mut().item_spacing.x = LABEL_GAP;
-                if let Some(v) = field(ui, "x", ("X", "W"), b.x0 as f32, w, u, dw) {
-                    run.push(("layer.translate".into(), json!({"layer": layer.id.0, "dx": (v - b.x0 as f32).round() as i32, "dy": 0})));
+                if let Some(v) = field(ui, "x", ("X", "W"), "X", bb[0] as f32, w, (u, dw), 0.5) {
+                    run.push(("layer.translate".into(), json!({"layer": layer.id.0, "dx": (v - bb[0] as f32).round() as i32, "dy": 0})));
                 }
                 ui.add_space(LINK_W + LABEL_GAP);
-                if let Some(v) = field(ui, "y", ("Y", "H"), b.y0 as f32, w, u, dh) {
-                    run.push(("layer.translate".into(), json!({"layer": layer.id.0, "dx": 0, "dy": (v - b.y0 as f32).round() as i32})));
+                if let Some(v) = field(ui, "y", ("Y", "H"), "Y", bb[1] as f32, w, (u, dh), 0.5) {
+                    run.push(("layer.translate".into(), json!({"layer": layer.id.0, "dx": 0, "dy": (v - bb[1] as f32).round() as i32})));
                 }
             });
             ui.add_space(ROW_GAP);
@@ -215,7 +243,7 @@ fn align_and_distribute(app: &PhotocraftApp, ui: &mut egui::Ui, run: &mut Vec<(S
             }
             align_glyph(ui, r, kind, if on { t.icon } else { t.text_faint });
             let tip = crate::i18n::fmt(tl!("Align {what}"), &[("what", tl!(&label))]);
-            resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, on, &tip));
+            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, on, &tip));
             if resp.on_hover_text(tip).clicked() {
                 run.push((id, json!({})));
             }
@@ -333,13 +361,13 @@ mod tests {
 
     #[test]
     fn width_edit_scales_from_the_top_left() {
-        let p = transform_params(7, [10, 20, 110, 70], Some(200.0), None, true).unwrap();
+        let p = transform_params(7, [10.0, 20.0, 110.0, 70.0], Some(200.0), None, true, 0.5).unwrap();
         assert_eq!(p["layer"], 7);
         assert_eq!(p["quad"], json!([[10.0, 20.0], [210.0, 20.0], [210.0, 120.0], [10.0, 120.0]]));
-        let p = transform_params(7, [10, 20, 110, 70], None, Some(25.0), false).unwrap();
+        let p = transform_params(7, [10.0, 20.0, 110.0, 70.0], None, Some(25.0), false, 0.5).unwrap();
         assert_eq!(p["quad"][2], json!([110.0, 45.0]));
-        assert!(transform_params(7, [10, 20, 110, 70], Some(100.0), None, true).is_none());
-        assert!(transform_params(7, [0, 0, 0, 0], Some(5.0), None, true).is_none());
+        assert!(transform_params(7, [10.0, 20.0, 110.0, 70.0], Some(100.0), None, true, 0.5).is_none());
+        assert!(transform_params(7, [0.0, 0.0, 0.0, 0.0], Some(5.0), None, true, 0.5).is_none());
     }
 
     #[test]
@@ -351,9 +379,57 @@ mod tests {
         s.execute("select.deselect", json!({})).unwrap();
         let st = s.active().unwrap();
         let id = st.active_layer.unwrap();
-        let p = transform_params(id.0, [10, 20, 110, 70], Some(50.0), None, true).unwrap();
+        let p = transform_params(id.0, [10.0, 20.0, 110.0, 70.0], Some(50.0), None, true, 0.5).unwrap();
         s.execute("edit.transform", p).unwrap();
         let b = s.active().unwrap().doc.layer(id).unwrap().surface().unwrap().content_bounds();
         assert_eq!((b.x0, b.y0, b.width(), b.height()), (10, 20, 50, 25));
     }
+
+    /// A stroked shape's Transform fields show its path, not the stroke's pixels, and a W edit
+    /// scales the path to that width, as in Photoshop.
+    #[test]
+    fn shape_fields_show_and_scale_the_path_without_its_stroke() {
+        let mut s = photocraft_engine::Session::new();
+        s.execute("file.new", json!({"width": 800, "height": 600})).unwrap();
+        s.execute("shape.create", json!({"kind": "rect", "rect": [200, 150, 400, 300], "fill": "#3366cc", "stroke": {"width": 15, "color": "#000000"}}))
+            .unwrap();
+        let st = s.active().unwrap();
+        let id = st.active_layer.unwrap();
+        let layer = st.doc.layer(id).unwrap();
+        let px = photocraft_compose::bounds::content_bounds(layer.surface().unwrap());
+        assert!(px.width() > 400, "the stroke's pixels reach past the path: {px:?}");
+        let bb = frame(layer, px);
+        assert_eq!(bb, [200.0, 150.0, 600.0, 450.0]);
+        s.execute("edit.transform", transform_params(id.0, bb, Some(200.0), None, true, 0.5).unwrap()).unwrap();
+        let LayerContent::Shape(sh) = &s.active().unwrap().doc.layer(id).unwrap().content else { panic!("still a shape") };
+        let c = sh.path.control_bounds().unwrap();
+        assert_eq!((c.0, c.1, c.2 - c.0, c.3 - c.1), (200.0, 150.0, 200.0, 150.0), "the path is exactly 200 × 150");
+    }
+
+    /// #9181 review: a shape's fractional path takes a W edit smaller than half a pixel (400.25
+    /// px typed as 400), while a pixel layer still ignores sub-pixel noise.
+    #[test]
+    fn a_shape_path_takes_a_width_edit_under_half_a_pixel() {
+        let mut s = photocraft_engine::Session::new();
+        s.execute("file.new", json!({"width": 800, "height": 600})).unwrap();
+        s.execute("shape.create", json!({"kind": "rect", "rect": [200, 150, 400.25, 100], "fill": "#3366cc"})).unwrap();
+        let st = s.active().unwrap();
+        let id = st.active_layer.unwrap();
+        let layer = st.doc.layer(id).unwrap();
+        let u = LenUnit { unit: photocraft_engine::prefs::Unit::Pixels, dpi: 72.0, ppi: 72.0 };
+        let bb = frame(layer, photocraft_compose::bounds::content_bounds(layer.surface().unwrap()));
+        assert_eq!(bb[2] - bb[0], 400.25);
+        let tol = edit_tolerance(layer, u, 800.0);
+        assert!(tol < 0.25, "{tol}");
+        let p = transform_params(id.0, bb, Some(400.0), None, false, tol).expect("a quarter-pixel edit applies");
+        s.execute("edit.transform", p).unwrap();
+        let LayerContent::Shape(sh) = &s.active().unwrap().doc.layer(id).unwrap().content else { panic!("still a shape") };
+        let c = sh.path.control_bounds().unwrap();
+        assert!((c.2 - c.0 - 400.0).abs() < 1e-6, "the path is exactly 400 wide: {c:?}");
+        // The field's own rounding (400.25 shown as 400.3) is not an edit.
+        assert!(transform_params(id.0, bb, Some(400.3), None, false, tol).is_none());
+        s.execute("layer.new.layer", json!({})).unwrap();
+        let st = s.active().unwrap();
+        assert_eq!(edit_tolerance(st.doc.layer(st.active_layer.unwrap()).unwrap(), u, 800.0), 0.5, "a pixel layer keeps half a pixel");
+    }
 }
diff --git a/crates/ui-egui/src/layer_reveal.rs b/crates/ui-egui/src/layer_reveal.rs
index bf80bba64d..14ee2a36b3 100644
--- a/crates/ui-egui/src/layer_reveal.rs
+++ b/crates/ui-egui/src/layer_reveal.rs
@@ -17,7 +17,7 @@ use crate::PhotocraftApp;
 struct Seen(usize, Option<LayerId>);
 
 fn seen_id() -> egui::Id {
-    egui::Id::new("layers-reveal-seen")
+    egui::Id::unique("layers-reveal-seen")
 }
 
 /// Called once per Layers panel frame, before its rows are listed. When the active layer
diff --git a/crates/ui-egui/src/layer_reveal_tests.rs b/crates/ui-egui/src/layer_reveal_tests.rs
index 181e42dc17..5b33aa75ca 100644
--- a/crates/ui-egui/src/layer_reveal_tests.rs
+++ b/crates/ui-egui/src/layer_reveal_tests.rs
@@ -6,7 +6,6 @@ use photocraft_doc::LayerId;
 use serde_json::json;
 
 use crate::PhotocraftApp;
-use crate::dock::{Group, last_rects};
 use crate::theme::ThemeKind;
 
 /// 30 layers above a closed group holding `inner` (near the bottom of the panel).
@@ -35,7 +34,7 @@ fn harness(app: PhotocraftApp, theme: ThemeKind) -> Harness<'static, PhotocraftA
             if !ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
                 return;
             }
-            crate::panels::right_dock(app, ui);
+            crate::panels::dock_area(app, ui);
             egui::CentralPanel::default().show(ui, |_| {});
         },
         app,
@@ -46,15 +45,19 @@ fn harness(app: PhotocraftApp, theme: ThemeKind) -> Harness<'static, PhotocraftA
     h
 }
 
+fn layers_group(h: &Harness<'static, PhotocraftApp>) -> Option<Rect> {
+    crate::panel_docking::probe::group_rect(h.state(), &h.ctx, "layers")
+}
+
 /// The Layers panel row of `name`, if drawn.
 fn row(h: &Harness<'static, PhotocraftApp>, name: &str) -> Option<Rect> {
-    let layers = last_rects(&h.ctx).into_iter().find(|(g, _)| *g == Group::Layers)?.1;
+    let layers = layers_group(h)?;
     h.query_all_by_label(name).map(|n| n.rect()).find(|r| layers.contains(r.center()) || (r.left() >= layers.left() && r.right() <= layers.right()))
 }
 
 /// Fully inside the rows viewport (below the strip and the blend/lock rows, above the footer).
 fn in_view(h: &Harness<'static, PhotocraftApp>, r: Rect) -> bool {
-    let layers = last_rects(&h.ctx).into_iter().find(|(g, _)| *g == Group::Layers).unwrap().1;
+    let layers = layers_group(h).unwrap();
     r.top() >= layers.top() + 26.0 && r.bottom() <= layers.bottom() - (crate::widgets::FOOTER_BAR + 1.0)
 }
 
diff --git a/crates/ui-egui/src/layer_row_ui.rs b/crates/ui-egui/src/layer_row_ui.rs
index 0658a797bc..0aa8341c4f 100644
--- a/crates/ui-egui/src/layer_row_ui.rs
+++ b/crates/ui-egui/src/layer_row_ui.rs
@@ -190,7 +190,7 @@ pub fn indicators(
                 icons::paint(ui, Rect::from_center_size(r.center(), vec2(ICON_W, ICON_W)), "triangle-alert", 12.0, t.warning);
                 let key = unsupported.unwrap_or_default();
                 let tip = crate::i18n::fmt(tl!("Not rendered: this adjustment ({key}) is kept as imported."), &[("key", key)]);
-                ui.interact(r, ui.id().with(("row-unsupported", l.id.0)), Sense::hover()).on_hover_text(tip);
+                ui.interact(r, ui.scope_id().with(("row-unsupported", l.id.0)), Sense::hover()).on_hover_text(tip);
             }
             Indicator::Lock => icons::paint(ui, Rect::from_center_size(r.center(), vec2(ICON_W, ICON_W)), "lock", 12.0, t.text_faint),
             Indicator::Link => icons::paint(ui, Rect::from_center_size(r.center(), vec2(ICON_W, ICON_W)), "link-2", 12.0, t.text_faint),
@@ -207,10 +207,10 @@ pub fn indicators(
             Indicator::SmartFilters => {
                 let enabled = matches!(&l.content, photocraft_doc::LayerContent::Smart(sm) if sm.filters_enabled);
                 crate::smart_ui::paint_badge(painter, r.center(), if enabled { t.icon } else { t.text_faint });
-                ui.interact(r, ui.id().with(("smart-filters-badge", l.id.0)), Sense::hover()).on_hover_text(tl!("Smart Filters"));
+                ui.interact(r, ui.scope_id().with(("smart-filters-badge", l.id.0)), Sense::hover()).on_hover_text(tl!("Smart Filters"));
             }
             Indicator::FxTriangle => {
-                let resp = ui.interact(r, ui.id().with(("fx-disclosure", l.id.0)), Sense::click());
+                let resp = ui.interact(r, ui.scope_id().with(("fx-disclosure", l.id.0)), Sense::click());
                 paint_triangle(painter, r.center(), fx_open, if resp.hovered() { t.text } else { t.icon });
                 if resp.clicked() {
                     clicked = true;
@@ -228,7 +228,7 @@ pub fn indicators(
                     tl!("Show the layer's effects  ({key}-click: all layers)")
                 };
                 let resp = resp.on_hover_text(crate::i18n::fmt(tip, &[("key", &crate::shortcuts::pretty("Alt"))]));
-                resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, format!("{verb} effects {name}")));
+                resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, format!("{verb} effects {name}")));
             }
         }
     }
@@ -328,7 +328,7 @@ pub fn panel_menu(app: &mut crate::PhotocraftApp, ui: &mut egui::Ui) {
 }
 
 fn rects_id() -> egui::Id {
-    egui::Id::new("layer-row-rects")
+    egui::Id::unique("layer-row-rects")
 }
 
 /// Start a frame's record (the Layers panel calls it before drawing its rows).
@@ -370,7 +370,7 @@ impl Rename {
 }
 
 fn rename_id() -> egui::Id {
-    egui::Id::new("layer-rename")
+    egui::Id::unique("layer-rename")
 }
 
 /// The rename in progress, if any.
@@ -419,7 +419,7 @@ pub fn end_rename(ctx: &egui::Context, commit: bool) -> Option<(String, Value)>
 
 /// Where Tab or ⇧Tab sends a rename: the layer it left and whether the next one is above.
 fn next_rename_id() -> egui::Id {
-    egui::Id::new("layer-rename-next")
+    egui::Id::unique("layer-rename-next")
 }
 
 /// The rename that Tab (`up` false) or ⇧Tab (`up` true) just left on `layer`, for the Layers panel
@@ -434,8 +434,8 @@ pub fn take_next_rename(ctx: &egui::Context) -> Option<(u64, bool)> {
 pub fn rename_field(ui: &mut egui::Ui, layer: u64, rect: Rect) -> Option<(String, Value)> {
     let ctx = ui.ctx().clone();
     let mut r = rename(&ctx).filter(|r| r.layer == layer)?;
-    let id = egui::Id::new(("layer-rename-field", layer));
-    let te = ui.put(rect, egui::TextEdit::singleline(&mut r.text).id(id).font(FontId::proportional(12.5)));
+    let id = egui::Id::unique(("layer-rename-field", layer));
+    let te = ui.put(rect, egui::TextEdit::singleline(&mut r.text).id(id).font(FontId::proportional(12.5))).accessible_name(tl!("Name"));
     r.pass = ctx.cumulative_pass_nr();
     if !r.focused {
         te.request_focus();
diff --git a/crates/ui-egui/src/layer_row_ui/rename_tests.rs b/crates/ui-egui/src/layer_row_ui/rename_tests.rs
index 4a7ea135ff..2d65099365 100644
--- a/crates/ui-egui/src/layer_row_ui/rename_tests.rs
+++ b/crates/ui-egui/src/layer_row_ui/rename_tests.rs
@@ -84,7 +84,7 @@ fn type_text(h: &mut Harness<'_, PhotocraftApp>, text: &str) {
 
 /// Is `layer`'s rename field on screen (drawn last frame)?
 fn field_shown(h: &Harness<'_, PhotocraftApp>, layer: u64) -> bool {
-    h.ctx.read_response(egui::Id::new(("layer-rename-field", layer))).is_some()
+    h.ctx.read_response(egui::Id::unique(("layer-rename-field", layer))).is_some()
 }
 
 /// A point on the canvas, away from every panel.
diff --git a/crates/ui-egui/src/layer_row_ui/tests.rs b/crates/ui-egui/src/layer_row_ui/tests.rs
index 6a9f26454b..70496fb0dd 100644
--- a/crates/ui-egui/src/layer_row_ui/tests.rs
+++ b/crates/ui-egui/src/layer_row_ui/tests.rs
@@ -229,9 +229,10 @@ fn groups_open(s: &photocraft_engine::Session) -> Vec<bool> {
 fn collapse_all_groups_from_the_panel_menu_and_it_is_saved() {
     let mut h = harness(busy(), 1.0, "promedium", 290.0);
     assert!(groups_open(&h.state().session).iter().all(|o| *o));
-    let menu = crate::dock::last_rects(&h.ctx).into_iter().find(|(g, _)| *g == crate::dock::Group::Layers).expect("layers group").1;
-    // The hamburger sits at the right end of the group's tab strip.
-    click(&mut h, pos2(menu.right() - 14.0, menu.top() + 14.0));
+    let group = crate::panel_docking::probe::group_rect(h.state(), &h.ctx, "layers").expect("layers group");
+    // The group's menu button sits on its tab strip.
+    let menu = h.query_all_by_label("Panel menu").map(|n| n.rect()).find(|r| group.contains(r.center())).expect("Layers panel menu");
+    click(&mut h, menu.center());
     let item = h.get_by_label("Collapse All Groups").rect().center();
     click(&mut h, item);
     let open = groups_open(&h.state().session);
@@ -463,7 +464,7 @@ fn the_footer_is_a_bar_along_the_panel_bottom_with_its_buttons_centred() {
         s.execute("file.new", json!({"width": 64, "height": 48})).unwrap();
         s.execute("layer.new.layer", json!({})).unwrap();
         let h = harness(s, 1.0, theme, 290.0);
-        let group = crate::dock::last_rects(&h.ctx).into_iter().find(|(g, _)| *g == crate::dock::Group::Layers).unwrap().1;
+        let group = crate::panel_docking::probe::group_rect(h.state(), &h.ctx, "layers").unwrap();
         let delete = h.get_by_label("Delete layer").rect();
         let bar_middle = group.bottom() - crate::widgets::FOOTER_BAR / 2.0;
         assert!((delete.center().y - bar_middle).abs() <= 1.5, "{theme}: button at {delete:?}, bar middle {bar_middle}, group {group:?}");
diff --git a/crates/ui-egui/src/layer_style.rs b/crates/ui-egui/src/layer_style.rs
index 084a48ffa4..b8fb211ccf 100644
--- a/crates/ui-egui/src/layer_style.rs
+++ b/crates/ui-egui/src/layer_style.rs
@@ -21,6 +21,8 @@ use serde_json::{Map, Value, json};
 use crate::theme::Tokens;
 use crate::{PhotocraftApp, widgets};
 
+#[cfg(test)]
+mod bevel_modes_tests;
 pub(crate) mod color_picker;
 mod contour;
 #[cfg(test)]
@@ -643,6 +645,54 @@ fn validate_params(f: &Map<String, Value>) -> Result<(), String> {
     Ok(())
 }
 
+fn effect_entry(e: &Value, kind: &str, mut params: Value, initial_light_angle: Option<f64>) -> Value {
+    match e.get("fx").filter(|fx| fx.is_object()) {
+        Some(fx) => {
+            if kind == "bevelEmboss"
+                && let Ok(original) = serde_json::from_value::<Effect>(fx.clone())
+                && let Some(edits) = params.as_object_mut()
+            {
+                let shown = values_of(&original, initial_light_angle.unwrap_or(120.0) as f32);
+                // Unedited display values must not quantize imported shading in the snapshot.
+                for key in ["highlightBlend", "highlightColor", "highlightOpacity", "shadowBlend", "shadowColor", "shadowOpacity"] {
+                    if edits.get(key) == shown.get(key) {
+                        edits.remove(key);
+                    }
+                }
+            }
+            json!({"kind": kind, "fx": fx, "params": params})
+        }
+        None => {
+            // A new instance: the page shows the factory defaults merged with
+            // the edits, and the engine builds from the full set.
+            let mut p = defaults(kind);
+            if let (Some(o), Some(pv)) = (p.as_object_mut(), params.as_object()) {
+                for (k, v) in pv {
+                    o.insert(k.clone(), v.clone());
+                }
+            }
+            json!({"kind": kind, "params": p})
+        }
+    }
+}
+
+fn find_light_angle(f: &Map<String, Value>, initial_light_angle: Option<f64>) -> Option<f64> {
+    let mut light_angle: Option<f64> = None;
+    for e in effects_of(f) {
+        if e.get("on").and_then(Value::as_bool) != Some(true) {
+            continue;
+        }
+        let params = e.get("params").cloned().unwrap_or_else(|| json!({}));
+        if params.get("useGlobalLight").and_then(Value::as_bool) == Some(true)
+            && let Some(angle) = params.get("angle").and_then(Value::as_f64)
+            && initial_light_angle.is_none_or(|initial| angle != initial)
+        {
+            light_angle = Some(angle);
+        }
+    }
+    light_angle
+}
+
 /// Runs the dialog's commands through `run`: blending options, then the whole
 /// effect list in one `layer.layerStyle.replace` (instances keep their order;
 /// their snapshots carry what the dialog doesn't model).
@@ -662,55 +712,14 @@ fn apply(f: &Map<String, Value>, mut run: impl FnMut(&str, Value) -> Result<Valu
     for e in effects_of(f) {
         let (Some(kind), Some(_)) = (e.get("kind").and_then(Value::as_str), e.get("id").and_then(Value::as_str)) else { continue };
         let on = e.get("on").and_then(Value::as_bool).unwrap_or(true);
-        let params = e.get("params").cloned().unwrap_or_else(|| json!({}));
-        let mut params = params;
+        let mut params = e.get("params").cloned().unwrap_or_else(|| json!({}));
         params["enabled"] = json!(on);
-        let entry = match e.get("fx").filter(|fx| fx.is_object()) {
-            Some(fx) => {
-                if kind == "bevelEmboss"
-                    && let Ok(original) = serde_json::from_value::<Effect>(fx.clone())
-                    && let Some(edits) = params.as_object_mut()
-                {
-                    let shown = values_of(&original, initial_light_angle.unwrap_or(120.0) as f32);
-                    // Unedited display values must not quantize imported shading in the snapshot.
-                    for key in ["highlightBlend", "highlightColor", "highlightOpacity", "shadowBlend", "shadowColor", "shadowOpacity"] {
-                        if edits.get(key) == shown.get(key) {
-                            edits.remove(key);
-                        }
-                    }
-                }
-                json!({"kind": kind, "fx": fx, "params": params})
-            }
-            None => {
-                // A new instance: the page shows the factory defaults merged with
-                // the edits, and the engine builds from the full set.
-                let mut p = defaults(kind);
-                if let (Some(o), Some(pv)) = (p.as_object_mut(), params.as_object()) {
-                    for (k, v) in pv {
-                        o.insert(k.clone(), v.clone());
-                    }
-                }
-                json!({"kind": kind, "params": p})
-            }
-        };
-        entries.push(entry);
+        entries.push(effect_entry(e, kind, params, initial_light_angle));
     }
     run("layer.layerStyle.replace", json!({"layer": layer, "effects": entries}))?;
     // An effect lit by the global light follows the document's light angle, so the Angle slider
     // drives that shared angle rather than the per-effect angle the compositor ignores.
-    let mut light_angle: Option<f64> = None;
-    for e in effects_of(f) {
-        if e.get("on").and_then(Value::as_bool) != Some(true) {
-            continue;
-        }
-        let params = e.get("params").cloned().unwrap_or_else(|| json!({}));
-        if params.get("useGlobalLight").and_then(Value::as_bool) == Some(true)
-            && let Some(angle) = params.get("angle").and_then(Value::as_f64)
-            && initial_light_angle.is_none_or(|initial| angle != initial)
-        {
-            light_angle = Some(angle);
-        }
-    }
+    let light_angle = find_light_angle(f, initial_light_angle);
     if let Some(angle) = f.get("pendingGlobalLight").and_then(Value::as_f64).or(light_angle) {
         run("layer.layerStyle.globalLight", json!({"angle": angle}))?;
     }
@@ -889,7 +898,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                         ui.painter().rect_filled(rect, t.radius_sm, t.hover.gamma_multiply(0.5));
                     }
                     let cb = fx_checkbox_rect(rect);
-                    let cresp = ui.interact(cb, ui.id().with(("fxcb", kind, id)), Sense::click());
+                    let cresp = ui.interact(cb, ui.scope_id().with(("fxcb", kind, id)), Sense::click());
                     fx_checkbox(ui.painter(), cb, on, &t);
                     ui.painter().text(
                         rect.left_center() + vec2(28.0, 0.0),
@@ -902,7 +911,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                     if multi(kind) {
                         let btn = |ui: &egui::Ui, at: egui::Pos2, glyph: &str, tag: &str| {
                             let r = egui::Rect::from_center_size(at, vec2(18.0, 18.0));
-                            let hresp = ui.interact(r, ui.id().with(("fxbtn", tag, id)), Sense::click());
+                            let hresp = ui.interact(r, ui.scope_id().with(("fxbtn", tag, id)), Sense::click());
                             let col = if hresp.hovered() { t.accent } else { t.text_faint };
                             ui.painter().text(r.center(), egui::Align2::CENTER_CENTER, glyph, egui::FontId::proportional(13.0), col);
                             hresp.clicked()
@@ -1048,7 +1057,8 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                             let mut cur = disp.get(key).and_then(Value::as_str).unwrap_or("Normal").to_string();
                             let opts: Vec<(String, &str)> =
                                 photocraft_color::BlendMode::LAYER_MODES.iter().map(|m| (m.label().to_string(), m.label())).collect();
-                            if widgets::dropdown(ui, &format!("fx-blend-{sel_kind}"), &mut cur, &opts, 150.0) {
+                            // One id per mode: Bevel & Emboss has two (Highlight, Shadow), which must not share a list (#9368).
+                            if widgets::dropdown(ui, &format!("fx-blend-{sel_kind}-{key}"), tl!(&label), &mut cur, &opts, 150.0) {
                                 let value = json!(cur);
                                 disp[key] = value.clone();
                                 set_param(f, &selected, key, value);
@@ -1060,7 +1070,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                             ui.label(RichText::new(tl!(&label)).color(t.text_dim));
                             let mut cur = disp.get(key).and_then(Value::as_str).unwrap_or(options[0].0).to_string();
                             let opts: Vec<(String, &str)> = options.iter().map(|(v, l)| (v.to_string(), *l)).collect();
-                            if widgets::dropdown(ui, &format!("fx-{sel_kind}-{key}"), &mut cur, &opts, 150.0) {
+                            if widgets::dropdown(ui, &format!("fx-{sel_kind}-{key}"), tl!(&label), &mut cur, &opts, 150.0) {
                                 let value = json!(cur);
                                 disp[key] = value.clone();
                                 set_param(f, &selected, key, value);
@@ -1083,7 +1093,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                                 current = "custom".into();
                                 options.insert(0, ("custom".into(), "Custom"));
                             }
-                            if widgets::dropdown(ui, "fx-gradientOverlay-method", &mut current, &options, 150.0) {
+                            if widgets::dropdown(ui, "fx-gradientOverlay-method", tl!("Method"), &mut current, &options, 150.0) {
                                 // The older dialog deliberately omits From/To for rich imported
                                 // curves. Once a method is chosen, show the real source ends.
                                 let snapshot = entry(f, &selected).and_then(|e| e.get("fx")).cloned();
@@ -1121,7 +1131,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
                                 .or_else(|| list.first().map(|l| l.0.clone()))
                                 .unwrap_or_default();
                             let opts: Vec<(String, &str)> = list.iter().map(|(id, n)| (id.clone(), n.as_str())).collect();
-                            if widgets::dropdown(ui, &format!("fx-{sel_kind}-{key}"), &mut cur, &opts, 180.0)
+                            if widgets::dropdown(ui, &format!("fx-{sel_kind}-{key}"), tl!(&label), &mut cur, &opts, 180.0)
                                 || disp.get(key).and_then(Value::as_str).is_none_or(str::is_empty)
                             {
                                 let value = json!(cur);
@@ -1249,7 +1259,7 @@ fn blending_page(ui: &mut egui::Ui, p: &mut Value, names: &[String]) {
         // Photoshop's modes, plus the layer's own Paint.NET mode when it has one (an imported .pdn).
         let own = photocraft_color::BlendMode::PAINT_NET_MODES.into_iter().find(|m| m.label() == cur);
         let opts: Vec<(String, &str)> = photocraft_color::BlendMode::LAYER_MODES.into_iter().chain(own).map(|m| (m.label().to_string(), m.label())).collect();
-        if widgets::dropdown(ui, "fx-blend-blendingOptions", &mut cur, &opts, 150.0) {
+        if widgets::dropdown(ui, "fx-blend-blendingOptions", tl!("Blend Mode"), &mut cur, &opts, 150.0) {
             p["blend"] = json!(cur);
         }
     });
@@ -1283,7 +1293,7 @@ fn blending_page(ui: &mut egui::Ui, p: &mut Value, names: &[String]) {
         ui.label(RichText::new(tl!("Knockout")).color(t.text_dim));
         let mut cur = p.get("knockout").and_then(Value::as_str).unwrap_or("none").to_string();
         let opts: Vec<(String, &str)> = KNOCKOUT.iter().map(|(v, l)| (v.to_string(), *l)).collect();
-        if widgets::dropdown(ui, "fx-blendingOptions-knockout", &mut cur, &opts, 150.0) {
+        if widgets::dropdown(ui, "fx-blendingOptions-knockout", tl!("Knockout"), &mut cur, &opts, 150.0) {
             p["knockout"] = json!(cur);
         }
     });
@@ -1316,7 +1326,7 @@ fn blending_page(ui: &mut egui::Ui, p: &mut Value, names: &[String]) {
         let labels: Vec<String> = (0..entries).map(label).collect();
         let opts: Vec<(usize, &str)> = labels.iter().enumerate().map(|(i, l)| (i, l.as_str())).collect();
         let mut cur = sel;
-        if widgets::dropdown(ui, "fx-blendingOptions-blendIf", &mut cur, &opts, 110.0) {
+        if widgets::dropdown(ui, "fx-blendingOptions-blendIf", tl!("Blend If:"), &mut cur, &opts, 110.0) {
             p["blendIfChannel"] = json!(cur);
         }
     });
@@ -1329,7 +1339,7 @@ fn blending_page(ui: &mut egui::Ui, p: &mut Value, names: &[String]) {
                 ui.label(RichText::new(format!("{}    {}", side(q[0], q[1]), side(q[2], q[3]))).color(t.text));
             });
         });
-        if blend_if_bar(ui, ui.id().with(("blendIf", key)), &mut q)
+        if blend_if_bar(ui, ui.scope_id().with(("blendIf", key)), &mut q)
             && let Some(e) = p.get_mut("blendIf").and_then(|a| a.get_mut(sel))
         {
             e[key] = json!(q);
@@ -1555,6 +1565,39 @@ mod tests {
         assert_eq!(rows, KINDS.len(), "one empty checkbox per effect row");
     }
 
+    // Regression test for #2209: Make Default and Reset to Default sat in a non-wrapping row, so
+    // translated labels wider than the page column (Russian) pushed one button over the other
+    // and out of the column instead of wrapping to a second row.
+    #[test]
+    fn default_buttons_wrap_inside_the_page_column_with_long_labels() {
+        use egui_kittest::kittest::Queryable;
+        let ru = crate::i18n::Lang::from_code("ru").unwrap();
+        crate::i18n::with_language(ru, || {
+            let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+            app.run("file.new", json!({"width": 32, "height": 32})).unwrap();
+            let l = Layer::raster("x", photocraft_doc::PixelFormat::RGBA8);
+            let fields = initial_fields(&l, Some("dropShadow"), 120.0);
+            let mut h = egui_kittest::Harness::builder().with_size(vec2(900.0, 700.0)).build_ui_state(
+                move |ui, app: &mut PhotocraftApp| {
+                    if !ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
+                        return;
+                    }
+                    let mut f = fields.clone();
+                    body(app, ui, &mut f);
+                },
+                app,
+            );
+            PhotocraftApp::setup_context(&h.ctx, crate::theme::ThemeKind::ProMedium);
+            h.run_steps(3);
+            let reset = h.get_by_role_and_label(egui::accesskit::Role::Button, crate::i18n::tr(ru, "Reset to Default")).rect();
+            let make = h.get_by_role_and_label(egui::accesskit::Role::Button, crate::i18n::tr(ru, "Make Default")).rect();
+            // Together they are wider than the page column: the second wraps to a row below
+            // instead of sharing the row and running left over the effect list.
+            assert!(make.top() >= reset.bottom(), "the buttons share one row: {make:?} {reset:?}");
+            assert_eq!(make.right(), reset.right(), "the wrapped row stays right-aligned");
+        });
+    }
+
     /// Double-clicking an effect row of a layer that isn't active selects that layer first, so
     /// the dialog holds its effects (and OK edits it), not the active layer's.
     #[test]
@@ -2236,7 +2279,7 @@ mod tests {
             120.0_f32,
         );
         h.run();
-        let dial = h.query_all_by_label("Angle").last().unwrap();
+        let dial = h.get_by_role_and_label(egui::accesskit::Role::Slider, "Angle");
         let rect = dial.rect();
         for (delta, expected) in [(vec2(15.0, 0.0), 0.0), (vec2(0.0, -15.0), 90.0), (vec2(0.0, 15.0), -90.0)] {
             let pos = rect.center() + delta;
diff --git a/crates/ui-egui/src/layer_style/bevel_modes_tests.rs b/crates/ui-egui/src/layer_style/bevel_modes_tests.rs
new file mode 100644
index 0000000000..56bfd35727
--- /dev/null
+++ b/crates/ui-egui/src/layer_style/bevel_modes_tests.rs
@@ -0,0 +1,46 @@
+//! #9368: Bevel & Emboss's Highlight Mode and Shadow Mode are two dropdowns, each changing its own
+//! mode, as in Photoshop. They shared one widget id, so the Shadow Mode list opened both lists and
+//! a pick changed the Highlight Mode.
+use egui::vec2;
+use egui_kittest::kittest::Queryable;
+
+use super::*;
+
+#[test]
+fn highlight_and_shadow_modes_are_independent_dropdowns() {
+    let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+    app.run("file.new", json!({"width": 32, "height": 32})).unwrap();
+    app.run("layer.new.layer", json!({})).unwrap();
+    app.run("layer.layerStyle.bevelEmboss", json!({})).unwrap();
+    let fields = {
+        let state = app.session.active().unwrap();
+        initial_fields(state.doc.layer(state.active_layer.unwrap()).unwrap(), Some("bevelEmboss"), 120.0)
+    };
+    let mut harness = egui_kittest::Harness::builder().with_size(vec2(1000.0, 1200.0)).build_ui_state(
+        |ui, state: &mut (PhotocraftApp, Map<String, Value>)| {
+            if ui.ctx().fonts(|fonts| fonts.families().contains(&egui::FontFamily::Name("semibold".into()))) {
+                body(&mut state.0, ui, &mut state.1);
+            }
+        },
+        (app, fields),
+    );
+    PhotocraftApp::setup_context(&harness.ctx, crate::theme::ThemeKind::ALL[0]);
+    harness.run_steps(3);
+    let params = |h: &egui_kittest::Harness<'_, (PhotocraftApp, Map<String, Value>)>| h.state().1["effects"][0]["params"].clone();
+    assert_eq!((params(&harness)["highlightBlend"].as_str(), params(&harness)["shadowBlend"].as_str()), (Some("Screen"), Some("Multiply")));
+    // Shadow Mode's list: one list opens, and its pick is the Shadow Mode's.
+    harness.get_by_value("Multiply").click();
+    harness.run_steps(3);
+    assert_eq!(harness.query_all_by_label("Dissolve").count(), 1, "only the Shadow Mode list is open");
+    harness.get_by_label("Dissolve").click();
+    harness.run_steps(3);
+    assert_eq!(params(&harness)["shadowBlend"], "Dissolve");
+    assert_eq!(params(&harness)["highlightBlend"], "Screen", "the Highlight Mode is unchanged");
+    // And the Highlight Mode's list changes the Highlight Mode.
+    harness.get_by_value("Screen").click();
+    harness.run_steps(3);
+    harness.get_by_label("Overlay").click();
+    harness.run_steps(3);
+    assert_eq!(params(&harness)["highlightBlend"], "Overlay");
+    assert_eq!(params(&harness)["shadowBlend"], "Dissolve");
+}
diff --git a/crates/ui-egui/src/layer_style/contour.rs b/crates/ui-egui/src/layer_style/contour.rs
index 295cf9f34c..0c1c18b605 100644
--- a/crates/ui-egui/src/layer_style/contour.rs
+++ b/crates/ui-egui/src/layer_style/contour.rs
@@ -330,7 +330,7 @@ pub(super) fn editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Str
     };
     let t = Tokens::get(ui.ctx());
     let ctx = ui.ctx().clone();
-    let mem = egui::Id::new(("contour-editor", effect.as_str(), key.as_str()));
+    let mem = egui::Id::unique(("contour-editor", effect.as_str(), key.as_str()));
     let mut st: PointCurveState = ctx.data(|d| d.get_temp(mem)).unwrap_or_default();
     let (mut pts, mut corners) = levels_of(&c);
     let mut close: Option<bool> = None;
@@ -350,7 +350,7 @@ pub(super) fn editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Str
                     ui.label(RichText::new(tl!("Preset:")).color(t.text_dim));
                     let mut cur = name_of(&c).to_string();
                     let opts: Vec<(String, &str)> = CONTOURS.iter().map(|(n, _)| (n.to_string(), *n)).collect();
-                    if widgets::dropdown(ui, "contour-editor-preset", &mut cur, &opts, 190.0) {
+                    if widgets::dropdown(ui, "contour-editor-preset", tl!("Preset"), &mut cur, &opts, 190.0) {
                         preset = Some(cur);
                     }
                 });
@@ -405,7 +405,7 @@ pub(super) fn editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Str
                 if let Some(name) = naming.as_mut() {
                     ui.horizontal(|ui| {
                         ui.label(RichText::new(tl!("Name:")).color(t.text_dim));
-                        let r = widgets::text_field(ui, mem.with("name-field"), name, "", 150.0, false);
+                        let r = widgets::text_field(ui, mem.with("name-field"), name, "", 150.0, false).accessible_name(tl!("Name:"));
                         r.request_focus();
                         if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
                             commit_name = true;
@@ -420,9 +420,11 @@ pub(super) fn editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Str
                 ui.horizontal(|ui| {
                     let (mut vi, mut vo) = sel.and_then(|i| pts.get(i)).map_or((0.0, 0.0), |q| ((q[0] / 2.55).round(), (q[1] / 2.55).round()));
                     ui.label(RichText::new(tl!("Input:")).color(t.text_dim));
-                    let ri = ui.add_enabled_ui(sel.is_some(), |ui| widgets::value_field(ui, &mut vi, 0.0..=100.0, "%", 52.0)).inner;
+                    let ri =
+                        ui.add_enabled_ui(sel.is_some(), |ui| widgets::value_field(ui, &mut vi, 0.0..=100.0, "%", 52.0).accessible_name(tl!("Input:"))).inner;
                     ui.label(RichText::new(tl!("Output:")).color(t.text_dim));
-                    let ro = ui.add_enabled_ui(sel.is_some(), |ui| widgets::value_field(ui, &mut vo, 0.0..=100.0, "%", 52.0)).inner;
+                    let ro =
+                        ui.add_enabled_ui(sel.is_some(), |ui| widgets::value_field(ui, &mut vo, 0.0..=100.0, "%", 52.0).accessible_name(tl!("Output:"))).inner;
                     if let Some(i) = sel
                         && (ri.changed() || ro.changed())
                     {
@@ -573,7 +575,7 @@ mod library_tests {
         let st = app.session.active().unwrap();
         let mut fields = crate::layer_style::initial_fields(st.doc.layer(st.active_layer.unwrap()).unwrap(), None, 120.0);
         open_editor(&mut fields, "fx1", "contour");
-        let naming = egui::Id::new(("contour-editor", "fx1", "contour")).with("naming");
+        let naming = egui::Id::unique(("contour-editor", "fx1", "contour")).with("naming");
         ctx.data_mut(|d| d.insert_temp(naming, "Unfinished".to_string()));
         ctx.run_ui(Default::default(), |ui| editor(&mut app, ui, &mut fields)).textures_delta.clear();
         let input = egui::RawInput {
diff --git a/crates/ui-egui/src/layer_transfer.rs b/crates/ui-egui/src/layer_transfer.rs
index 890768b28a..c9e45225f4 100644
--- a/crates/ui-egui/src/layer_transfer.rs
+++ b/crates/ui-egui/src/layer_transfer.rs
@@ -30,7 +30,7 @@ struct Transfer {
 }
 
 fn key() -> egui::Id {
-    egui::Id::new("pc-layer-transfer")
+    egui::Id::unique("pc-layer-transfer")
 }
 
 fn get(ctx: &egui::Context) -> Option<Transfer> {
@@ -99,7 +99,7 @@ pub fn over_tab(app: &mut PhotocraftApp, ctx: &egui::Context, index: usize) {
         app.session.set_active(index);
         app.jobs.focus = None;
         // The Layers panel now lists the other document: its rows don't take the drag.
-        ctx.data_mut(|d| d.remove::<u64>(egui::Id::new("layer-drag")));
+        ctx.data_mut(|d| d.remove::<u64>(egui::Id::unique("layer-drag")));
     }
     if ctx.input(|i| i.pointer.any_released()) {
         drop(app, ctx, index, None);
@@ -168,7 +168,7 @@ fn drop(app: &mut PhotocraftApp, ctx: &egui::Context, dest: usize, at: Option<[f
 /// The dragged layers' name next to the pointer (also the Layers panel's reorder drag).
 pub fn ghost(ctx: &egui::Context, p: egui::Pos2, label: &str) {
     let t = crate::theme::Tokens::get(ctx);
-    let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("layer-transfer-ghost")));
+    let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("layer-transfer-ghost")));
     let g = painter.layout_no_wrap(label.to_string(), egui::FontId::proportional(12.0), t.text);
     let r = egui::Rect::from_min_size(p + egui::vec2(12.0, -10.0), g.size() + egui::vec2(16.0, 8.0));
     painter.rect_filled(r, t.radius_sm, t.card.gamma_multiply(0.95));
diff --git a/crates/ui-egui/src/layer_tree_ui.rs b/crates/ui-egui/src/layer_tree_ui.rs
index d00dffb8da..858fe432fc 100644
--- a/crates/ui-egui/src/layer_tree_ui.rs
+++ b/crates/ui-egui/src/layer_tree_ui.rs
@@ -56,7 +56,7 @@ pub fn triangle_rect(row: Rect, x: f32) -> Rect {
 pub fn disclosure(ui: &mut egui::Ui, row: Rect, x: &mut f32, l: &Layer, actions: &mut Vec<(String, Value)>) -> bool {
     let LayerContent::Group(g) = &l.content else { return false };
     let hit = triangle_rect(row, *x);
-    let resp = ui.interact(hit, ui.id().with(("disclosure", l.id.0)), Sense::click());
+    let resp = ui.interact(hit, ui.scope_id().with(("disclosure", l.id.0)), Sense::click());
     let t = Tokens::get(ui.ctx());
     let c = pos2(*x + TRIANGLE_W / 2.0 - 1.0, row.center().y);
     let s = 3.5;
@@ -76,7 +76,7 @@ pub fn disclosure(ui: &mut egui::Ui, row: Rect, x: &mut f32, l: &Layer, actions:
     let (verb, name) = (if g.expanded { tl!("Collapse") } else { tl!("Expand") }, l.name.clone());
     let tip = if g.expanded { tl!("Collapse group  ({key}-click: all groups)") } else { tl!("Expand group  ({key}-click: all groups)") };
     let resp = resp.on_hover_text(crate::i18n::fmt(tip, &[("key", &crate::shortcuts::pretty("Alt"))]));
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, format!("{verb} group {name}")));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, format!("{verb} group {name}")));
     clicked
 }
 
diff --git a/crates/ui-egui/src/layers_panel_ui.rs b/crates/ui-egui/src/layers_panel_ui.rs
index 5027b228b0..d640e3850d 100644
--- a/crates/ui-egui/src/layers_panel_ui.rs
+++ b/crates/ui-egui/src/layers_panel_ui.rs
@@ -260,7 +260,7 @@ pub fn show_dialog(app: &mut PhotocraftApp, ctx: &Context) {
         LayersPanelDialog::NewGroup(_) => tl!("New Group"),
         LayersPanelDialog::LockLayers { .. } => tl!("Lock Layers"),
     };
-    egui::Modal::new(egui::Id::new("layers-panel-options-modal")).show(ctx, |ui| {
+    egui::Modal::new(egui::Id::unique("layers-panel-options-modal")).show(ctx, |ui| {
         ui.set_width(if matches!(dialog, LayersPanelDialog::PanelOptions(_)) { 480.0 } else { 380.0 });
         ui.horizontal(|ui| {
             ui.heading(title);
diff --git a/crates/ui-egui/src/layout_keys.rs b/crates/ui-egui/src/layout_keys.rs
index 28d2dc9c06..bd31428cca 100644
--- a/crates/ui-egui/src/layout_keys.rs
+++ b/crates/ui-egui/src/layout_keys.rs
@@ -68,7 +68,7 @@ fn is_digit(key: Key) -> bool {
 /// What was typed comes as the text event next to the key press: right after it natively, right
 /// before it on the web.
 pub fn apply(ctx: &egui::Context) {
-    let id = egui::Id::new("photocraft_layout_keys");
+    let id = egui::Id::unique("photocraft_layout_keys");
     let mut learnt: Learnt = ctx.data(|d| d.get_temp(id)).unwrap_or_default();
     let before = (learnt.brackets, learnt.table_layout);
     ctx.input_mut(|i| {
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 4db3dc2a34..adf7b4f959 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -46,6 +46,7 @@ pub mod caf_ui;
 pub(crate) mod cam_preview;
 mod cam_transform;
 mod camera_raw_detail_ui;
+mod camera_raw_gpu;
 mod camera_raw_preview_ui;
 mod camera_raw_scope_ui;
 pub mod camera_raw_ui;
@@ -114,6 +115,7 @@ pub mod gpu_status;
 pub mod gradient_ui;
 pub mod guide_layout_ui;
 pub mod guide_select;
+pub mod histogram_panel;
 pub mod history_menu_ui;
 pub mod hold_keys;
 pub mod i18n;
@@ -194,12 +196,14 @@ mod rgb_histogram;
 pub mod rotate_view;
 pub mod rulers;
 pub mod screen_picker;
+pub mod screenshot;
 pub mod scrollbars;
 mod scrub_wrap;
 pub mod select_mask_view;
 pub mod served_fonts;
 pub mod shape_dialog;
 pub(crate) mod shape_fill_ui;
+mod shape_gradient_ui;
 mod shape_options;
 mod shape_paint_ui;
 pub mod shape_stroke_ui;
@@ -211,6 +215,7 @@ pub mod slice_ui;
 pub mod smart_filter_dialog;
 pub mod smart_ui;
 pub mod snap_ui;
+pub mod snapshot_dialog;
 pub(crate) mod solid_fill_ui;
 pub mod spring_tools;
 pub mod stack_dialog;
@@ -682,10 +687,6 @@ pub struct Services {
     pub quit: Option<QuitFn>,
 }
 
-/// A document histogram being computed off the UI thread: (document, revision, receiver of
-/// (document, compute ms, histograms)).
-pub(crate) type HistJob = (DocId, u64, std::sync::mpsc::Receiver<(DocId, f64, std::sync::Arc<tone::Histograms>)>);
-
 /// The Info panel's cached sample: pixel x, y, document revision and Eyedropper Sample Size.
 type InfoSampleKey = (i32, i32, u64, u32);
 
@@ -777,15 +778,20 @@ pub struct PhotocraftApp {
     /// This press began with ⌥ (Alt) held on a painting tool, so it samples colours instead of
     /// painting until it is released (`canvas::alt_eyedropper`, #417).
     pub(crate) alt_sampling: bool,
+    /// This press began with ⌥ (Alt) held on the Mixer Brush, so it loaded paint from the canvas
+    /// and paints nothing until it is released, even with ⌥ let go (`canvas::tool_event`).
+    pub(crate) mixer_sampling: bool,
     /// Caps Lock toggled on, read from the OS each frame (`services.caps_lock`): painting tools
     /// show the precise crosshair whatever the cursor preference (#1758).
     pub caps_lock: bool,
     /// The first digit of a two-digit opacity typed on the number keys (`opacity_keys`, #352).
     pub(crate) opacity_keys: opacity_keys::Pending,
     control_rx: Option<Receiver<ControlRequest>>,
-    pending_screenshots: Vec<(u64, Option<String>, Sender<ControlResponse>)>,
-    /// Screenshots not yet requested from the viewport: (token, earliest time in ms, frames seen).
-    queued_screenshots: Vec<(u64, f64, u32)>,
+    /// `ui.screenshot` requests: bounded admission, a weak-slot callback per issuance, monotonic
+    /// deadlines and a capture-time geometry epoch (see `screenshot.rs`).
+    captures: screenshot::Captures,
+    /// The custom Type tool's IME owner/generation/receipt tracker (`type_tool::sync_ime`).
+    pub(crate) type_ime: type_tool::ImeState,
     /// Control replies waiting for queued synthetic input to be processed.
     input_waiters: Vec<Sender<ControlResponse>>,
     /// Live (uncommitted) adjustment edit shown on canvas while a slider is dragged.
@@ -862,6 +868,20 @@ pub struct PhotocraftApp {
     pub(crate) live_adjust_preview: Option<adjust_preview::LiveAdjust>,
     /// Synthetic input events queued by automation (`ui.click`, `ui.key`, …), injected next frame.
     pub(crate) synthetic: Vec<egui::Event>,
+    /// The one synthetic batch currently being delivered.
+    ///
+    /// eframe preserves input appended by `raw_input_hook` across hidden (`update_logic_only`)
+    /// ticks, so draining another step every hidden tick would deliver several host iterations
+    /// as one burst. At most one batch is ever in flight; the next step waits for a pass.
+    synthetic_batch: Option<Vec<egui::Event>>,
+    /// A pass consumed the batch but returned before handling input (fonts not ready): put the
+    /// same events back on the next hook so the step is not lost. Cleared as soon as they are
+    /// re-appended, so two hidden ticks cannot deliver the same step twice.
+    synthetic_reinject: bool,
+    /// Document/focus identity the batch was created for. A batch queued against one document is
+    /// cancelled, not replayed, after the active document (including a switch away and back) or
+    /// the focus changes; an edit in the same document does not cancel it.
+    synthetic_snapshot: Option<SyntheticTarget>,
     /// True only while a frame is processing synthetic automation input. It
     /// makes shortcut- and dialog-triggered commands pass the same policy as
     /// direct control calls.
@@ -871,10 +891,14 @@ pub struct PhotocraftApp {
     pub(crate) paused_playbacks: actions::PausedPlaybacks,
     /// Levels/Curves histogram cache: (document, adjustment layer, revision it is valid for).
     pub(crate) tone_hist: Option<(DocId, photocraft_doc::LayerId, u64, std::sync::Arc<tone::Histograms>)>,
-    /// Histogram panel cache: (document, revision, computed at ms, histograms).
-    pub(crate) doc_hist: Option<(DocId, u64, f64, std::sync::Arc<tone::Histograms>)>,
-    /// The document histogram being computed on a worker thread: (document, revision, receiver).
-    pub(crate) hist_job: Option<HistJob>,
+    /// Histogram panel: the document's histogram (`histogram_panel`).
+    pub(crate) doc_hist: Option<histogram_panel::PanelHist>,
+    /// Histogram panel: the histogram of the adjustment previewing on the canvas.
+    pub(crate) doc_hist_preview: Option<histogram_panel::PanelHist>,
+    /// The panel histogram being computed on a worker thread.
+    pub(crate) hist_job: Option<histogram_panel::HistJob>,
+    /// The (document, revision) an Uncached Refresh asked to count at cache level 1.
+    pub(crate) hist_uncached: Option<(DocId, u64)>,
     /// Free Transform preview (document without the moving pixels + their texture).
     pub(crate) transform_preview: Option<transform_tool::TransformPreview>,
     /// Move-tool ⇧/⌥ drag state (move_mods).
@@ -899,8 +923,9 @@ pub struct PhotocraftApp {
     /// A raw file just opened interactively, waiting for the open-time Camera Raw dialog (shown
     /// on the next frame, which has the egui context).
     pub(crate) pending_raw_open: Option<camera_raw_ui::RawOpen>,
-    /// The open-time re-develop (or its Camera Raw step) running in the background.
-    pub(crate) raw_redevelop: Option<camera_raw_ui::Redevelop>,
+    /// The open-time re-develops (or their Camera Raw steps) running in the background, one per
+    /// raw being opened.
+    pub(crate) raw_redevelop: Vec<camera_raw_ui::Redevelop>,
     /// Filter › Adaptive Wide Angle dialog (wide_angle_ui).
     pub(crate) wide_angle: Option<wide_angle_ui::WideAngleDialog>,
     /// ⌘Z history of each open parameter dialog (edit_history).
@@ -1018,6 +1043,26 @@ pub struct PhotocraftApp {
     live_tokens: theme::live::LiveTokens,
 }
 
+/// The state a synthetic input batch was queued for.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct SyntheticTarget {
+    document: Option<screenshot::DocumentId>,
+    focus: Option<egui::Id>,
+}
+
+impl SyntheticTarget {
+    /// The document must be the same one in the same activation (a switch away and back is a
+    /// change); its revision is attribution only, so an edit does not cancel a queued step.
+    fn matches(self, other: Self) -> bool {
+        self.focus == other.focus
+            && match (self.document, other.document) {
+                (Some(a), Some(b)) => a.same_activation(b),
+                (None, None) => true,
+                _ => false,
+            }
+    }
+}
+
 impl PhotocraftApp {
     pub fn new(mut session: Session, mut services: Services) -> Self {
         session.updates.check = services.check_updates.take();
@@ -1063,11 +1108,12 @@ impl PhotocraftApp {
             quick_pick: false,
             brush_resize_armed: false,
             alt_sampling: false,
+            mixer_sampling: false,
             caps_lock: false,
             opacity_keys: None,
             control_rx: None,
-            pending_screenshots: Vec::new(),
-            queued_screenshots: Vec::new(),
+            captures: screenshot::Captures::default(),
+            type_ime: type_tool::ImeState::default(),
             input_waiters: Vec::new(),
             live_adjust: None,
             frame: 0,
@@ -1104,6 +1150,9 @@ impl PhotocraftApp {
             adjust_preview: None,
             live_adjust_preview: None,
             synthetic: Vec::new(),
+            synthetic_batch: None,
+            synthetic_reinject: false,
+            synthetic_snapshot: None,
             automation_input: false,
             paused_playbacks: Default::default(),
             channel_thumbs: None,
@@ -1137,13 +1186,15 @@ impl PhotocraftApp {
             gradient: Default::default(),
             camera_raw: None,
             pending_raw_open: None,
-            raw_redevelop: None,
+            raw_redevelop: Vec::new(),
             wide_angle: None,
             dialog_edits: Default::default(),
             pending_after_prompt: None,
             tone_hist: None,
             doc_hist: None,
+            doc_hist_preview: None,
             hist_job: None,
+            hist_uncached: None,
             gpu: None,
             window_device: None,
             window_lost: false,
@@ -1178,6 +1229,7 @@ impl PhotocraftApp {
         // Saved preferences are in place before the first frame; recovery starts in upkeep.
         prefs_ui::load(&mut app);
         layers_panel_ui::restore_options(&mut app);
+        histogram_panel::restore_options(&mut app);
         // After the saved preferences, which say whether the set was already offered.
         kys_import::offer_import(&mut app);
         notices::wayland_file_drop_guidance(&mut app);
@@ -2195,10 +2247,13 @@ impl PhotocraftApp {
                 control::Outcome::AfterInput => self.input_waiters.push(reply),
                 control::Outcome::AfterJob(job) => self.jobs.waiters.push((job, reply)),
                 control::Outcome::Screenshot { token, path } => {
-                    // Wait out egui's fade animations (~83 ms) and a few rendered frames first.
-                    let settle = ctx.global_style().animation_time as f64 * 2000.0 + 60.0;
-                    self.queued_screenshots.push((token, gpu_canvas::now_ms() + settle, 0));
-                    self.pending_screenshots.push((token, path, reply));
+                    // Admission is budgeted here, after this pass's completed captures were
+                    // drained, so a just-finished request never causes a false rejection.
+                    let settle = screenshot::settle_ms(ctx.global_style().animation_time);
+                    let document = self.document_identity();
+                    if let Err((reply, e)) = self.captures.admit(token, path, reply, document, settle, screenshot::now()) {
+                        let _ = reply.send(serde_json::json!({"ok": false, "error": e}));
+                    }
                 }
             }
             // `ui.set` may have changed the edit target: the next request sees its colours.
@@ -2207,41 +2262,67 @@ impl PhotocraftApp {
         self.control_rx = Some(rx);
     }
 
-    fn issue_screenshots(&mut self, ctx: &egui::Context) {
-        let now = gpu_canvas::now_ms();
-        self.queued_screenshots.retain_mut(|(token, at, frames)| {
-            *frames += 1;
-            if now >= *at && *frames >= 3 {
-                ctx.send_viewport_cmd(egui::ViewportCommand::Screenshot(egui::UserData::new(*token)));
-                false
-            } else {
-                true
-            }
-        });
+    /// The active document's identity at admission: a queued capture never applies to another
+    /// document. Includes the revision so a saved image is attributable to a known state.
+    fn document_identity(&self) -> Option<screenshot::DocumentId> {
+        self.session.active().map(|st| screenshot::DocumentId { document: st.doc.id.0, revision: st.revision, generation: self.session.active_generation() })
     }
 
-    fn collect_screenshots(&mut self, ctx: &egui::Context) {
-        if self.pending_screenshots.is_empty() {
+    /// Issue due screenshot requests. UI phase only: settling counts real layout passes, and the
+    /// geometry epoch is that of the pass the image will be rendered from.
+    fn issue_captures(&mut self, ctx: &egui::Context) {
+        // A discarded pass (popup sizing, `request_discard`) will be re-run: capture only a pass
+        // whose UI state will actually be present.
+        if ctx.will_discard() {
             return;
         }
-        let events: Vec<_> = ctx.input(|i| {
-            i.raw
-                .events
-                .iter()
-                .filter_map(|e| match e {
-                    egui::Event::Screenshot { user_data, image, .. } => {
-                        let token = user_data.data.as_ref().and_then(|d| d.downcast_ref::<u64>()).copied()?;
-                        Some((token, image.clone()))
+        let now = screenshot::now();
+        let doc = self.document_identity();
+        let finished = self.captures.issue(ctx, now, doc, |callback| screenshot::send_command(ctx, callback));
+        self.finish_captures(finished);
+    }
+
+    /// Collect callbacks and expire requests. Logic phase; the image is encoded and written here,
+    /// on the UI thread, never inside the callback.
+    fn drain_captures(&mut self, ctx: &egui::Context) {
+        let now = screenshot::now();
+        let doc = self.document_identity();
+        // begin_pass supplies the new RawInput before App::logic; run_logic refreshes native
+        // viewport metadata too. Observe it before any completed callback can be delivered.
+        let current = screenshot::CaptureGeometry::current(ctx, doc);
+        self.captures.note_geometry(current);
+        let observed = self.captures.last_geometry();
+        let finished = self.captures.drain(now, observed, doc);
+        self.finish_captures(finished);
+    }
+
+    fn finish_captures(&mut self, finished: Vec<screenshot::Finished>) {
+        for f in finished {
+            let reply = match f.result {
+                Ok(image) => {
+                    let [w, h] = image.size;
+                    // The encoder takes RGBA bytes; its copy is bounded by the same per-image
+                    // reservation as the retained image, and the image itself is released first.
+                    match w.checked_mul(h).and_then(|n| n.checked_mul(4)) {
+                        Some(bytes) if bytes <= screenshot::MAX_IMAGE_BYTES => {
+                            let rgba: Vec<u8> = image.pixels.iter().flat_map(|c| c.to_array()).collect();
+                            drop(image);
+                            control::save_screenshot_rgba(self, w, h, &rgba, f.path.as_deref())
+                        }
+                        _ => serde_json::json!({
+                            "ok": false,
+                            "error": format!(
+                                "screenshot {} failed: the image exceeds the {} MiB encode budget",
+                                f.token,
+                                screenshot::MAX_IMAGE_BYTES / (1 << 20)
+                            ),
+                        }),
                     }
-                    _ => None,
-                })
-                .collect()
-        });
-        for (token, image) in events {
-            if let Some(i) = self.pending_screenshots.iter().position(|(t, _, _)| *t == token) {
-                let (_, path, reply) = self.pending_screenshots.remove(i);
-                let r = control::save_screenshot(self, &image, path.as_deref());
-                let _ = reply.send(r);
+                }
+                Err(e) => serde_json::json!({"ok": false, "error": e}),
+            };
+            if let Some(tx) = f.reply {
+                let _ = tx.send(reply);
             }
         }
     }
@@ -2261,14 +2342,26 @@ impl PhotocraftApp {
     }
 }
 
-impl eframe::App for PhotocraftApp {
-    fn on_exit(&mut self) {
-        if let Err(err) = tool_memory::save_on_exit(self) {
-            log::warn!("Preferences: could not save the final tool selection: {err}");
-        }
+impl PhotocraftApp {
+    /// Install the callback-mode markers in an app creator, before the first `run_ui` on this
+    /// Context (and again through [`Self::setup_context`] when a host replaces its Context).
+    /// Installing while a pass is already running cannot mark that pass; it only arms the next.
+    pub fn install_type_reset_hooks(ctx: &egui::Context) {
+        type_tool::install_reset_hooks(ctx);
     }
 
-    fn logic(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
+    /// The host's UI tail, after all panels and any shell-side model/focus mutations.
+    pub fn finish_type_reset_pass(&mut self, ctx: &egui::Context) {
+        type_tool::finish_reset_pass(self, ctx);
+    }
+
+    /// The host's logic tail; full UI passes leave availability to their later UI tail.
+    pub fn finish_type_reset_logic(&mut self, ctx: &egui::Context) {
+        type_tool::finish_reset_logic(self, ctx);
+    }
+
+    /// Shared logic body. A wrapping host owns the final reset tail after its own work.
+    pub fn logic_frame(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
         self.cap_frame_rate();
         i18n::set_current(i18n::Lang::from_pref(&self.session.prefs().interface.language));
         // Caps Lock state read from the OS once per frame (see `Services::caps_lock`): the canvas
@@ -2295,6 +2388,9 @@ impl eframe::App for PhotocraftApp {
         if self.live_tokens.poll(ctx, self.ui.theme) {
             self.checker = None;
         }
+        // Finish or expire outstanding captures first, so a new request admitted in this pass
+        // sees their released budget.
+        self.drain_captures(ctx);
         self.drain_control(ctx);
         native_menu::run(self, ctx);
         // Switching tools commits, also between the Type and Type Mask tools.
@@ -2308,8 +2404,6 @@ impl eframe::App for PhotocraftApp {
         }
         transform_tool::end_if_left(self);
         shape_stroke_ui::sync_editor(self, ctx);
-        self.collect_screenshots(ctx);
-        self.issue_screenshots(ctx);
         prefs_ui::tick(self, ctx);
         updates_ui::tick(self, ctx);
         monitor_status::poll_frame(self, ctx, frame);
@@ -2326,7 +2420,13 @@ impl eframe::App for PhotocraftApp {
             jobs_ui::tick(self, ctx);
             #[cfg(not(target_arch = "wasm32"))]
             filter_preview_worker::discard_closed(self);
-            shortcuts::handle(self, ctx);
+            if type_tool::in_ui_pass(ctx) {
+                if self.fonts_ready {
+                    shortcuts::handle(self, ctx);
+                } else {
+                    type_tool::controls_only(self, ctx);
+                }
+            }
         }
         let arrived: Vec<(String, Vec<u8>)> =
             self.services.inbox.as_ref().map(|q| std::mem::take(&mut *q.lock().unwrap_or_else(|e| e.into_inner()))).unwrap_or_default();
@@ -2357,55 +2457,55 @@ impl eframe::App for PhotocraftApp {
         self.place_next_dropped(ctx);
         // The control transport wakes the UI on arrival (ctx.request_repaint); only poll while a
         // screenshot is pending. (Polling every 50 ms here made idle apps render at 20 fps.)
-        if !self.pending_screenshots.is_empty() {
+        if self.captures.any_pending() {
             ctx.request_repaint_after(std::time::Duration::from_millis(16));
         }
+        // A hidden host runs no UI pass: a queued (or re-queued) capture asks for one. An issued
+        // capture's own `Screenshot` command forces its paint; asking again would spin a hidden
+        // window while a slow readback is in flight. Synthetic input queued during hidden ticks
+        // needs the same wake: its events sit in eframe's preserved input until a UI pass.
+        if self.captures.any_unissued() || self.synthetic_batch.is_some() || !self.synthetic.is_empty() {
+            ctx.send_viewport_cmd(egui::ViewportCommand::RequestPaintWhileHidden);
+        }
         self.poll_file_dialog(ctx, Some(frame));
     }
 
-    fn raw_input_hook(&mut self, ctx: &egui::Context, raw_input: &mut egui::RawInput) {
-        let frame_start = gpu_canvas::now_ms();
-        // An undecorated window gets its caption back when the toolkit changes its flags
-        // (maximize, restore, …): take it off again before the frame is laid out (#2246).
-        if let Some(window_frame) = self.services.window_frame.as_mut() {
-            window_frame();
-        }
-        // Native menu key equivalents become the key presses they were (see `native_menu`).
-        if let Some(menu) = self.services.native_menu.as_mut() {
-            menu.raw_input(raw_input);
-        }
-        shortcuts::clipboard_keys(ctx, ctx.text_edit_focused() || self.ui.text_edit.is_some(), raw_input);
-        // Windows precision touchpads and some Linux Wayland compositors send pinches
-        // as fractional Ctrl + wheel rather than a native Zoom event (#4566).
-        // Leave Ctrl+whole-notch mouse scrolling alone, and honour the pinch preference.
-        if cfg!(any(target_os = "windows", target_os = "linux")) && self.session.prefs().enhanced_controls.zoom_with_trackpad_pinch {
-            wheel_nav::fold_legacy_pinch(ctx, raw_input);
-        }
-        raw_input.events.extend(self.take_synthetic_step());
-        // After the control channel's own events (`ui.type`) join the OS's, before any widget.
-        widgets::cap_text_events(&mut raw_input.events);
-        self.control_click.normalize(&mut raw_input.events, cfg!(target_os = "macos"));
-        // A pen held still is no touch screen's press-and-hold right click (stylus.rs).
-        let pen_down = self.stylus.pen_contacts.observe(&raw_input.events);
-        stylus::pen_hold_is_no_right_click(ctx, pen_down);
-        if self.custom_titlebar {
-            titlebar::release_after_os_resize(ctx, raw_input);
-        }
-        if self.stroke_trace.enabled() {
-            // The OS's moves and the control channel's (injected just above).
-            let moves = raw_input.events.iter().filter(|e| matches!(e, egui::Event::PointerMoved(_))).count();
-            self.stroke_trace.begin_frame(frame_start, moves);
-        }
-    }
-
-    fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
+    /// Shared UI body. A wrapping host must call `finish_type_reset_pass` after return,
+    /// including when this body returns early without drawing an editor.
+    pub fn ui_frame(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
         let ctx = ui.ctx().clone();
+        // One control owner even when this callback cannot draw the custom editor.
+        if !self.fonts_ready
+            || !self.ui.dialogs.is_empty()
+            || screen_picker::busy(&ctx)
+            || self.ui.text_edit.is_none()
+            || ctx.text_edit_focused()
+            || ctx.egui_wants_keyboard_input()
+        {
+            type_tool::controls_only(self, &ctx);
+        }
+        // 0.36 saved panel sizes under `Id::unique(name)`; 0.37 reads parent-scoped keys. Data-only,
+        // so it runs even before fonts are ready; the old keys stay for a 0.36 rollback.
+        panels::migrate_panel_state(&ctx);
+        // A real UI pass, not a hidden `run_logic` tick: record the capture geometry (the
+        // document identity included) and count one settling pass. `run_logic` leaves these
+        // input values stale; only this real UI phase counts toward settling.
+        let geometry = screenshot::CaptureGeometry::current(&ctx, self.document_identity());
+        self.captures.note_geometry(geometry);
+        self.captures.note_pass();
+        // A real UI pass consumes the one in-flight synthetic batch (see `inject_synthetic`).
+        self.begin_synthetic_pass(&ctx);
         self.hover_layer = None;
         i18n::set_current(i18n::Lang::from_pref(&self.session.prefs().interface.language));
         // Fonts registered via set_fonts only take effect next frame; named families would panic now.
         if !self.fonts_ready {
+            // egui consumed this pass's input without PhotoCraft handling it: keep the synthetic
+            // batch for the next pass instead of losing the step.
+            self.defer_synthetic_pass();
             ctx.request_repaint();
             self.automation_input = false;
+            // No editor was drawn this pass: end its IME context rather than keep a stale owner.
+            type_tool::sync_ime(self, &ctx);
             return;
         }
         let t0 = gpu_canvas::now_ms();
@@ -2429,14 +2529,17 @@ impl eframe::App for PhotocraftApp {
         // View › Screen Mode › Full Screen Mode: only the image, on black (F or Esc returns).
         screen_picker::show(&ctx);
         if screen_picker::busy(&ctx) && screen_picker::showing(&ctx) {
-            egui::Modal::new(egui::Id::new("screen-color-wait")).show(&ctx, |ui| {
+            egui::Modal::new(egui::Id::unique("screen-color-wait")).show(&ctx, |ui| {
                 ui.spinner();
                 ui.label(tl!("Pick a screen pixel or press Esc to cancel"));
                 if ui.button(tl!("Cancel")).clicked() {
                     screen_picker::cancel(&ctx);
                 }
             });
+            // This pass handled its input (the modal above ran): deliver the synthetic batch.
+            self.finish_synthetic_pass();
             self.automation_input = false;
+            type_tool::sync_ime(self, &ctx);
             gpu_status::check_window(self, &ctx);
             return;
         }
@@ -2465,15 +2568,18 @@ impl eframe::App for PhotocraftApp {
         if (chrome && self.ui.panels.toolbar) || tabbed_in {
             panels::toolbar(self, ui);
         }
-        if (chrome && self.ui.panels.dock) || tabbed_in {
-            panels::right_dock(self, ui);
+        // craft-ui's layout holds the canvas as its protected `canvas` panel.
+        let docking = (chrome && self.ui.panels.dock) || tabbed_in;
+        if docking {
+            panels::dock_area(self, ui);
+        } else {
+            let t = theme::Tokens::get(&ctx);
+            let backdrop = if chrome { prefs_ui::pasteboard_color(self).unwrap_or(t.canvas) } else { egui::Color32::BLACK };
+            egui::CentralPanel::default().frame(egui::Frame::NONE.fill(backdrop)).show(ui, |ui| {
+                canvas::document_area(self, ui);
+            });
+            panels::properties_window(self, &ctx);
         }
-        let t = theme::Tokens::get(&ctx);
-        let backdrop = if chrome { prefs_ui::pasteboard_color(self).unwrap_or(t.canvas) } else { egui::Color32::BLACK };
-        egui::CentralPanel::default().frame(egui::Frame::NONE.fill(backdrop)).show(ui, |ui| {
-            canvas::document_area(self, ui);
-        });
-        panels::properties_window(self, &ctx);
         brush_panel::window(self, &ctx);
         preset_panels::windows(self, &ctx);
         gradient_ui::editor_window(self, &ctx);
@@ -2519,12 +2625,15 @@ impl eframe::App for PhotocraftApp {
         tool_memory::persist(self, &ctx);
         // So are View › Extras, Show and Snap To (#3762).
         view_cmds::persist(self, &ctx);
+        // Remember the 0.37 panel sizes so a later 0.36 rollback's newer old-key values win on
+        // the next upgrade (see `panels::migrate_panel_state`).
+        panels::remember_panel_state(&ctx);
         self.automation_input = false;
         shape_stroke_ui::finish_frame(self, &ctx);
         native_menu::sync(self, &ctx);
         if screen_picker::busy(&ctx) {
             // Block input without a backdrop: the worker may still be capturing the screen.
-            egui::Modal::new(egui::Id::new("screen-color-wait")).frame(egui::Frame::NONE).backdrop_color(egui::Color32::TRANSPARENT).show(&ctx, |_| {});
+            egui::Modal::new(egui::Id::unique("screen-color-wait")).frame(egui::Frame::NONE).backdrop_color(egui::Color32::TRANSPARENT).show(&ctx, |_| {});
             ctx.set_cursor_icon(egui::CursorIcon::Wait);
         }
         let ui_ms = gpu_canvas::now_ms() - t0;
@@ -2549,9 +2658,14 @@ impl eframe::App for PhotocraftApp {
                 if info.present.is_empty() { gpu } else { format!("{gpu}, {}", info.present) }
             });
         }
+        // This pass handled its input: the in-flight synthetic batch is delivered once and the
+        // next step may be injected on the next frame.
+        self.finish_synthetic_pass();
         // Synthetic input is injected one press/release step per frame: keep frames coming until
         // the queue is empty, then release control replies waiting on it.
-        if !self.synthetic.is_empty() {
+        // Only a pass that reached the end of the UI and delivered the in-flight batch counts as
+        // settled input; an early-returning pass keeps the batch (and the waiting replies).
+        if !self.synthetic.is_empty() || self.synthetic_batch.is_some() {
             ctx.request_repaint();
         } else if !self.input_waiters.is_empty() {
             for w in self.input_waiters.drain(..) {
@@ -2563,11 +2677,89 @@ impl eframe::App for PhotocraftApp {
         jobs_ui::keep_polling(self, &ctx);
         // Menus and buttons in this frame may have asked for a file dialog.
         self.poll_file_dialog(&ctx, Some(frame));
+        // The Type tool's IME descriptor is the last writer of this pass: every panel and the
+        // canvas have finished mutating the model, and an absent/focus-moved editor ends here.
+        type_tool::sync_ime(self, &ctx);
+        // Issue any due `ui.screenshot` now that this pass's state is settled: a queued request
+        // that has waited its passes and animation delay captures exactly this frame.
+        self.issue_captures(&ctx);
         // Last, after everything drawn this frame: a lost window device can't draw it (#3438).
         gpu_status::check_window(self, &ctx);
     }
 }
 
+impl eframe::App for PhotocraftApp {
+    fn on_exit(&mut self) {
+        if let Err(err) = tool_memory::save_on_exit(self) {
+            log::warn!("Preferences: could not save the final tool selection: {err}");
+        }
+        // Release a pending screenshot's image budget and answer its control request; the
+        // callback is inert afterwards (it holds only a weak slot).
+        let finished = self.captures.cancel_all("the application is closing");
+        self.finish_captures(finished);
+    }
+
+    fn logic(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
+        self.logic_frame(ctx, frame);
+        self.finish_type_reset_logic(ctx);
+    }
+
+    fn raw_input_hook(&mut self, ctx: &egui::Context, raw_input: &mut egui::RawInput) {
+        let frame_start = gpu_canvas::now_ms();
+        // An undecorated window gets its caption back when the toolkit changes its flags
+        // (maximize, restore, …): take it off again before the frame is laid out (#2246).
+        if let Some(window_frame) = self.services.window_frame.as_mut() {
+            window_frame();
+        }
+        // Native menu key equivalents become the key presses they were (see `native_menu`).
+        if let Some(menu) = self.services.native_menu.as_mut() {
+            menu.raw_input(raw_input);
+        }
+        // While a text field of a floating panel's own window has the keyboard, the dock area
+        // hands that window the text keys in this input and converts them there.
+        if craft_ui::docking::typing_window(ctx).is_none() {
+            shortcuts::clipboard_keys(ctx, ctx.text_edit_focused() || self.ui.text_edit.is_some(), raw_input);
+        }
+        // Windows precision touchpads and some Linux Wayland compositors send pinches
+        // as fractional Ctrl + wheel rather than a native Zoom event (#4566).
+        // Leave Ctrl+whole-notch mouse scrolling alone, and honour the pinch preference.
+        if cfg!(any(target_os = "windows", target_os = "linux")) && self.session.prefs().enhanced_controls.zoom_with_trackpad_pinch {
+            wheel_nav::fold_legacy_pinch(ctx, raw_input);
+        }
+        self.inject_synthetic(ctx, raw_input);
+        // After the control channel's own events (`ui.type`) join the OS's, before any widget.
+        widgets::cap_text_events(&mut raw_input.events);
+        self.control_click.normalize(&mut raw_input.events, cfg!(target_os = "macos"));
+        // A pen held still is no touch screen's press-and-hold right click (stylus.rs).
+        let pen_down = self.stylus.pen_contacts.observe(&raw_input.events);
+        stylus::pen_hold_is_no_right_click(ctx, pen_down);
+        if self.custom_titlebar {
+            titlebar::release_after_os_resize(ctx, raw_input);
+        }
+        if self.stroke_trace.enabled() {
+            // The OS's moves and the control channel's (injected just above).
+            let moves = raw_input.events.iter().filter(|e| matches!(e, egui::Event::PointerMoved(_))).count();
+            self.stroke_trace.begin_frame(frame_start, moves);
+        }
+    }
+
+    fn ui(&mut self, ui: &mut egui::Ui, frame: &mut eframe::Frame) {
+        self.ui_frame(ui, frame);
+        self.finish_type_reset_pass(ui.ctx());
+    }
+}
+
+/// Remove one contiguous run equal to `batch` from `events` (eframe's preserved synthetic
+/// input). A no-op when the run is not present.
+fn remove_event_run(events: &mut Vec<egui::Event>, batch: &[egui::Event]) {
+    if batch.is_empty() || batch.len() > events.len() {
+        return;
+    }
+    if let Some(pos) = events.windows(batch.len()).position(|w| w == batch) {
+        events.drain(pos..pos + batch.len());
+    }
+}
+
 #[cfg(not(target_arch = "wasm32"))]
 fn read_dropped(f: &(dyn egui::DroppedFile + Send + Sync)) -> Result<Vec<u8>, String> {
     f.bytes()
@@ -2600,18 +2792,36 @@ impl PhotocraftApp {
     /// ⌘I then inverts the mask, as in Photoshop (#780). A targeted alpha channel or Quick Mask
     /// mode wins, as the engine routes those itself.
     pub fn with_mask_target(&self, id: &str, params: Value) -> Value {
-        if !photocraft_engine::channel_cmds::follows_target(id) || params.get("target").is_some() || !self.layer_mask_targeted() {
+        if !photocraft_engine::channel_cmds::follows_target(id) || params.get("target").is_some() {
             return params;
         }
+        // A filter mask is painted, filled and filtered in place; it doesn't float or move, and
+        // Edit › Transform, Apply Image and the dialog filters act on the smart object.
+        let target = if self.filter_mask_targeted() && photocraft_engine::channel_cmds::follows_filter_mask(id) {
+            "filterMask"
+        } else if self.layer_mask_targeted() {
+            "mask"
+        } else {
+            return params;
+        };
         match params {
             Value::Object(mut m) => {
-                m.insert("target".into(), Value::from("mask"));
+                m.insert("target".into(), Value::from(target));
                 Value::Object(m)
             }
-            _ => serde_json::json!({ "target": "mask" }),
+            _ => serde_json::json!({ "target": target }),
         }
     }
 
+    /// The Layers panel targets the active smart object's filter mask (FILE-215-3), and no alpha
+    /// channel or Quick Mask takes over.
+    pub fn filter_mask_targeted(&self) -> bool {
+        let Some(st) = self.session.active() else { return false };
+        let Some(id) = st.active_layer.filter(|id| self.ui.filter_mask_target == Some(id.0)) else { return false };
+        let composite = st.channel_view.target == photocraft_engine::channel_cmds::ChannelTarget::Composite && st.doc.quick_mask.is_none();
+        composite && st.doc.layer(id).is_some_and(|l| matches!(&l.content, photocraft_doc::LayerContent::Smart(sm) if !sm.smart_filters.is_empty()))
+    }
+
     /// The active layer's mask is what pixel commands edit: the Layers panel targets it, the layer
     /// is an adjustment layer (no pixels of its own), or every colour channel is off and that mask
     /// is the picture. An alpha channel or Quick Mask wins, as the engine routes those itself.
@@ -2631,17 +2841,72 @@ impl PhotocraftApp {
         colors_off && !alpha_on
     }
 
+    /// Targeting the pixels, the layer mask or the vector mask ends a shown filter mask (⌥-click
+    /// on its thumbnail): while it shows, [`Self::sync_mask_targets`] keeps the filter mask
+    /// targeted, so strokes would keep landing there.
+    pub(crate) fn end_filter_mask_view(&mut self) {
+        let Some(v) = self.session.active().and_then(photocraft_engine::mask_view_cmds::current).filter(|v| v.filter) else { return };
+        let off = serde_json::json!({"layer": v.layer.0, "mode": "off", "mask": "filter"});
+        if let Err(err) = self.session.execute(photocraft_engine::mask_view_cmds::ID, off) {
+            log::warn!("could not end the filter mask view: {err}");
+        }
+    }
+
+    /// Explicitly targeting a filter mask ends any conflicting mask view; untargeting it ends its
+    /// own view too.
+    pub(crate) fn select_filter_mask_target(&mut self, layer: Option<u64>) {
+        if layer.is_none() {
+            self.end_filter_mask_view();
+        }
+        if layer.is_some() {
+            if let Some(st) = self.session.active_mut() {
+                if st.channel_view.layer_mask.is_some_and(|v| !v.filter || Some(v.layer.0) != layer) {
+                    st.channel_view.layer_mask = None;
+                }
+                if matches!(
+                    st.channel_view.target,
+                    photocraft_engine::channel_cmds::ChannelTarget::LayerMask | photocraft_engine::channel_cmds::ChannelTarget::VectorMask
+                ) {
+                    st.channel_view.target = photocraft_engine::channel_cmds::ChannelTarget::Composite;
+                }
+            }
+            self.ui.mask_target = false;
+            self.ui.vector_mask_target = false;
+        }
+        self.ui.filter_mask_target = layer;
+        self.sync_mask_targets();
+    }
+
     /// Viewing a layer mask (#196) targets it; a vector-mask target needs a vector mask on the
     /// active layer (a shape layer's path is its content, not a mask). Targeting a mask or the
     /// pixels brings back that target's foreground/background pair, as in Photoshop (#2166).
     pub(crate) fn sync_mask_targets(&mut self) {
         if let Some(st) = self.session.active_mut() {
-            if photocraft_engine::mask_view_cmds::current(st).is_some() || st.channel_view.target == photocraft_engine::channel_cmds::ChannelTarget::LayerMask {
-                self.ui.mask_target = true;
-                self.ui.vector_mask_target = false;
-            } else if st.channel_view.target == photocraft_engine::channel_cmds::ChannelTarget::VectorMask {
-                self.ui.vector_mask_target = true;
-                self.ui.mask_target = false;
+            use photocraft_engine::channel_cmds::ChannelTarget;
+            let channel = st.channel_view.target;
+            match photocraft_engine::mask_view_cmds::current(st) {
+                Some(v) if v.filter => {
+                    self.ui.filter_mask_target = Some(v.layer.0);
+                    self.ui.mask_target = false;
+                    self.ui.vector_mask_target = false;
+                }
+                Some(_) => {
+                    self.ui.mask_target = true;
+                    self.ui.vector_mask_target = false;
+                    self.ui.filter_mask_target = None;
+                }
+                None if channel == ChannelTarget::LayerMask => {
+                    self.ui.mask_target = true;
+                    self.ui.vector_mask_target = false;
+                }
+                None if channel == ChannelTarget::VectorMask => {
+                    self.ui.vector_mask_target = true;
+                    self.ui.mask_target = false;
+                }
+                None => {}
+            }
+            if self.ui.mask_target || self.ui.vector_mask_target {
+                self.ui.filter_mask_target = None;
             }
             if self.ui.vector_mask_target && !mask_thumbs_ui::has_vector_mask(st) {
                 self.ui.vector_mask_target = false;
@@ -2656,7 +2921,10 @@ impl PhotocraftApp {
                 self.ui.properties_layer = None;
             }
         }
-        let mask = self.layer_mask_targeted();
+        if self.ui.filter_mask_target.is_some() && !self.filter_mask_targeted() {
+            self.ui.filter_mask_target = None;
+        }
+        let mask = self.layer_mask_targeted() || self.filter_mask_targeted();
         self.session.tools.target_mask(mask);
     }
 
@@ -2860,6 +3128,99 @@ fn thumb_image(frame: photocraft_geom::Rect, side: usize, mut f: impl FnMut(i32,
 }
 
 impl PhotocraftApp {
+    /// The document/focus identity the in-flight synthetic batch was queued for.
+    fn synthetic_target(&self, ctx: &egui::Context) -> SyntheticTarget {
+        SyntheticTarget { document: self.document_identity(), focus: ctx.memory(|m| m.focused()) }
+    }
+
+    fn synthetic_target_matches(&self, ctx: &egui::Context) -> bool {
+        self.synthetic_snapshot.is_some_and(|queued| queued.matches(self.synthetic_target(ctx)))
+    }
+
+    /// Put at most one queued synthetic batch into this pass's input.
+    ///
+    /// The batch is appended once and tracked; `begin_pass` consumes it. While it is in flight no
+    /// further step is drained, so hidden logic ticks cannot accumulate several batches into one
+    /// pass. A document or focus change observed here is before eframe consumes the events, so the
+    /// batch is dropped and its waiting control replies fail instead of landing somewhere else.
+    /// If a pass consumed it but PhotoCraft returned before handling input (fonts not ready), the
+    /// same batch is appended again on the next hook, exactly once.
+    fn inject_synthetic(&mut self, ctx: &egui::Context, raw_input: &mut egui::RawInput) {
+        if self.synthetic_batch.is_some() {
+            if !self.synthetic_target_matches(ctx) {
+                // eframe may already carry the batch in its preserved input: withdraw exactly
+                // those events before the host consumes them, then fail the waiting replies.
+                if let Some(batch) = self.synthetic_batch.as_ref() {
+                    remove_event_run(&mut raw_input.events, batch);
+                }
+                self.cancel_synthetic("the active document or focus changed while the input was queued");
+                return;
+            }
+            if self.synthetic_reinject {
+                if let Some(batch) = self.synthetic_batch.clone() {
+                    raw_input.events.extend(batch);
+                }
+                self.synthetic_reinject = false;
+                self.automation_input = true;
+            }
+            return;
+        }
+        if self.synthetic.is_empty() {
+            return;
+        }
+        let events = self.take_synthetic_step();
+        if events.is_empty() {
+            return;
+        }
+        self.synthetic_snapshot = Some(self.synthetic_target(ctx));
+        raw_input.events.extend(events.iter().cloned());
+        self.synthetic_batch = Some(events);
+    }
+
+    /// A pass begins with the in-flight batch. The events are already in this pass's input, so a
+    /// target change detected now cannot withdraw them: deliver them (never half-apply) and keep
+    /// `automation_input` set so the commands they trigger still go through the automation policy.
+    /// `inject_synthetic` performs the withdrawable check, before the host consumes the events.
+    /// Called at the start of `App::ui` only (a hidden `run_logic` tick consumes no input).
+    fn begin_synthetic_pass(&mut self, ctx: &egui::Context) {
+        if self.synthetic_batch.is_none() {
+            return;
+        }
+        if !self.synthetic_target_matches(ctx) {
+            log::warn!("synthetic input: the document or focus changed inside the pass; delivering it as automation input");
+        }
+        self.automation_input = true;
+    }
+
+    /// One full UI pass handled the in-flight batch: deliver it once and let the next step in.
+    fn finish_synthetic_pass(&mut self) {
+        let _ = self.synthetic_batch.take();
+        self.synthetic_snapshot = None;
+        self.synthetic_reinject = false;
+    }
+
+    /// The pass returned before the input handling (fonts not ready): keep the batch and have the
+    /// next hook append it again exactly once, because egui already consumed the events.
+    fn defer_synthetic_pass(&mut self) {
+        if self.synthetic_batch.is_some() {
+            self.synthetic_reinject = true;
+        }
+    }
+
+    /// Drop the in-flight batch and fail the replies waiting on it.
+    fn cancel_synthetic(&mut self, reason: &str) {
+        let pending = self.synthetic_batch.take().is_some() || !self.synthetic.is_empty();
+        self.synthetic.clear();
+        self.synthetic_snapshot = None;
+        self.synthetic_reinject = false;
+        self.automation_input = false;
+        if pending || !self.input_waiters.is_empty() {
+            for w in self.input_waiters.drain(..) {
+                let _ = w.send(serde_json::json!({"ok": false, "error": format!("input cancelled: {reason}")}));
+            }
+        }
+    }
+
     /// Next step of queued synthetic input (automation): events up to and including the first
     /// release, so egui sees press and release in separate frames. Hosts that don't call
     /// `raw_input_hook` (offscreen harnesses) feed these to their input themselves.
@@ -2876,9 +3237,12 @@ impl PhotocraftApp {
         events
     }
 
-    /// Install fonts, image loaders and the theme. Call from the app creator when possible so the
-    /// very first frame renders; otherwise `logic` does it and the first frame is skipped.
+    /// Install fonts, image loaders and the theme. Call from the app creator (and again for a
+    /// replacement Context) before the first `run_ui` so the very first frame renders and the
+    /// Type reset begin/end pass markers exist; otherwise `logic` does it and the first frame is
+    /// skipped, with the begin-pass marker necessarily starting on the following pass.
     pub fn setup_context(ctx: &egui::Context, kind: theme::ThemeKind) {
+        Self::install_type_reset_hooks(ctx);
         ctx.add_plugin(tool_cursor::CursorLifecycle);
         ctx.add_plugin(single_line_drag::SingleLineDrag::default());
         theme::install_fonts(ctx);
@@ -3207,7 +3571,7 @@ impl PhotocraftApp {
         let r = photocraft_geom::Rect::new(0, 0, w as i32, h as i32);
         let mut surface = photocraft_raster::Surface::from_interleaved(photocraft_color::PixelFormat::RGBA8, r, &bytes);
         surface.prune();
-        self.session.clipboard = Some(photocraft_engine::edit_cmds::Clip { surface, bounds: r, layers: None, resolution: None });
+        self.session.clipboard = Some(photocraft_engine::edit_cmds::Clip { surface, bounds: r, layers: None, resolution: None, source: None });
         self.os_clip_sig = Some(sig);
         self.clip_external = true;
         self.clip_unmirrored = false;
@@ -3215,6 +3579,12 @@ impl PhotocraftApp {
     }
 }
 
+#[cfg(test)]
+mod lifecycle_tests;
+
+#[cfg(test)]
+mod screenshot_tests;
+
 #[cfg(test)]
 mod navigator_gpu_tests;
 
diff --git a/crates/ui-egui/src/lifecycle_tests.rs b/crates/ui-egui/src/lifecycle_tests.rs
new file mode 100644
index 0000000000..d9506a6907
--- /dev/null
+++ b/crates/ui-egui/src/lifecycle_tests.rs
@@ -0,0 +1,191 @@
+//! Hidden-tick and synthetic-input lifecycle regressions.
+//!
+//! The host runs `App::logic` without a UI pass for hidden/occluded windows; eframe preserves the
+//! raw input appended by `raw_input_hook` until a real pass consumes it. These tests exercise that
+//! order without a renderer: at most one synthetic batch may be in flight, a pass that returns
+//! early must not lose it (and must not deliver it twice), and a batch queued for one document
+//! must not be replayed into another.
+
+use crate::{PhotocraftApp, Services};
+use eframe::App as _;
+use egui::{Context, Event, Key, Modifiers, RawInput};
+use photocraft_engine::Session;
+use serde_json::json;
+
+fn app_with_doc() -> PhotocraftApp {
+    let mut app = PhotocraftApp::new(Session::new(), Services::default());
+    app.run("file.new", json!({"width": 32, "height": 32})).expect("a document");
+    app
+}
+
+fn press(key: Key) -> Event {
+    Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE }
+}
+
+fn release(key: Key) -> Event {
+    Event::Key { key, physical_key: None, pressed: false, repeat: false, modifiers: Modifiers::NONE }
+}
+
+fn hook(app: &mut PhotocraftApp, ctx: &Context) -> Vec<Event> {
+    let mut raw = RawInput::default();
+    app.inject_synthetic(ctx, &mut raw);
+    raw.events
+}
+
+/// Hidden logic ticks still receive the current viewport's native geometry. The default ROOT
+/// entry has no geometry, so it cannot represent a window with a capturable size.
+fn host_input(viewport: egui::ViewportId) -> RawInput {
+    let rect = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(1200.0, 800.0));
+    let mut raw = RawInput { viewport_id: viewport, screen_rect: Some(rect), focused: true, ..Default::default() };
+    raw.viewports
+        .insert(viewport, egui::ViewportInfo { inner_rect: Some(rect), native_pixels_per_point: Some(1.0), minimized: Some(false), ..Default::default() });
+    raw
+}
+
+#[test]
+fn one_batch_at_a_time_across_hidden_ticks() {
+    let ctx = Context::default();
+    let mut app = app_with_doc();
+    app.synthetic.extend([press(Key::V), release(Key::V), press(Key::W), release(Key::W)]);
+    // The first hidden tick injects the first press/release pair.
+    let first = hook(&mut app, &ctx);
+    assert_eq!(first.len(), 2, "one step: the press and its release");
+    // Further hidden ticks must not drain the next step into eframe's preserved buffer.
+    assert!(hook(&mut app, &ctx).is_empty());
+    assert!(hook(&mut app, &ctx).is_empty());
+    // A real UI pass consumes the batch; only then may the next step start.
+    app.begin_synthetic_pass(&ctx);
+    app.finish_synthetic_pass();
+    let next = hook(&mut app, &ctx);
+    assert_eq!(next.len(), 2, "the second step starts after the pass");
+}
+
+#[test]
+fn an_early_returning_pass_reinjects_the_batch_exactly_once() {
+    let ctx = Context::default();
+    let mut app = app_with_doc();
+    app.synthetic.extend([press(Key::A)]);
+    assert_eq!(hook(&mut app, &ctx).len(), 1);
+    // A pass began (egui consumed the events), then returned before handling input: fonts not
+    // ready. Keep the same batch and put it back on the next hook.
+    app.begin_synthetic_pass(&ctx);
+    app.defer_synthetic_pass();
+    let again = hook(&mut app, &ctx);
+    assert_eq!(again.len(), 1, "the same step is delivered again");
+    assert!(matches!(again[0], Event::Key { key: Key::A, pressed: true, .. }));
+    // A second hidden tick before the UI pass must not append the step a second time.
+    assert!(hook(&mut app, &ctx).is_empty(), "the reinjection is consumed once");
+    app.begin_synthetic_pass(&ctx);
+    app.finish_synthetic_pass();
+    assert!(hook(&mut app, &ctx).is_empty(), "then it is delivered once and done");
+}
+
+#[test]
+fn a_document_change_before_injection_drops_the_batch_and_replies() {
+    let ctx = Context::default();
+    let mut app = app_with_doc();
+    app.synthetic.extend([press(Key::V), release(Key::V)]);
+    assert!(!hook(&mut app, &ctx).is_empty());
+    let (tx, rx) = std::sync::mpsc::channel();
+    app.input_waiters.push(tx);
+    // The document changed while the events were still in flight: the next hook sees it before
+    // the host consumes them, so it withdraws the batch and fails the waiting reply.
+    app.run("file.new", json!({"width": 16, "height": 16})).expect("a second document");
+    assert!(hook(&mut app, &ctx).is_empty(), "nothing is delivered to the new document");
+    assert!(app.synthetic_batch.is_none(), "the stale batch is dropped");
+    let reply = rx.recv().expect("the waiting control request gets an answer");
+    assert_eq!(reply["ok"], false);
+    assert!(reply["error"].as_str().is_some_and(|e| e.contains("document or focus changed")));
+}
+
+#[test]
+fn a_document_change_inside_the_pass_is_delivered_and_not_reported_as_cancelled() {
+    let ctx = Context::default();
+    let mut app = app_with_doc();
+    app.synthetic.extend([press(Key::V), release(Key::V)]);
+    assert!(!hook(&mut app, &ctx).is_empty());
+    let (tx, rx) = std::sync::mpsc::channel();
+    app.input_waiters.push(tx);
+    // `logic` opens another document after the hook consumed the events into this pass. They
+    // cannot be withdrawn now. Treat the batch as delivered (automation-gated) rather than
+    // failing the reply while the input still lands.
+    app.run("file.new", json!({"width": 16, "height": 16})).expect("a second document");
+    app.begin_synthetic_pass(&ctx);
+    assert!(app.automation_input, "the delivered batch keeps the automation policy");
+    assert!(app.synthetic_batch.is_some(), "the pass still owns the batch until it finishes");
+    assert!(rx.try_recv().is_err(), "no cancellation reply for input that was delivered");
+    app.finish_synthetic_pass();
+    assert!(app.synthetic_batch.is_none());
+}
+
+#[test]
+fn a_preserved_batch_is_withdrawn_from_the_raw_input_on_a_document_change() {
+    let ctx = Context::default();
+    let mut app = app_with_doc();
+    app.synthetic.extend([press(Key::V), release(Key::V)]);
+    let first = hook(&mut app, &ctx);
+    assert_eq!(first.len(), 2);
+    // A hidden logic tick preserved the events for the next pass; meanwhile the document changed.
+    app.run("file.new", json!({"width": 16, "height": 16})).expect("a second document");
+    let mut preserved = RawInput { events: first, ..Default::default() };
+    app.inject_synthetic(&ctx, &mut preserved);
+    assert!(preserved.events.is_empty(), "the stale events are withdrawn from preserved input");
+    assert!(app.synthetic_batch.is_none());
+}
+
+#[test]
+fn an_edit_in_the_same_document_does_not_cancel_the_queued_batch() {
+    let ctx = Context::default();
+    let mut app = app_with_doc();
+    app.synthetic.extend([press(Key::L), release(Key::L)]);
+    assert!(!hook(&mut app, &ctx).is_empty());
+    let (tx, rx) = std::sync::mpsc::channel();
+    app.input_waiters.push(tx);
+    // A command edits the same document while the step is in flight: the revision changes, the
+    // document activation does not, so the step is not cancelled.
+    app.run("layer.new.layer", json!({"name": "queued"})).expect("an edit");
+    let mut preserved = RawInput::default();
+    app.inject_synthetic(&ctx, &mut preserved);
+    assert!(app.synthetic_batch.is_some(), "the batch for this document survives an edit");
+    assert!(rx.try_recv().is_err(), "no cancellation reply");
+    app.begin_synthetic_pass(&ctx);
+    app.finish_synthetic_pass();
+}
+
+/// A hidden host runs `logic` without a UI pass. Both a capture that is waiting for its first
+/// geometry and a queued synthetic step must ask the host for a paint, or the window stays
+/// hidden forever and the control request times out.
+#[test]
+fn a_logic_tick_requests_a_hidden_paint_for_waiting_captures_and_queued_input() {
+    let ctx = Context::default();
+    let mut app = app_with_doc();
+    let mut frame = eframe::Frame::_new_kittest();
+    let (tx, _rx) = std::sync::mpsc::channel();
+    let document = app.document_identity();
+    app.captures.admit(90, None, tx, document, 0.0, crate::screenshot::now()).expect("parked before the first pass");
+    let out = ctx.run_logic(&host_input(egui::ViewportId::ROOT), |ctx| app.logic(ctx, &mut frame));
+    let paints = |out: &egui::LogicOutput| {
+        out.viewport_commands.get(&egui::ViewportId::ROOT).is_some_and(|commands| commands.contains(&egui::ViewportCommand::RequestPaintWhileHidden))
+    };
+    assert!(paints(&out), "a capture waiting for geometry keeps the hidden window painting");
+
+    app.synthetic.extend([press(Key::V), release(Key::V)]);
+    let mut raw = host_input(egui::ViewportId::ROOT);
+    app.inject_synthetic(&ctx, &mut raw);
+    let out = ctx.run_logic(&raw, |ctx| app.logic(ctx, &mut frame));
+    assert!(paints(&out), "queued synthetic input keeps the hidden window painting");
+}
+
+#[test]
+fn a_finished_pass_does_not_replay_the_batch() {
+    let ctx = Context::default();
+    let mut app = app_with_doc();
+    app.synthetic.extend([press(Key::B), release(Key::B)]);
+    assert_eq!(hook(&mut app, &ctx).len(), 2);
+    app.begin_synthetic_pass(&ctx);
+    app.finish_synthetic_pass();
+    // A second pass in the same frame (a popup sizing pass) must see no events from us.
+    let mut second_pass = RawInput::default();
+    app.inject_synthetic(&ctx, &mut second_pass);
+    assert!(second_pass.events.is_empty());
+}
diff --git a/crates/ui-egui/src/liquify_ui.rs b/crates/ui-egui/src/liquify_ui.rs
index 43a792d3ff..52a16f6223 100644
--- a/crates/ui-egui/src/liquify_ui.rs
+++ b/crates/ui-egui/src/liquify_ui.rs
@@ -59,7 +59,7 @@ pub enum BackdropMode {
 }
 
 impl BackdropMode {
-    const ALL: [(BackdropMode, &'static str); 3] = [(BackdropMode::InFront, "inFront"), (BackdropMode::Behind, "behind"), (BackdropMode::Blend, "blend")];
+    const ALL: [(BackdropMode, &str); 3] = [(BackdropMode::InFront, "inFront"), (BackdropMode::Behind, "behind"), (BackdropMode::Blend, "blend")];
 
     fn key(self) -> &'static str {
         Self::ALL.iter().find(|(m, _)| *m == self).map_or("inFront", |(_, k)| k)
@@ -904,7 +904,8 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let mut events: Vec<ToolEvent> = Vec::new();
     let mut mods = egui::Modifiers::NONE;
     let pinch_zooms = app.session.prefs().enhanced_controls.zoom_with_trackpad_pinch;
-    egui::Area::new(egui::Id::new("liquify-dialog")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
+    let animated_zoom = app.session.prefs().general.animated_zoom;
+    egui::Area::new(egui::Id::unique("liquify-dialog")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
         let Some(d) = app.distort.liquify.as_mut() else { return };
         d.upload(ctx);
         let (full, _) = ui.allocate_exact_size(screen.size(), Sense::hover());
@@ -984,7 +985,14 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
             widgets::checkbox(ui, &mut d.opts.show_mesh, tl!("Show Mesh"));
             ui.horizontal(|ui| {
                 ui.label(tl!("Mesh Size"));
-                widgets::dropdown(ui, "liquify-mesh-size", &mut d.opts.mesh_size, &[(0, tl!("Small")), (1, tl!("Medium")), (2, tl!("Large"))], 110.0);
+                widgets::dropdown(
+                    ui,
+                    "liquify-mesh-size",
+                    tl!("Mesh Size"),
+                    &mut d.opts.mesh_size,
+                    &[(0, tl!("Small")), (1, tl!("Medium")), (2, tl!("Large"))],
+                    110.0,
+                );
             });
             widgets::checkbox(ui, &mut d.opts.show_mask, tl!("Show Mask"));
             widgets::checkbox(ui, &mut d.opts.show_backdrop, tl!("Show Backdrop"));
@@ -992,12 +1000,12 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 ui.horizontal(|ui| {
                     ui.label(tl!("Use"));
                     let names: Vec<(Option<u64>, &str)> = backdrop_layers.iter().map(|(id, n)| (*id, n.as_str())).collect();
-                    widgets::dropdown_literal(ui, "liquify-backdrop-use", &mut d.opts.backdrop_layer, &names, 150.0);
+                    widgets::dropdown_literal(ui, "liquify-backdrop-use", tl!("Layer"), &mut d.opts.backdrop_layer, &names, 150.0);
                 });
                 ui.horizontal(|ui| {
                     ui.label(tl!("Mode"));
                     let modes = [(BackdropMode::InFront, tl!("In Front")), (BackdropMode::Behind, tl!("Behind")), (BackdropMode::Blend, tl!("Blend"))];
-                    widgets::dropdown(ui, "liquify-backdrop-mode", &mut d.opts.backdrop_mode, &modes, 150.0);
+                    widgets::dropdown(ui, "liquify-backdrop-mode", tl!("Mode"), &mut d.opts.backdrop_mode, &modes, 150.0);
                 });
                 widgets::slider_row(ui, tl!("Opacity"), &mut d.opts.backdrop_opacity, 0.0..=100.0, "", None);
             }
@@ -1034,14 +1042,22 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
             d.zoom = ((area.width() - 40.0) / cw).min((area.height() - 40.0) / ch).clamp(ZOOM_MIN, 4.0);
             d.center = [f64::from(d.canvas.x0) + f64::from(cw) / 2.0, f64::from(d.canvas.y0) + f64::from(ch) / 2.0];
         }
-        let resp = ui.interact(area, egui::Id::new("liquify-preview"), Sense::click_and_drag());
+        let resp = ui.interact(area, egui::Id::unique("liquify-preview"), Sense::click_and_drag());
         // The wheel zooms about the pointer, ×1.1 a notch, and so does a trackpad pinch (unless
         // Preferences › Enhanced Controls › Zoom with Trackpad Pinch is off); a sideways scroll
         // pans (#7210). Read every frame, as `wheel_nav` asks, so its modifier state follows.
-        let wheel = crate::wheel_nav::read(ctx, true, pinch_zooms, egui::Id::new("liquify-preview-wheel"), resp.hovered());
+        let wheel_id = egui::Id::unique("liquify-preview-wheel");
+        let wheel = crate::wheel_nav::read(ctx, true, pinch_zooms, animated_zoom, wheel_id, resp.hovered());
         if let Some(hp) = resp.hover_pos() {
             let zoom = match wheel {
-                Some(crate::wheel_nav::Wheel::Zoom(f)) => Some((d.zoom * f).clamp(ZOOM_MIN, ZOOM_MAX)),
+                Some(crate::wheel_nav::Wheel::Zoom(f)) => {
+                    let z = d.zoom * f;
+                    // At a limit, drop the rest of an eased notch, or it would swallow the first notch back.
+                    if z != z.clamp(ZOOM_MIN, ZOOM_MAX) {
+                        crate::wheel_nav::settle(ctx, wheel_id);
+                    }
+                    Some(z.clamp(ZOOM_MIN, ZOOM_MAX))
+                }
                 Some(crate::wheel_nav::Wheel::SnapZoom(n)) => {
                     Some((0..n.unsigned_abs()).fold(d.zoom, |z, _| crate::zoom_levels::step_in_range(z, n.signum(), ZOOM_MIN, ZOOM_MAX)))
                 }
@@ -1705,7 +1721,7 @@ mod tests {
         };
         let mut out = ctx.run_ui(raw, |ui| {
             let ctx = ui.ctx();
-            ctx.memory_mut(|m| m.request_focus(egui::Id::new("liquify-slider-focus")));
+            ctx.memory_mut(|m| m.request_focus(egui::Id::unique("liquify-slider-focus")));
             assert!(ctx.egui_wants_keyboard_input());
             crate::shortcuts::handle(&mut app, ctx);
         });
@@ -1727,6 +1743,80 @@ mod tests {
         assert_eq!(app.distort.liquify.as_ref().unwrap().strokes.len(), 1, "Cmd+Shift+Z redoes the last stroke");
     }
 
+    // Regression test for #4134: Cmd+Z and Cmd+Shift+Z were ignored in Liquify while a numeric
+    // field's text edit (Size, Pressure, ...) had keyboard focus, so a stroke could not be undone.
+    #[test]
+    fn liquify_undo_and_redo_work_while_a_numeric_field_is_focused() {
+        let ctx = egui::Context::default();
+        let mut app = app_with_layer();
+        open(&mut app, &ctx).unwrap();
+        for ev in [ToolEvent::Down { x: 40.0, y: 40.0, pressure: 1.0 }, ToolEvent::Move { x: 52.0, y: 40.0, pressure: 1.0 }, ToolEvent::Up { x: 52.0, y: 40.0 }]
+        {
+            pointer(&mut app, ev, egui::Modifiers::NONE);
+        }
+        let strokes = |app: &PhotocraftApp| app.distort.liquify.as_ref().unwrap().strokes.len();
+        assert_eq!(strokes(&app), 1);
+
+        // One frame of the real shortcut handler, then a focused single-line text edit (the
+        // numeric fields are text edits), as the app orders them.
+        let mut text = String::from("100");
+        let field = egui::Id::unique("liquify-size-field");
+        let mut frame = |app: &mut PhotocraftApp, events: Vec<egui::Event>| {
+            let raw = egui::RawInput { events, ..Default::default() };
+            let mut out = ctx.run_ui(raw, |ui| {
+                crate::shortcuts::handle(app, ui.ctx());
+                let edit = ui.add(egui::TextEdit::singleline(&mut text).id(field));
+                edit.request_focus();
+            });
+            out.textures_delta.clear();
+        };
+        frame(&mut app, Vec::new());
+        assert!(ctx.text_edit_focused(), "the numeric field is a focused text edit");
+
+        let z = |modifiers| egui::Event::Key { key: egui::Key::Z, physical_key: None, pressed: true, repeat: false, modifiers };
+        frame(&mut app, vec![z(egui::Modifiers::COMMAND)]);
+        assert_eq!(strokes(&app), 0, "Cmd+Z undoes the stroke with the field focused");
+        frame(&mut app, vec![z(egui::Modifiers::COMMAND | egui::Modifiers::SHIFT)]);
+        assert_eq!(strokes(&app), 1, "Cmd+Shift+Z redoes it");
+    }
+
+    // Regression test for #4134: other Liquify keys must not steal characters from a focused
+    // numeric field, and the bracket keys step the brush by at least one pixel.
+    #[test]
+    fn liquify_tool_keys_leave_a_focused_field_alone_and_brackets_reach_one_pixel() {
+        let ctx = egui::Context::default();
+        let mut app = app_with_layer();
+        open(&mut app, &ctx).unwrap();
+        app.distort.liquify.as_mut().unwrap().opts.size = 2.0;
+        let size = |app: &PhotocraftApp| app.distort.liquify.as_ref().unwrap().opts.size;
+        let press = |app: &mut PhotocraftApp, key: egui::Key| {
+            let ev = egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE };
+            let mut out = ctx.run_ui(egui::RawInput { events: vec![ev], ..Default::default() }, |ui| crate::shortcuts::handle(app, ui.ctx()));
+            out.textures_delta.clear();
+        };
+        // 2 px * 0.9 used to round back to 2, so `[` never reached 1 px; `]` steps up from 1.
+        press(&mut app, egui::Key::OpenBracket);
+        assert_eq!(size(&app), 1.0, "`[` steps a 2 px brush down to 1 px");
+        press(&mut app, egui::Key::CloseBracket);
+        assert_eq!(size(&app), 2.0, "`]` steps it back up");
+
+        // With a text edit focused, `[` belongs to the field.
+        let mut text = String::new();
+        let field = egui::Id::unique("liquify-size-field");
+        let focused_frame = |app: &mut PhotocraftApp, text: &mut String, events: Vec<egui::Event>| {
+            let mut out = ctx.run_ui(egui::RawInput { events, ..Default::default() }, |ui| {
+                crate::shortcuts::handle(app, ui.ctx());
+                ui.add(egui::TextEdit::singleline(text).id(field)).request_focus();
+            });
+            out.textures_delta.clear();
+        };
+        focused_frame(&mut app, &mut text, Vec::new());
+        assert!(ctx.text_edit_focused());
+        let bracket = egui::Event::Key { key: egui::Key::OpenBracket, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE };
+        focused_frame(&mut app, &mut text, vec![bracket]);
+        assert_eq!(size(&app), 2.0, "the focused field keeps its keys");
+    }
+
     fn key(key: egui::Key) -> egui::Event {
         egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND }
     }
@@ -1792,8 +1882,11 @@ mod tests {
         let still = to_doc(d, area, at);
         assert!((still[0] - under[0]).abs() < 1e-3 && (still[1] - under[1]).abs() < 1e-3, "the point under the pointer stays: {under:?} → {still:?}");
 
+        // Animated Zoom off: a notch is one instant step, so one frame shows the whole ×1.1.
+        app.session.prefs.edit(|p| p.general.animated_zoom = false);
         let notch = ctx.options(|o| o.input_options.line_scroll_speed);
         let wheel = egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
             unit: egui::MouseWheelUnit::Line,
             delta: vec2(0.0, 1.0),
             modifiers: egui::Modifiers::NONE,
diff --git a/crates/ui-egui/src/mask_props_ui.rs b/crates/ui-egui/src/mask_props_ui.rs
index 9c74a8a18f..89e5ea4d3b 100644
--- a/crates/ui-egui/src/mask_props_ui.rs
+++ b/crates/ui-egui/src/mask_props_ui.rs
@@ -72,7 +72,7 @@ pub fn shape_properties(app: &mut PhotocraftApp, ui: &mut egui::Ui, layer: &Laye
 fn sliders(app: &mut PhotocraftApp, ui: &mut egui::Ui, layer: u64, document: u64, command: &str, prefix: &str, density: f32, feather: f32) {
     // Like brush settings, track pointer presses even on frames without a value change.
     // slider_row also merges numeric scrubbing, whose drag flags are not in its Response.
-    let key = ui.id().with("gesture");
+    let key = ui.scope_id().with("gesture");
     let pass = ui.ctx().cumulative_pass_nr();
     let pressed = ui.input(|i| i.pointer.any_pressed());
     let gesture = ui.data_mut(|d| {
diff --git a/crates/ui-egui/src/mask_thumbs_ui.rs b/crates/ui-egui/src/mask_thumbs_ui.rs
index 9e2d8e8210..c19b14928d 100644
--- a/crates/ui-egui/src/mask_thumbs_ui.rs
+++ b/crates/ui-egui/src/mask_thumbs_ui.rs
@@ -112,7 +112,7 @@ pub fn paint(
     for (kind, enabled, linked) in masks(l) {
         // The chain sits in the gap before the thumbnail, centred between the two.
         let chain = Rect::from_min_max(pos2(*x - 4.0, cy - ts / 2.0), pos2(*x - 4.0 + CHAIN_W, cy + ts / 2.0));
-        let resp = ui.interact(chain, ui.id().with(("mask-chain", l.id.0, kind == MaskKind::Vector)), Sense::click());
+        let resp = ui.interact(chain, ui.scope_id().with(("mask-chain", l.id.0, kind == MaskKind::Vector)), Sense::click());
         if linked {
             paint_chain(painter, chain.center(), if resp.hovered() { t.text } else { t.icon });
         } else if resp.hovered() {
@@ -122,11 +122,7 @@ pub fn paint(
         let resp = resp.on_hover_text(if linked { tl!("Unlink the mask from the layer") } else { tl!("Link the mask to the layer") });
         let template = "{verb} {mask} {layer}";
         resp.widget_info(|| {
-            egui::WidgetInfo::labeled(
-                egui::WidgetType::Button,
-                true,
-                crate::i18n::fmt(tl!(template), &[("verb", tl!(verb)), ("mask", tl!(what)), ("layer", &name)]),
-            )
+            egui::WidgetInfo::labeled(egui::Role::Button, true, crate::i18n::fmt(tl!(template), &[("verb", tl!(verb)), ("mask", tl!(what)), ("layer", &name)]))
         });
         if resp.clicked() {
             out.clicked = true;
@@ -175,7 +171,7 @@ type Rects = (Vec<(MaskKind, Rect)>, Vec<(MaskKind, Rect)>);
 
 /// Memory key of the per-layer record of where the mask thumbnails and chains were drawn.
 fn rects_id() -> egui::Id {
-    egui::Id::new("mask-thumb-rects")
+    egui::Id::unique("mask-thumb-rects")
 }
 
 /// The mask thumbnails and chains last drawn for layer `id` (for tests and automation).
@@ -255,7 +251,7 @@ pub fn paint_brackets(painter: &Painter, r: Rect, color: Color32) {
 }
 
 fn bracket_id() -> egui::Id {
-    egui::Id::new("layer-target-brackets")
+    egui::Id::unique("layer-target-brackets")
 }
 
 /// Where the target brackets were last drawn (for tests and automation).
diff --git a/crates/ui-egui/src/mask_thumbs_ui/tests.rs b/crates/ui-egui/src/mask_thumbs_ui/tests.rs
index 230d0add3a..f5ea5f9fc1 100644
--- a/crates/ui-egui/src/mask_thumbs_ui/tests.rs
+++ b/crates/ui-egui/src/mask_thumbs_ui/tests.rs
@@ -86,6 +86,28 @@ fn deleting_the_vector_mask_prunes_its_thumbnail() {
     assert!(!h.state().thumbs.contains_key(&key));
 }
 
+// Regression test for #119: the Layers panel's thumbnail textures of a deleted layer, and of
+// every layer of a closed document, were kept for the rest of the session.
+#[test]
+fn deleting_a_layer_or_closing_its_document_releases_the_thumbnails() {
+    let (s, masked, shape) = session();
+    let mut h = harness(s, 0, 1.0, 290.0);
+    let layer_key = |id: u64| (photocraft_doc::LayerId(id), crate::mask_thumbs_ui::THUMB_LAYER);
+    assert!(h.state().thumbs.contains_key(&layer_key(masked)) && h.state().thumbs.contains_key(&layer_key(shape)), "both rows drew a thumbnail");
+    let before = h.state().thumbs.len();
+
+    h.state_mut().run("layer.delete", json!({"layer": shape})).unwrap();
+    h.run_steps(3);
+    assert!(!h.state().thumbs.contains_key(&layer_key(shape)), "the deleted layer's thumbnail is released");
+    assert!(h.state().thumbs.contains_key(&layer_key(masked)), "the other layer keeps its thumbnail");
+    assert!(h.state().thumbs.len() < before);
+
+    h.state_mut().run("file.close", json!({})).unwrap();
+    h.run_steps(3);
+    assert!(h.state().session.documents().is_empty());
+    assert!(h.state().thumbs.is_empty(), "no thumbnails outlive their document: {:?}", h.state().thumbs.keys().collect::<Vec<_>>());
+}
+
 #[test]
 fn footer_trash_deletes_only_the_targeted_mask_linked_or_unlinked() {
     for linked in [true, false] {
@@ -417,7 +439,7 @@ fn paths_list_the_layer_path_above_a_bottom_footer() {
     let row = h.get_by_label("Masked Vector Mask").rect();
     let footer = crate::vector_ui::paths_footer(&h.ctx).expect("footer drawn");
     assert!(footer.top() > row.bottom(), "buttons below the rows");
-    let group = crate::dock::last_rects(&h.ctx).into_iter().find(|(g, _)| *g == crate::dock::Group::Layers).unwrap().1;
+    let group = crate::panel_docking::probe::group_rect(h.state(), &h.ctx, "paths").unwrap();
     assert!(group.bottom() - footer.bottom() < 16.0, "footer at the panel bottom: footer {footer:?}, group {group:?}");
     assert!(footer.bottom() - row.bottom() > 100.0, "the footer is pinned, not right below the rows");
     h.state_mut().run("layer.select", json!({"layer": shape})).unwrap();
@@ -627,6 +649,7 @@ fn mask_view_gestures_fail_gracefully_without_a_mask() {
     h.state_mut().session.active_mut().unwrap().channel_view.layer_mask = Some(photocraft_engine::mask_view_cmds::LayerMaskView {
         layer: photocraft_doc::LayerId(u64::MAX),
         mode: photocraft_engine::mask_view_cmds::MaskViewMode::Gray,
+        filter: false,
     });
     assert!(canvas_px(&h).is_none());
     h.run_steps(2);
diff --git a/crates/ui-egui/src/menu_keys.rs b/crates/ui-egui/src/menu_keys.rs
index 20eed5b1fe..2f563f9771 100644
--- a/crates/ui-egui/src/menu_keys.rs
+++ b/crates/ui-egui/src/menu_keys.rs
@@ -1,6 +1,6 @@
 //! The menu bar from the keyboard (#4988), as Photoshop's on Windows: a tap on Alt (or F10)
-//! puts the keyboard on the bar (File lit; ← / → move along it, ↓ / ↩ / Space open the lit menu,
-//! Esc or a click leaves), Alt+letter opens the menu with that mnemonic straight away, and in an
+//! puts the keyboard on the bar (File lit; ← / → move along it, ↓ / ↩ open the lit menu,
+//! Esc, Space or a click leaves), Alt+letter opens the menu with that mnemonic straight away, and in an
 //! open menu a letter runs the row with that mnemonic (or opens its submenu).
 //!
 //! Mnemonics are underlined while Alt is held, the bar is focused or a menu was opened from the
@@ -51,11 +51,11 @@ pub struct Keys {
 }
 
 fn keys_id() -> Id {
-    Id::new("pc-menu-bar-keys")
+    Id::unique("pc-menu-bar-keys")
 }
 
 fn focus_id() -> Id {
-    Id::new("pc-menu-bar-focus")
+    Id::unique("pc-menu-bar-focus")
 }
 
 /// Is the keyboard on the menu bar (no menu open yet)? The shortcuts leave the keys to it then,
@@ -408,8 +408,13 @@ impl Keys {
             self.focus = Some((focus + 1) % n);
         } else if press(Key::ArrowLeft) {
             self.focus = Some((focus + n - 1) % n);
-        } else if press(Key::ArrowDown) || press(Key::Enter) || press(Key::Space) {
+        } else if press(Key::ArrowDown) || press(Key::Enter) {
             open_top(focus, self);
+        } else if events.iter().any(|e| matches!(e, Event::Key { key: Key::Space, pressed: true, .. })) {
+            // Space is the Hand tool, and on Windows it opens the window menu there, never File:
+            // it takes the keyboard off the bar, so a stray Alt tap can't have held Space run
+            // File › New….
+            self.focus = None;
         } else if let Some((key, c)) = events.iter().find_map(|e| match e {
             Event::Key { key, pressed: true, modifiers, .. } if modifiers.is_none() => key_char(*key).map(|c| (*key, c)),
             _ => None,
diff --git a/crates/ui-egui/src/menu_keys_tests.rs b/crates/ui-egui/src/menu_keys_tests.rs
index 0ac4533b26..1fcde2bd54 100644
--- a/crates/ui-egui/src/menu_keys_tests.rs
+++ b/crates/ui-egui/src/menu_keys_tests.rs
@@ -85,6 +85,7 @@ fn alt_with_a_wheel_scroll_or_a_lost_focus_is_no_tap() {
     h.run_steps(2);
     h.event_modifiers(
         egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
             unit: egui::MouseWheelUnit::Line,
             delta: egui::vec2(0.0, -1.0),
             phase: egui::TouchPhase::Move,
@@ -123,6 +124,7 @@ fn a_held_alt_repeating_after_the_wheel_is_no_tap() {
     h.run_steps(2);
     h.event_modifiers(
         egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Wheel,
             unit: egui::MouseWheelUnit::Line,
             delta: egui::vec2(0.0, 1.0),
             modifiers: egui::Modifiers::ALT,
@@ -150,6 +152,25 @@ fn a_held_alt_repeating_after_the_wheel_is_no_tap() {
     assert_eq!(Keys::current(&h.ctx).focus, Some(0), "a long press of Alt alone focuses the bar");
 }
 
+/// A stray Alt tap (a second, quick one after Alt+scroll) focuses the bar; Space for the hand
+/// tool then takes the keyboard off it instead of opening File, where held Space ran New….
+#[test]
+fn space_on_the_focused_bar_leaves_it_and_opens_no_menu() {
+    let mut h = bar();
+    alt_tap(&mut h);
+    assert_eq!(Keys::current(&h.ctx).focus, Some(0), "the tap focuses the bar");
+    h.key_down(egui::Key::Space);
+    h.run_steps(2);
+    // Held Space repeats, which ran New… from the open File menu.
+    h.event(egui::Event::Key { key: egui::Key::Space, physical_key: None, pressed: true, repeat: true, modifiers: egui::Modifiers::NONE });
+    h.run_steps(2);
+    assert!(!is_open(&h.ctx), "Space opens no menu");
+    assert!(h.state().ui.dialogs.is_empty(), "Space does not run File › New");
+    assert_eq!(Keys::current(&h.ctx).focus, None, "Space takes the keyboard off the bar");
+    h.key_up(egui::Key::Space);
+    h.run_steps(3);
+}
+
 #[test]
 fn a_second_alt_or_esc_or_a_click_takes_the_keyboard_off_the_bar() {
     let mut h = bar();
diff --git a/crates/ui-egui/src/menu_nav.rs b/crates/ui-egui/src/menu_nav.rs
index 93b29ce7d9..9f5de15c46 100644
--- a/crates/ui-egui/src/menu_nav.rs
+++ b/crates/ui-egui/src/menu_nav.rs
@@ -93,11 +93,11 @@ pub struct Nav {
 }
 
 fn nav_id() -> Id {
-    Id::new("pc-menu-nav")
+    Id::unique("pc-menu-nav")
 }
 
 fn open_id() -> Id {
-    Id::new("pc-menu-open")
+    Id::unique("pc-menu-open")
 }
 
 /// Is one of the menu bar's menus open? (Shortcuts leave the keys to it meanwhile.)
@@ -462,14 +462,14 @@ pub fn level_room_in(screen: Rect, visible: Rect, bar_bottom: Option<f32>, depth
 pub fn level(ui: &mut Ui, depth: usize, nav: &mut Nav, rows: impl FnOnce(&mut Ui, &mut Nav)) {
     let ctx = ui.ctx().clone();
     let level = depth.saturating_sub(1);
-    nav.begin_level(level, find_menu_root(ui).id);
+    nav.begin_level(level, find_menu_root(ui).scope_id);
     let screen = ctx.content_rect();
     // Only the part of the window on its monitor, clear of the taskbar, can be seen (#315).
     let visible = crate::work_area::visible_rect(&ctx);
     // The menu frame's margin and stroke around the rows.
     let frame = ui.spacing().menu_margin.sum().y + 2.0;
     let anchor = nav.anchors.get(level).copied().flatten();
-    let key = ui.id().with(("pc-menu-level", depth));
+    let key = ui.scope_id().with(("pc-menu-level", depth));
     // Rows' height from the last frame: does this level overflow?
     let content: Option<f32> = ctx.data(|d| d.get_temp(key));
     let room = level_room_in(screen, visible, nav.bar_bottom, depth, anchor, content, frame);
@@ -481,12 +481,18 @@ pub fn level(ui: &mut Ui, depth: usize, nav: &mut Nav, rows: impl FnOnce(&mut Ui
     // pt, on the first): a scroll area never grows past that, so every menu stuck at that height
     // and scrolled even on a tall window (#235). Ask for the room the window has; auto-shrink then
     // fits the area to its rows, so a menu scrolls only when they don't fit.
-    let out = egui::ScrollArea::vertical()
+    // egui 0.37 made `ScrollAreaState::offset` private: a scroll target requested by last
+    // frame's arrows is applied through the builder instead of writing the stored state.
+    let mut area = egui::ScrollArea::vertical()
         .id_salt(("menu-level", depth))
         .max_height(height)
         .min_scrolled_height(height)
-        .scroll_source(egui::containers::scroll_area::ScrollSource::ALL)
-        .show(ui, |ui| rows(ui, nav));
+        .scroll_source(egui::containers::scroll_area::ScrollSource::ALL);
+    if let Some(target) = ctx.data(|d| d.get_temp::<f32>(scroll_request_id(key))) {
+        area = area.vertical_scroll_offset(target);
+    }
+    let out = area.show(ui, |ui| rows(ui, nav));
+    ctx.data_mut(|d| d.remove_temp::<f32>(scroll_request_id(key)));
     let down = over.then(|| ui.allocate_exact_size(vec2(0.0, ARROW), Sense::hover()).0);
     ctx.data_mut(|d| d.insert_temp(key, out.content_size.y));
     if let Some(v) = nav.views.get_mut(level) {
@@ -505,7 +511,7 @@ pub fn level(ui: &mut Ui, depth: usize, nav: &mut Nav, rows: impl FnOnce(&mut Ui
     let t = crate::theme::Tokens::get(&ctx);
     let x = ui.min_rect().x_range();
     let max = (out.content_size.y - out.inner_rect.height()).max(0.0);
-    let offset = out.state.offset.y;
+    let offset = out.state.clamped_offset().y;
     let dt = ctx.input(|i| i.stable_dt).clamp(0.0, 0.1);
     let mut target = offset;
     for (strip, dir, live) in [(up, -1.0, offset > 0.5), (down, 1.0, offset < max - 0.5)] {
@@ -521,7 +527,7 @@ pub fn level(ui: &mut Ui, depth: usize, nav: &mut Nav, rows: impl FnOnce(&mut Ui
         let id = key.with(dir < 0.0);
         let r = ui.interact(strip, id, Sense::hover());
         let label = if dir < 0.0 { "Scroll menu up" } else { "Scroll menu down" };
-        r.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, live, tl!(label)));
+        r.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, live, tl!(label)));
         if live && pointer_on(ui, strip) {
             target = (offset + dir * SPEED * dt.max(1.0 / 120.0)).clamp(0.0, max);
             ctx.request_repaint();
@@ -535,12 +541,17 @@ pub fn level(ui: &mut Ui, depth: usize, nav: &mut Nav, rows: impl FnOnce(&mut Ui
         }
     }
     if target != offset {
-        let mut st = out.state;
-        st.offset.y = target;
-        st.store(&ctx, out.id);
+        // Applied to the scroll area on its next frame (egui 0.37 keeps the offset private).
+        ctx.data_mut(|d| d.insert_temp(scroll_request_id(key), target));
+        ctx.request_repaint();
     }
 }
 
+/// The temp key that carries an arrow/wheel scroll target to the next `ScrollArea` build.
+fn scroll_request_id(key: egui::Id) -> egui::Id {
+    key.with("scroll-request")
+}
+
 #[cfg(test)]
 #[path = "menu_nav_tests.rs"]
 mod tests;
diff --git a/crates/ui-egui/src/menu_nav_tests.rs b/crates/ui-egui/src/menu_nav_tests.rs
index 87c5498f7d..24fa76e166 100644
--- a/crates/ui-egui/src/menu_nav_tests.rs
+++ b/crates/ui-egui/src/menu_nav_tests.rs
@@ -45,6 +45,7 @@ fn reported_menus_stay_above_the_panel_when_the_window_position_is_unknown() {
                     break;
                 }
                 h.event(egui::Event::MouseWheel {
+                    source: egui::MouseWheelSource::Unknown,
                     unit: egui::MouseWheelUnit::Point,
                     delta: egui::vec2(0.0, -60.0),
                     modifiers: egui::Modifiers::NONE,
@@ -164,6 +165,7 @@ fn the_mouse_wheel_scrolls_a_long_menu() {
                 break;
             }
             h.event(egui::Event::MouseWheel {
+                source: egui::MouseWheelSource::Unknown,
                 unit: egui::MouseWheelUnit::Point,
                 delta: egui::vec2(0.0, -60.0),
                 modifiers: egui::Modifiers::NONE,
@@ -271,9 +273,9 @@ fn left_and_right_switch_menus_and_shortcuts_wait_while_one_is_open() {
 fn help_search_keeps_the_arrows_and_space_that_edit_it() {
     let mut h = harness((1280.0, 720.0, 1.0));
     open(&mut h, "Help");
-    let field = egui::Id::new("help-menu-search").with("field");
+    let field = egui::Id::unique("help-menu-search").with("field");
     assert_eq!(h.ctx.memory(|m| m.focused()), Some(field), "the search field has the keyboard");
-    let text = |h: &Harness<'static, PhotocraftApp>| h.ctx.data(|d| d.get_temp::<String>(egui::Id::new("help-menu-search"))).unwrap_or_default();
+    let text = |h: &Harness<'static, PhotocraftApp>| h.ctx.data(|d| d.get_temp::<String>(egui::Id::unique("help-menu-search"))).unwrap_or_default();
     let typing = |h: &mut Harness<'static, PhotocraftApp>, s: &str| {
         h.event(egui::Event::Text(s.to_string()));
         h.run_steps(3);
@@ -411,6 +413,7 @@ fn a_short_window_still_scrolls_the_file_menu_to_its_last_row() {
             break;
         }
         h.event(egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
             unit: egui::MouseWheelUnit::Point,
             delta: egui::vec2(0.0, -60.0),
             modifiers: egui::Modifiers::NONE,
@@ -565,6 +568,7 @@ fn menus_stay_above_the_taskbar_and_scroll_to_their_last_row() {
             h.hover_at(view.center());
             for _ in 0..60 {
                 h.event(egui::Event::MouseWheel {
+                    source: egui::MouseWheelSource::Unknown,
                     unit: egui::MouseWheelUnit::Point,
                     delta: egui::vec2(0.0, 120.0),
                     modifiers: egui::Modifiers::NONE,
@@ -932,6 +936,7 @@ fn a_scrolled_menu_reopens_and_stays_open_with_a_hidden_submenu_row_under_its_ti
         h.hover_at(egui::pos2(view.center().x, view.bottom() - 2.0));
         let wheel = |h: &mut Harness<'static, PhotocraftApp>, dy: f32| {
             h.event(egui::Event::MouseWheel {
+                source: egui::MouseWheelSource::Unknown,
                 unit: egui::MouseWheelUnit::Point,
                 delta: egui::vec2(0.0, dy),
                 modifiers: Modifiers::NONE,
diff --git a/crates/ui-egui/src/menus.rs b/crates/ui-egui/src/menus.rs
index 0663f43ef7..07df45a66a 100644
--- a/crates/ui-egui/src/menus.rs
+++ b/crates/ui-egui/src/menus.rs
@@ -7,10 +7,11 @@ use crate::state::DialogKind;
 
 /// Shared gate for native menu clicks and control-channel `ui.menu.invoke`.
 /// Dialogs and unsaved-changes prompts block edits, but allow the four view-navigation
-/// commands also usable through shortcuts. Camera Raw blocks menu commands entirely, and a pending
-/// crop blocks the commands Photoshop greys during one (`crop_ui::blocks`).
+/// commands also usable through shortcuts. Camera Raw and the full-window workspaces
+/// (`distort_ui::modal_workspace`) block menu commands entirely, and a pending crop blocks the
+/// commands Photoshop greys during one (`crop_ui::blocks`).
 pub(crate) fn modal_allows(app: &PhotocraftApp, id: &str) -> bool {
-    if app.camera_raw.is_some() || crate::crop_ui::blocks(app, id) {
+    if app.camera_raw.is_some() || crate::distort_ui::modal_workspace(app).is_some() || crate::crop_ui::blocks(app, id) {
         return false;
     }
     (app.ui.dialogs.is_empty() && app.ui.layers_panel_dialog.is_none() && app.discard.is_none()) || crate::shortcuts::NAV_COMMANDS.contains(&id)
@@ -730,8 +731,17 @@ pub fn is_enabled(app: &PhotocraftApp, id: &str) -> bool {
         return e;
     }
     match id {
-        "window.panel.activate" | "window.panel.layout" => true,
-        "window.panel.group" | "window.panel.move" | "window.panel.float" | "window.panel.dock" | "window.panel.close" => !app.session.prefs().workspace_locked,
+        "window.panel.activate" | "window.panel.layout" | "ui.dock" => true,
+        "window.panel.group"
+        | "window.panel.move"
+        | "window.panel.float"
+        | "window.panel.window"
+        | "window.panel.dock"
+        | "window.panel.close"
+        | "window.panel.closeGroup"
+        | "window.panel.closeOthers"
+        | "window.panel.minimize"
+        | "window.panel.iconic" => !app.session.prefs().workspace_locked,
         "file.open" | "file.exit" | "file.clearRecent" | "file.removeRecent" | "help.about" | "help.systemInfo" | "edit.search" => true,
         i if i.starts_with("file.openRecent.") => true,
         i if i.starts_with(DOCUMENT_ITEM) => true,
@@ -1323,7 +1333,7 @@ pub fn menu_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> f32 {
 }
 
 fn press_gesture_id() -> egui::Id {
-    egui::Id::new("menu-press-gesture")
+    egui::Id::unique("menu-press-gesture")
 }
 
 /// A menu title's open/close command this frame, the press opens a closed menu (and
@@ -1431,7 +1441,7 @@ pub fn search_items<'a>(items: &'a [MenuItem], query: &str, lang: crate::i18n::L
 fn help_search(ui: &mut egui::Ui, items: &[MenuItem], opening: bool, clicked: &mut Option<String>, nav: &mut crate::menu_nav::Nav) {
     let ctx = ui.ctx().clone();
     let lang = crate::i18n::current();
-    let text_id = egui::Id::new("help-menu-search");
+    let text_id = egui::Id::unique("help-menu-search");
     let pass_id = text_id.with("pass");
     // A fresh opening of the Help menu starts empty, with the field focused.
     let pass = ctx.cumulative_pass_nr();
@@ -1600,7 +1610,7 @@ fn submenu_row<R>(ui: &mut egui::Ui, title: egui::WidgetText, content: impl FnOn
     if open {
         ui.style_mut().visuals.widgets.inactive = ui.style().visuals.widgets.open;
     }
-    let response = ui.add(egui::Button::new(title).right_text(SubMenuButton::RIGHT_ARROW));
+    let response = ui.add(egui::Button::new(title).right_text(SubMenuButton::arrow_atom(None)));
     ui.style_mut().visuals.widgets.inactive = inactive;
     // The rect egui tests the pointer against (`SubMenu::show`), against the part that can be seen.
     let reach = response.rect.expand2(ui.spacing().item_spacing / 2.0);
@@ -1638,7 +1648,8 @@ pub fn apply_workspace(app: &mut PhotocraftApp) {
     app.ui.docking_reveal = None;
     app.ui.docking_generation = app.ui.docking_generation.wrapping_add(1);
     app.ui.docking = None;
-    app.ui.docking_hidden.clear();
+    app.ui.docking_kept = None;
+    app.ui.docking_returns.clear();
     app.ui.docking_collapsed.clear();
     app.ui.dock_tabs = Default::default();
     let p = &mut app.ui.panels;
@@ -1839,12 +1850,15 @@ mod tests {
                 egui::CentralPanel::default().show(ui, |ui| {
                     let (rect, _) = ui.allocate_exact_size(egui::vec2(80.0, 24.0), egui::Sense::hover());
                     let shifted = rect.translate(egui::vec2(p.x - rect.center().x, p.y - rect.center().y));
-                    let response = ui.interact(shifted, egui::Id::new("menu-title-test"), egui::Sense::hover());
+                    let response = ui.interact(shifted, egui::Id::unique("menu-title-test"), egui::Sense::hover());
                     title = Some(response);
                 });
-                egui::Area::new(egui::Id::new("overlapping-popup-test")).order(egui::Order::Foreground).fixed_pos(p - egui::vec2(10.0, 10.0)).show(ctx, |ui| {
-                    ui.allocate_space(egui::vec2(20.0, 20.0));
-                });
+                egui::Area::new(egui::Id::unique("overlapping-popup-test")).order(egui::Order::Foreground).fixed_pos(p - egui::vec2(10.0, 10.0)).show(
+                    ctx,
+                    |ui| {
+                        ui.allocate_space(egui::vec2(20.0, 20.0));
+                    },
+                );
                 let response = title.as_ref().unwrap();
                 reaches = pointer_reaches_title(ctx, response, p);
             });
@@ -2010,7 +2024,7 @@ mod tests {
                 h.run_steps(3);
             };
             let open = |h: &Harness<'_, PhotocraftApp>| h.query_by_label_contains("About PhotoCraft").is_some();
-            let field_id = egui::Id::new("help-menu-search").with("field");
+            let field_id = egui::Id::unique("help-menu-search").with("field");
             let help = h.get_by_label("Help").rect().center();
             click(&mut h, help);
             assert!(open(&h), "Help opened ({what})");
@@ -2062,7 +2076,7 @@ mod tests {
         }
         h.run_steps(3);
         assert!(h.query_by_label_contains("About PhotoCraft").is_some(), "typing keeps Help open");
-        let query: String = h.ctx.data(|d| d.get_temp(egui::Id::new("help-menu-search"))).unwrap_or_default();
+        let query: String = h.ctx.data(|d| d.get_temp(egui::Id::unique("help-menu-search"))).unwrap_or_default();
         assert_eq!(query, "DeSelect all", "every letter reached the field");
         assert!(h.state().ui.dialogs.is_empty(), "no menu command ran: {:?}", h.state().ui.dialogs);
     }
@@ -2143,6 +2157,7 @@ mod tests {
         let before = item.rect().top();
         harness.hover_at(item.rect().center());
         harness.event(egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
             unit: egui::MouseWheelUnit::Point,
             delta: egui::vec2(0.0, -80.0),
             phase: egui::TouchPhase::Move,
diff --git a/crates/ui-egui/src/move_auto_select_tests.rs b/crates/ui-egui/src/move_auto_select_tests.rs
index 403ab28cd1..91eb91e5d3 100644
--- a/crates/ui-egui/src/move_auto_select_tests.rs
+++ b/crates/ui-egui/src/move_auto_select_tests.rs
@@ -146,7 +146,7 @@ fn every_theme_shows_the_auto_select_toggle() {
         PhotocraftApp::setup_context(&h.ctx, theme);
         h.run_steps(4);
         assert!(h.state().ui.tool_options.move_auto_select);
-        h.get_by_label("Auto-Select:").click();
+        h.get_by_role_and_label(egui::accesskit::Role::CheckBox, "Auto-Select:").click();
         h.run_steps(2);
         assert!(!h.state().ui.tool_options.move_auto_select, "{theme:?}: the toggle turns Auto-Select off");
     }
diff --git a/crates/ui-egui/src/native_menu.rs b/crates/ui-egui/src/native_menu.rs
index 2beef91f94..6a1426f39b 100644
--- a/crates/ui-egui/src/native_menu.rs
+++ b/crates/ui-egui/src/native_menu.rs
@@ -760,7 +760,7 @@ pub(crate) fn state_hash(app: &PhotocraftApp, input: Option<u64>) -> u64 {
     }
     let ui = &app.ui;
     (&ui.recent_files, &ui.workspace, ui.palette_open, ui.transform.is_some(), ui.text_edit.is_some(), ui.dialogs.len()).hash(&mut h);
-    (app.discard.is_some(), app.camera_raw.is_some()).hash(&mut h);
+    (app.discard.is_some(), app.camera_raw.is_some(), crate::distort_ui::modal_workspace(app)).hash(&mut h);
     serde_json::to_string(&(&ui.panels, &ui.extras, &ui.view, ui.theme, ui.tool)).unwrap_or_default().hash(&mut h);
     s.prefs().interface.language.hash(&mut h);
     h.finish()
@@ -1258,4 +1258,17 @@ mod tests {
             assert_eq!(native[i] + 1, in_window[i], "{title}: {} in-window, {} with the Mac menu bar", in_window[i], native[i]);
         }
     }
+
+    #[test]
+    fn opening_or_closing_a_workspace_without_input_rebuilds_the_menus() {
+        let mut app = app(true);
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("edit.fill", json!({"color": "#808080"})).unwrap();
+        let closed = state_hash(&app, None);
+        crate::gallery_ui::open(&mut app).unwrap();
+        let open = state_hash(&app, None);
+        assert_ne!(open, closed, "the menus grey out when an agent opens Filter Gallery");
+        app.distort.gallery = None;
+        assert_eq!(state_hash(&app, None), closed, "and come back when it is cancelled");
+    }
 }
diff --git a/crates/ui-egui/src/new_doc_ui.rs b/crates/ui-egui/src/new_doc_ui.rs
index 0fb7b7b21f..7174fd0d43 100644
--- a/crates/ui-egui/src/new_doc_ui.rs
+++ b/crates/ui-egui/src/new_doc_ui.rs
@@ -647,7 +647,7 @@ pub fn body(app: &mut crate::PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Strin
             // Keep the canonical English default in state; only the TextEdit shows a translation.
             let raw = get_s(f, "name", "Untitled-1");
             let mut name = if raw == "Untitled-1" { tl!("Untitled-1").to_string() } else { raw };
-            let r = ui.add(egui::TextEdit::singleline(&mut name).desired_width(250.0).font(egui::FontId::proportional(15.0)));
+            let r = ui.add(egui::TextEdit::singleline(&mut name).desired_width(250.0).font(egui::FontId::proportional(15.0))).accessible_name(tl!("Name"));
             if r.changed() {
                 f.insert("name".into(), json!(name));
             }
@@ -669,11 +669,12 @@ pub fn body(app: &mut crate::PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Strin
             small_label(ui, tl!("Width"));
             ui.horizontal(|ui| {
                 let mut w = shown_size(f, "width", 1920.0, &unit, ppi);
-                if widgets::value_field_units(ui, &mut w, 0.0..=300_000.0, 110.0, widgets::unit_decimals(&unit), units).changed() {
+                if widgets::value_field_units(ui, &mut w, 0.0..=300_000.0, 110.0, widgets::unit_decimals(&unit), units).accessible_name(tl!("Width")).changed()
+                {
                     set_size(f, "width", w, &unit, ppi);
                 }
                 let opts: Vec<(String, &str)> = UNITS.iter().map(|u| (u.0.to_string(), u.1)).collect();
-                if widgets::dropdown(ui, "nd-unit", &mut unit, &opts, 120.0) {
+                if widgets::dropdown(ui, "nd-unit", tl!("Units"), &mut unit, &opts, 120.0) {
                     f.insert("__unit".into(), json!(unit));
                     f.remove("__savedPreset");
                 }
@@ -681,7 +682,8 @@ pub fn body(app: &mut crate::PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Strin
             small_label(ui, tl!("Height"));
             ui.horizontal(|ui| {
                 let mut h = shown_size(f, "height", 1080.0, &unit, ppi);
-                if widgets::value_field_units(ui, &mut h, 0.0..=300_000.0, 110.0, widgets::unit_decimals(&unit), units).changed() {
+                if widgets::value_field_units(ui, &mut h, 0.0..=300_000.0, 110.0, widgets::unit_decimals(&unit), units).accessible_name(tl!("Height")).changed()
+                {
                     set_size(f, "height", h, &unit, ppi);
                 }
                 ui.add_space(6.0);
@@ -699,17 +701,28 @@ pub fn body(app: &mut crate::PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Strin
                     }
                 }
             });
+            // Under Orientation, as in Photoshop: the document starts as one artboard (#9086).
+            let mut artboard = f.get("artboard").and_then(Value::as_bool).unwrap_or(false);
+            if widgets::checkbox(ui, &mut artboard, tl!("Artboards")).changed() {
+                f.insert("artboard".into(), json!(artboard));
+            }
             ui.add_space(4.0);
             small_label(ui, tl!("Resolution"));
             ui.horizontal(|ui| {
                 let per_cm = get_s(f, "__resUnit", "in") == "cm";
                 let mut r = if per_cm { ppi / 2.54 } else { ppi };
-                if widgets::value_field(ui, &mut r, 1.0..=30_000.0, "", 110.0).changed() {
+                if widgets::value_field(ui, &mut r, 1.0..=30_000.0, "", 110.0).accessible_name(tl!("Resolution")).changed() {
                     set_resolution(f, if per_cm { r * 2.54 } else { r });
                 }
                 let mut ru = get_s(f, "__resUnit", "in");
-                if widgets::dropdown(ui, "nd-resunit", &mut ru, &[("in".to_string(), tl!("Pixels/Inch")), ("cm".to_string(), tl!("Pixels/Centimeter"))], 120.0)
-                {
+                if widgets::dropdown(
+                    ui,
+                    "nd-resunit",
+                    tl!("Resolution"),
+                    &mut ru,
+                    &[("in".to_string(), tl!("Pixels/Inch")), ("cm".to_string(), tl!("Pixels/Centimeter"))],
+                    120.0,
+                ) {
                     f.insert("__resUnit".into(), json!(ru));
                     f.remove("__savedPreset");
                 }
@@ -721,6 +734,7 @@ pub fn body(app: &mut crate::PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Strin
                 if widgets::dropdown(
                     ui,
                     "nd-mode",
+                    tl!("Color Mode"),
                     &mut mode,
                     &[
                         ("gray".to_string(), tl!("Grayscale")),
@@ -737,7 +751,7 @@ pub fn body(app: &mut crate::PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Strin
                 }
                 let mut depth = f.get("depth").and_then(Value::as_u64).unwrap_or(8);
                 let depth_options: Vec<(u64, &str, &str)> = DEPTH_OPTIONS.iter().map(|(bits, label, tooltip)| (*bits, *label, *tooltip)).collect();
-                if widgets::dropdown_with_tooltips(ui, "nd-depth", &mut depth, &depth_options, 120.0) {
+                if widgets::dropdown_with_tooltips(ui, "nd-depth", tl!("Depth"), &mut depth, &depth_options, 120.0) {
                     f.insert("depth".into(), json!(depth));
                     f.remove("__savedPreset");
                 }
@@ -759,7 +773,7 @@ pub fn body(app: &mut crate::PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Strin
                     f.remove("profile");
                 }
                 let shown: Vec<(String, &str)> = opts.iter().map(|(v, l)| (v.clone(), l.as_str())).collect();
-                if widgets::dropdown(ui, "nd-profile", &mut profile, &shown, 240.0) {
+                if widgets::dropdown(ui, "nd-profile", tl!("Color Profile"), &mut profile, &shown, 240.0) {
                     if profile == "working" {
                         f.remove("profile");
                     } else {
@@ -783,7 +797,7 @@ pub fn body(app: &mut crate::PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Strin
             let shown = background_rgb(app, f);
             let mut pick = false;
             ui.horizontal(|ui| {
-                if widgets::dropdown(ui, "nd-bg", &mut bg, &opts, 240.0 - SWATCH - 6.0) {
+                if widgets::dropdown(ui, "nd-bg", tl!("Background"), &mut bg, &opts, 240.0 - SWATCH - 6.0) {
                     if bg == CUSTOM {
                         // Custom… opens the Color Picker on the colour shown so far.
                         pick = true;
@@ -810,7 +824,7 @@ pub fn body(app: &mut crate::PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<Strin
                 }
                 ui.painter().rect_stroke(r, 2.0, Stroke::new(1.0, Tokens::get(ui.ctx()).field_border), StrokeKind::Inside);
                 let resp = resp.on_hover_text(tl!("Custom background color")).on_hover_cursor(egui::CursorIcon::PointingHand);
-                resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Custom background color")));
+                resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Custom background color")));
                 if resp.clicked() {
                     pick = true;
                     f.remove("__savedPreset");
@@ -881,6 +895,21 @@ mod tests {
         assert_eq!(f["profile"], "coated-cmyk");
     }
 
+    /// #9086: the Artboards checkbox's field reaches `file.new`, which starts the document as one
+    /// artboard; the dialog's own `__` keys don't.
+    #[test]
+    fn the_artboards_box_creates_an_artboard_document() {
+        let mut s = photocraft_engine::Session::new();
+        let mut f = Map::new();
+        for (k, v) in [("width", json!(64)), ("height", json!(48)), ("artboard", json!(true)), ("__orientation", json!("landscape"))] {
+            f.insert(k.into(), v);
+        }
+        s.execute("file.new", command_params(&f)).unwrap();
+        let doc = &s.active().unwrap().doc;
+        assert_eq!(doc.artboards().len(), 1);
+        assert_eq!(doc.artboards()[0].2.rect, doc.bounds());
+    }
+
     #[test]
     fn units_round_trip_through_pixels() {
         assert_eq!(to_unit(2100.0, "in", 300.0), 7.0);
diff --git a/crates/ui-egui/src/new_guide_ui.rs b/crates/ui-egui/src/new_guide_ui.rs
index 07a8aef7b5..8657576b57 100644
--- a/crates/ui-egui/src/new_guide_ui.rs
+++ b/crates/ui-egui/src/new_guide_ui.rs
@@ -163,15 +163,15 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
             ui.radio_value(&mut orientation, "vertical".to_string(), tl!("Vertical"));
         });
         ui.end_row();
-        ui.label(tl!("Position"));
-        ui.add(egui::TextEdit::singleline(&mut position).desired_width(120.0));
+        let position_label = ui.label(tl!("Position"));
+        ui.add(egui::TextEdit::singleline(&mut position).desired_width(120.0)).labelled_by(position_label.id);
         ui.end_row();
         ui.label(tl!("Color"));
         ui.horizontal(|ui| {
             // Custom… first, then Photoshop's colours.
             let options: Vec<(String, &str)> =
                 std::iter::once(CUSTOM).chain(GUIDE_COLORS.iter().map(|(n, ..)| *n)).map(|n| (n.to_string(), color_label(n))).collect();
-            crate::widgets::dropdown(ui, "new-guide-color", &mut color, &options, 140.0);
+            crate::widgets::dropdown(ui, "new-guide-color", tl!("Color"), &mut color, &options, 140.0);
             if color == CUSTOM {
                 let hex = custom_color(f);
                 let rgb = photocraft_engine::prefs::parse_hex(&hex).unwrap_or([0x4a, 0xff, 0xff]);
diff --git a/crates/ui-egui/src/new_layer_ui.rs b/crates/ui-egui/src/new_layer_ui.rs
index af051adbb0..9f7281def0 100644
--- a/crates/ui-egui/src/new_layer_ui.rs
+++ b/crates/ui-egui/src/new_layer_ui.rs
@@ -72,12 +72,12 @@ pub fn neutral_label(mode: BlendMode) -> String {
 pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
     let label_width = 64.0;
     let row_label = |ui: &mut egui::Ui, text: &str| {
-        ui.allocate_ui_with_layout(egui::vec2(label_width, 22.0), egui::Layout::right_to_left(egui::Align::Center), |ui| ui.label(text));
+        ui.allocate_ui_with_layout(egui::vec2(label_width, 22.0), egui::Layout::right_to_left(egui::Align::Center), |ui| ui.label(text)).inner
     };
     ui.horizontal(|ui| {
-        row_label(ui, tl!("Name:"));
+        let name_label = row_label(ui, tl!("Name:"));
         let mut name = f.get("name").and_then(Value::as_str).unwrap_or("").to_string();
-        let field = ui.add(egui::TextEdit::singleline(&mut name).desired_width(260.0));
+        let field = ui.add(egui::TextEdit::singleline(&mut name).desired_width(260.0)).labelled_by(name_label.id);
         if field.changed() {
             f.insert("name".into(), json!(name));
         }
@@ -99,7 +99,7 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
         row_label(ui, tl!("Color:"));
         let mut color = f.get("color").and_then(Value::as_str).and_then(LabelColor::from_id).unwrap_or_default();
         let options: Vec<(LabelColor, &str)> = LabelColor::ALL.into_iter().map(|c| (c, crate::layer_menu_ui::color_name(c))).collect();
-        if crate::widgets::dropdown(ui, "new-layer-color", &mut color, &options, 140.0) {
+        if crate::widgets::dropdown(ui, "new-layer-color", tl!("Color"), &mut color, &options, 140.0) {
             f.insert("color".into(), json!(color.id()));
         }
     });
@@ -107,13 +107,13 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
     ui.horizontal(|ui| {
         row_label(ui, tl!("Mode:"));
         let options: Vec<(BlendMode, &str)> = BlendMode::LAYER_MODES.into_iter().map(|m| (m, m.label())).collect();
-        if crate::widgets::dropdown(ui, "new-layer-mode", &mut m, &options, 140.0) {
+        if crate::widgets::dropdown(ui, "new-layer-mode", tl!("Mode"), &mut m, &options, 140.0) {
             f.insert("mode".into(), json!(m.label()));
         }
         ui.add_space(8.0);
         ui.label(tl!("Opacity:"));
         let mut o = f.get("opacity").and_then(Value::as_f64).unwrap_or(100.0) as f32;
-        if crate::widgets::value_field(ui, &mut o, 0.0..=100.0, "%", 64.0).changed() {
+        if crate::widgets::value_field(ui, &mut o, 0.0..=100.0, "%", 64.0).accessible_name(tl!("Opacity:")).changed() {
             f.insert("opacity".into(), json!(o.clamp(0.0, 100.0)));
         }
     });
diff --git a/crates/ui-egui/src/notices.rs b/crates/ui-egui/src/notices.rs
index 79e4dad3db..52597597a8 100644
--- a/crates/ui-egui/src/notices.rs
+++ b/crates/ui-egui/src/notices.rs
@@ -221,7 +221,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let t = crate::theme::Tokens::get(ctx);
     let mut dismiss_id = None;
     // Clear the status bar (~24 px) and leave the dock's edge some air.
-    let area = egui::Area::new(egui::Id::new("photocraft-notices"))
+    let area = egui::Area::new(egui::Id::unique("photocraft-notices"))
         .order(egui::Order::Foreground)
         .anchor(egui::Align2::RIGHT_BOTTOM, egui::vec2(-16.0, -36.0))
         .interactable(true)
diff --git a/crates/ui-egui/src/numeric_expression.rs b/crates/ui-egui/src/numeric_expression.rs
index 6c7f96393c..2d2d35cb44 100644
--- a/crates/ui-egui/src/numeric_expression.rs
+++ b/crates/ui-egui/src/numeric_expression.rs
@@ -309,7 +309,7 @@ mod widget_tests {
     fn typed_expression_commits_clamps_and_rejects_invalid() {
         let mut h = Harness::builder().build_ui_state(
             |ui, value| {
-                ui.add(egui::DragValue::new(value).range(0.0..=1000.0).custom_parser(super::parse));
+                ui.add(egui::DragValue::new(value).range(0.0..=1000.0).custom_parser(super::parse)).accessible_name("Test number");
             },
             100.0_f64,
         );
diff --git a/crates/ui-egui/src/options_bar_mode_wheel_tests.rs b/crates/ui-egui/src/options_bar_mode_wheel_tests.rs
index 068561b4a0..1c65cf5ec9 100644
--- a/crates/ui-egui/src/options_bar_mode_wheel_tests.rs
+++ b/crates/ui-egui/src/options_bar_mode_wheel_tests.rs
@@ -1,5 +1,6 @@
-//! #2061: the scroll wheel over the options bar's Mode dropdown (Brush, Pencil, Gradient) steps
-//! through the blend modes, as over the Layers panel's (#1747) and as in Photoshop.
+//! #2061: the scroll wheel over the options bar's Mode dropdown (Brush, Pencil, Gradient, Paint
+//! Bucket, the stamps, History Brush, Healing) steps through the blend modes, as over the Layers
+//! panel's (#1747) and as in Photoshop.
 
 use egui::accesskit::Role;
 use egui::{Pos2, Rect, vec2};
@@ -34,6 +35,7 @@ fn wheel(h: &mut Harness<'_, PhotocraftApp>, at: Pos2, lines: f32) {
     h.hover_at(at);
     h.run_steps(1);
     h.event(egui::Event::MouseWheel {
+        source: egui::MouseWheelSource::Unknown,
         unit: egui::MouseWheelUnit::Line,
         delta: vec2(0.0, lines),
         phase: egui::TouchPhase::Move,
@@ -81,3 +83,35 @@ fn the_wheel_over_the_gradient_mode_dropdown_steps_its_blend_mode() {
     wheel(&mut h, at, 1.0);
     assert_eq!(h.state().ui.tool_options.gradient_blend_mode, BlendMode::Dissolve);
 }
+
+/// The stamps, the History Brush and the Healing Brush have a Mode dropdown of their own brush's
+/// mode; the Healing Brush's skips the modes it doesn't have.
+#[test]
+fn retouch_tools_have_a_mode_dropdown() {
+    for (tool, after_two) in [
+        (Tool::CloneStamp, BlendMode::Darken),
+        (Tool::PatternStamp, BlendMode::Darken),
+        (Tool::HistoryBrush, BlendMode::Darken),
+        (Tool::Healing, BlendMode::Screen),
+    ] {
+        let mut h = harness(tool);
+        let at = mode_dropdown(&h).center();
+        wheel(&mut h, at, -2.0);
+        assert_eq!(brush_mode(&h), after_two, "{tool:?}");
+        assert_eq!(h.state().ui.tool, tool);
+    }
+}
+
+/// The Paint Bucket's Mode dropdown has Clear after Dissolve, as the Brush's does.
+#[test]
+fn the_paint_bucket_mode_dropdown_has_clear() {
+    let mut h = harness(Tool::PaintBucket);
+    let at = mode_dropdown(&h).center();
+    wheel(&mut h, at, -1.0);
+    assert_eq!(h.state().ui.tool_options.bucket_blend_mode, BlendMode::Dissolve);
+    wheel(&mut h, at, -1.0);
+    assert!(h.state().ui.tool_options.bucket_clear);
+    wheel(&mut h, at, -1.0);
+    assert!(!h.state().ui.tool_options.bucket_clear);
+    assert_eq!(h.state().ui.tool_options.bucket_blend_mode, BlendMode::Darken);
+}
diff --git a/crates/ui-egui/src/options_hit_area_tests.rs b/crates/ui-egui/src/options_hit_area_tests.rs
index d444f06473..9af3647016 100644
--- a/crates/ui-egui/src/options_hit_area_tests.rs
+++ b/crates/ui-egui/src/options_hit_area_tests.rs
@@ -1,7 +1,10 @@
 //! #5052: the actual Brush options caption and field form one scrub target.
 use crate::PhotocraftApp;
 use egui::{Modifiers, Pos2, Rect, pos2, vec2};
-use egui_kittest::{Harness, kittest::Queryable};
+use egui_kittest::{
+    Harness,
+    kittest::{NodeT, Queryable},
+};
 
 fn harness() -> Harness<'static, PhotocraftApp> {
     let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
@@ -21,7 +24,13 @@ fn harness() -> Harness<'static, PhotocraftApp> {
 }
 
 fn geometry(h: &Harness<'_, PhotocraftApp>) -> (Rect, Rect) {
-    let label = h.get_by_label("Hardness").rect();
+    // The visible caption, not the number field it names: kittest returns the labelled control
+    // for `get_by_label`, whose rect would put the drag inside the numeric editor.
+    let label = h
+        .query_all(egui_kittest::kittest::by().label("Hardness").include_labels())
+        .find(|n| n.accesskit_node().role() == egui::accesskit::Role::Label)
+        .expect("the Hardness caption")
+        .rect();
     let field = h
         .get_all_by_role(egui::accesskit::Role::SpinButton)
         .map(|n| n.rect())
@@ -118,7 +127,7 @@ fn options_expanded_hit_click_does_not_edit_or_request_focus() {
     click(&mut h, f.center());
     let before_focus = h.ctx.memory(|m| m.focused()).expect("numeric editor focus");
     let before_journal = h.state().session.journal.len();
-    let l = h.get_by_label("Hardness").rect();
+    let (l, _) = geometry(&h);
     click(&mut h, l.center() + vec2(0.0, 10.0));
     assert_eq!(h.state().session.tools.brush.hardness, 0.5);
     println!(
@@ -197,3 +206,29 @@ fn options_tab_moves_from_hardness_to_opacity_without_a_caption_stop() {
     assert_eq!(h.state().session.tools.brush.hardness, 0.5);
     assert!((h.state().session.tools.brush.opacity - 0.99).abs() < 0.0001);
 }
+
+// Regression test for #3425: the options bar drew its own 1 px top and bottom separator inside
+// the panel, on top of the panel's own border, so the borders doubled (three lines, not one).
+#[test]
+fn options_bar_has_a_single_full_width_border() {
+    for kind in [crate::theme::ThemeKind::Studio, crate::theme::ThemeKind::Pro, crate::theme::ThemeKind::Classic] {
+        let mut h = harness();
+        PhotocraftApp::setup_context(&h.ctx, kind);
+        h.run_steps(4);
+        let separator = crate::theme::Tokens::get(&h.ctx).separator;
+        let borders: Vec<_> = h
+            .output()
+            .shapes
+            .iter()
+            .filter_map(|c| match &c.shape {
+                egui::Shape::LineSegment { points, stroke }
+                    if stroke.color == separator && (points[0].y - points[1].y).abs() < 0.01 && (points[1].x - points[0].x).abs() > 400.0 =>
+                {
+                    Some(*points)
+                }
+                _ => None,
+            })
+            .collect();
+        assert_eq!(borders.len(), 1, "{kind:?}: the options bar has exactly one border, the panel's (its own would double it): {borders:?}");
+    }
+}
diff --git a/crates/ui-egui/src/paint_mouse.rs b/crates/ui-egui/src/paint_mouse.rs
index 84695522d1..33ff242b57 100644
--- a/crates/ui-egui/src/paint_mouse.rs
+++ b/crates/ui-egui/src/paint_mouse.rs
@@ -37,8 +37,10 @@ pub fn sync_tool_brush(app: &mut PhotocraftApp) {
             let _ = app.session.load_brush_tips(&mut b);
             b
         }
-        // A tool seen for the first time takes what the brush has, at Photoshop's smoothing.
-        None => BrushSettings { smoothing: first_smoothing(), ..current },
+        // A tool seen for the first time takes what the brush has, at Photoshop's smoothing, but
+        // in Normal mode: each tool's Mode starts at Normal, so a Multiply Brush doesn't make the
+        // first Clone Stamp stroke multiply (or give Healing a mode its menu doesn't have).
+        None => BrushSettings { smoothing: first_smoothing(), mode: photocraft_color::BlendMode::Normal, ..current },
     };
     // The picked preset was the outgoing tool's brush: forget it, so Update Brush can't overwrite
     // that preset with this tool's brush.
@@ -358,7 +360,7 @@ mod tests {
         assert!(strokes(&h).is_empty());
         // The picker shows over the canvas at the pointer, moved up just enough to stay on screen.
         h.run_steps(2);
-        let shown = h.ctx.memory(|m| m.area_rect(egui::Id::new("canvas-brush-picker"))).expect("picker shown");
+        let shown = h.ctx.memory(|m| m.area_rect(egui::Id::unique("canvas-brush-picker"))).expect("picker shown");
         let screen = h.ctx.content_rect();
         assert!((shown.min.x - c.x).abs() < 1.0 && shown.min.y <= c.y + 1.0, "{shown:?}");
         assert!(screen.contains_rect(shown.shrink(0.5)) && shown.width() > 250.0 && shown.height() > 150.0, "{shown:?}");
@@ -449,11 +451,11 @@ mod tests {
         let c = h.state().last_canvas_rect.center();
         h.state_mut().ui.brush_picker = Some([c.x, c.y]);
         h.run_steps(2);
-        assert!(h.query_by_label("Hardness").is_some());
+        assert!(h.query_all_by_label("Hardness").next().is_some());
         let sampled = h.state().session.tools.presets.iter().find(|p| p.brush.tip != photocraft_engine::paint::TipShape::Round).map(|p| p.name.clone());
         h.state_mut().run("tools.setBrush", json!({ "preset": sampled.expect("a sampled preset") })).unwrap();
         h.run_steps(2);
-        assert!(h.query_by_label("Hardness").is_none());
+        assert!(h.query_all_by_label("Hardness").next().is_none());
         assert!(h.state().ui.brush_picker.is_some());
     }
 
@@ -623,6 +625,7 @@ mod tests {
         // Mode, opacity, flow and the dynamics sections are per tool too.
         app.ui.tool = Tool::CloneStamp;
         sync_tool_brush(&mut app);
+        assert_eq!(mode(&brush(&app)), photocraft_color::BlendMode::Normal, "a new tool starts in Normal, not the Brush's Multiply");
         app.run("tools.setBrush", json!({"brush": {"mode": "Screen", "opacity": 0.3}})).unwrap();
         app.ui.tool = Tool::Brush;
         sync_tool_brush(&mut app);
diff --git a/crates/ui-egui/src/palette.rs b/crates/ui-egui/src/palette.rs
index 7de5195988..eeb01de764 100644
--- a/crates/ui-egui/src/palette.rs
+++ b/crates/ui-egui/src/palette.rs
@@ -48,7 +48,7 @@ const RECENT_CAP: usize = 8;
 
 /// The id of the palette's recently-run list (egui temp data: session-scoped, like the query).
 fn recent_id() -> egui::Id {
-    egui::Id::new("palette-recent")
+    egui::Id::unique("palette-recent")
 }
 
 /// Remember `id` as the most recently run command: deduplicated, newest first, capped.
@@ -124,7 +124,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let t = Tokens::get(ctx);
     let screen = ctx.content_rect();
     // Scrim.
-    egui::Area::new(egui::Id::new("palette-scrim")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
+    egui::Area::new(egui::Id::unique("palette-scrim")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
         let r = ui.allocate_exact_size(screen.size(), Sense::click()).1;
         ui.painter().rect_filled(screen, 0.0, Color32::from_black_alpha(110));
         if r.clicked() {
@@ -133,7 +133,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     });
     let width = 560.0;
     let mut run: Option<String> = None;
-    egui::Area::new(egui::Id::new("palette"))
+    egui::Area::new(egui::Id::unique("palette"))
         .order(egui::Order::Tooltip)
         .pivot(Align2::CENTER_TOP)
         .fixed_pos(egui::pos2(screen.center().x, screen.top() + 110.0))
@@ -146,7 +146,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 .inner_margin(egui::Margin::same(10))
                 .show(ui, |ui| {
                     ui.set_width(width);
-                    let qid = egui::Id::new("palette-query");
+                    let qid = egui::Id::unique("palette-query");
                     let mut q: String = ui.data_mut(|d| d.get_temp(qid).unwrap_or_default());
                     ui.horizontal(|ui| {
                         let (r, _) = ui.allocate_exact_size(vec2(22.0, 22.0), Sense::hover());
@@ -190,7 +190,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                     }
                     hits.sort_by(|a, b| b.0.cmp(&a.0).then(a.2.cmp(&b.2)));
                     hits.truncate(12);
-                    let sel_id = egui::Id::new("palette-sel");
+                    let sel_id = egui::Id::unique("palette-sel");
                     let mut sel: usize = ui.data_mut(|d| d.get_temp(sel_id).unwrap_or(0));
                     let (down, up, enter, esc) = ui.input(|i| {
                         (
@@ -247,7 +247,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         });
     if let Some(id) = run {
         app.ui.palette_open = false;
-        ctx.data_mut(|d| d.insert_temp(egui::Id::new("palette-query"), String::new()));
+        ctx.data_mut(|d| d.insert_temp(egui::Id::unique("palette-query"), String::new()));
         if let Some(tool) = id.strip_prefix("tool:") {
             if let Some(t) = crate::state::Tool::from_name(tool) {
                 app.ui.tool = t;
diff --git a/crates/ui-egui/src/panel_docking.rs b/crates/ui-egui/src/panel_docking.rs
index 06971e56a0..b2cd933235 100644
--- a/crates/ui-egui/src/panel_docking.rs
+++ b/crates/ui-egui/src/panel_docking.rs
@@ -1,12 +1,27 @@
-//! Application-owned panel IDs and commands around the shared docking layout.
+//! Application-owned panel IDs and commands around the shared docking workspace.
+//!
+//! craft-ui draws the window's panels and the canvas as one layout: a horizontal split of the
+//! protected `canvas` panel and a dock at the logical end edge. Until the first docking
+//! operation the layout is built each frame from the native dock's state (`crate::dock`), so its
+//! groups, tab order, selection, heights and collapse follow that state; from then on
+//! `app.ui.docking` holds a craft-ui [`Workspace`]. The layout, hidden panels and their return
+//! places, and the lock are craft-ui's; PhotoCraft keeps the panel registry, the collapsed custom
+//! groups and where a floated panel docks back.
 
 use crate::dock::Group;
-use craft_ui::docking::{Action, Floating, Layout, Node, Placement, Zone};
+use craft_ui::docking::{
+    Action, Column, DockCommand, DockHeights, FloatSpace, Floating, Layout, Location, Node, PanelState, Permissions, Placement, Side, Target, Zone,
+};
 use craft_ui::layout::{SplitAxis, SplitSize};
-use serde_json::{Value, json};
+use serde_json::{Map, Value, json};
 
 use crate::PhotocraftApp;
 
+/// The saved arrangement: layout, hidden panels with their return places, and the lock.
+pub(crate) type Workspace = craft_ui::docking::Workspace<String>;
+
+type Returns = std::collections::BTreeMap<String, Location<String>>;
+
 const PANELS: &[(&str, &str, Group)] = &[
     ("color", "Color", Group::Color),
     ("swatches", "Swatches", Group::Color),
@@ -27,463 +42,594 @@ const PANELS: &[(&str, &str, Group)] = &[
     ("paths", "Paths", Group::Layers),
     ("brushes", "Brushes", Group::Brushes),
 ];
-#[derive(Clone, Default)]
-struct LegacyDrag {
-    generation: u64,
-    layout: Option<Layout<String>>,
-    tabs: crate::state::DockTabs,
-    hidden: std::collections::BTreeMap<String, craft_ui::docking::Location<String>>,
+
+/// PhotoCraft's wording of craft-ui's docking labels, translated through `tl!`. The others keep
+/// craft-ui's English.
+const DOCK_LABELS: &[(&str, &str)] = &[
+    ("dock.float", "Float Panel"),
+    ("dock.close", "Close Panel"),
+    ("dock.movePanelTo", "Group with"),
+    ("dock.panels", "Panels"),
+    ("dock.resize", "Resize panels"),
+    ("dock.resizeWindow", "Resize panel window"),
+    ("dock.closeGroup", "Close Tab Group"),
+    ("dock.floatGroup", "Float Tab Group"),
+];
+
+/// Where a panel floats when a command gives no rect: craft-ui places it 24 points inside this
+/// area, at (400, 140) on the window.
+const FLOAT_AREA: egui::Rect = egui::Rect::from_min_max(egui::pos2(376.0, 116.0), egui::pos2(1400.0, 900.0));
+const FLOAT_SIZE: egui::Vec2 = egui::vec2(300.0, 400.0);
+
+fn area_id() -> egui::Id {
+    egui::Id::unique("photocraft-panel-docking")
 }
 
-fn cancel_legacy_drag(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
-    let key = egui::Id::new("photocraft-panel-docking").with("legacy-origin");
-    let previous = ctx.data_mut(|data| data.remove_temp::<LegacyDrag>(key));
-    if let Some(previous) = previous {
-        craft_ui::docking::cancel_drag::<String>(ctx, egui::Id::new("photocraft-panel-docking"));
-        if previous.generation != app.ui.docking_generation {
-            return false;
-        }
-        app.ui.dock_tabs = previous.tabs;
-        app.ui.docking = previous.layout;
-        app.ui.docking_hidden = previous.hidden;
-        true
-    } else {
-        false
+#[cfg(test)]
+fn bodies_id() -> egui::Id {
+    area_id().with("bodies")
+}
+
+/// The body of each panel drawn last frame, the canvas included (screen points).
+#[cfg(test)]
+pub(crate) fn last_bodies(ctx: &egui::Context) -> Vec<(String, egui::Rect)> {
+    ctx.data(|data| data.get_temp::<Vec<(String, egui::Rect)>>(bodies_id())).unwrap_or_default()
+}
+
+/// The panel that holds the document area. It never moves, floats, closes or takes tabs, and
+/// docks and frames open beside it.
+pub(crate) const CANVAS: &str = "canvas";
+
+/// Every other panel may move, float and close; the workspace lock limits them all.
+fn permissions(id: &String) -> Permissions {
+    if id == CANVAS { Permissions { accepts_splits: true, ..Permissions::PROTECTED } } else { Permissions::default() }
+}
+
+/// The width of the dock column in a layout built from the native dock.
+fn default_width(pro: bool) -> f32 {
+    if pro { 290.0 } else { 300.0 }
+}
+
+/// The window id of the Studio themes' floating Properties group in a layout built each frame:
+/// the same every time, with the top bit set, where craft-ui's fresh ids never reach.
+const PROPERTIES_WINDOW: u64 = (1 << 63) | 0x5052_4f50;
+
+/// The canvas beside `dock`, which is `width` wide, at the logical end edge.
+fn with_canvas(dock: Node<String>, width: f32) -> Node<String> {
+    Node::Split {
+        axis: SplitAxis::Horizontal,
+        size: SplitSize::FixedSecond(width),
+        first: Box::new(Node::Tabs { panels: vec![CANVAS.to_owned()], active: 0 }),
+        second: Box::new(dock),
     }
 }
 
+/// A layout saved before the canvas joined it, beside the canvas as it was beside the document
+/// area. Layouts that hold the canvas are returned unchanged.
+fn beside_canvas(mut layout: Layout<String>) -> Layout<String> {
+    if !layout.panels().iter().any(|p| p.as_str() == CANVAS) {
+        layout.root = Some(match layout.root.take() {
+            Some(root) => with_canvas(root, default_width(false)),
+            None => Node::Tabs { panels: vec![CANVAS.to_owned()], active: 0 },
+        });
+    }
+    layout
+}
+
+fn docked(layout: &Layout<String>) -> Layout<String> {
+    Layout { root: layout.root.clone(), floating: Vec::new() }
+}
+
 pub(crate) fn normalize(raw: &str) -> Option<&'static str> {
     PANELS.iter().find(|(id, label, _)| id.eq_ignore_ascii_case(raw.trim()) || label.eq_ignore_ascii_case(raw.trim())).map(|p| p.0)
 }
 
+fn registered(id: &str) -> bool {
+    id == CANVAS || normalize(id) == Some(id)
+}
+
 pub(crate) fn valid(layout: &Layout<String>) -> bool {
-    layout.validate().is_ok() && layout.panels().iter().all(|id| normalize(id) == Some(id.as_str()))
+    layout.validate().is_ok() && layout.panels().iter().all(|id| registered(id)) && docked(layout).contains(&CANVAS.to_owned())
+}
+
+/// craft-ui's checks plus PhotoCraft's registry, for the layout and every hidden panel.
+pub(crate) fn valid_workspace(workspace: &Workspace) -> bool {
+    workspace.validate().is_ok()
+        && valid(&workspace.layout)
+        && workspace.saved.as_ref().is_none_or(valid)
+        && workspace.hidden.iter().all(|(id, at)| registered(id) && at.anchor.as_deref().is_none_or(registered))
+}
+
+/// Read a saved `docking` workspace and where its floating panels dock back. Anything else,
+/// such as the bare layouts written before workspaces, gives `None`: the native dock's default.
+pub(crate) fn load(saved: &Value) -> Option<(Workspace, Returns)> {
+    let docking = saved.get("docking").filter(|v| v.get("layout").is_some())?;
+    let mut workspace: Workspace = serde_json::from_value(docking.clone()).ok()?;
+    workspace.layout = beside_canvas(workspace.layout);
+    workspace.saved = workspace.saved.map(beside_canvas);
+    let mut returns: Returns = saved.get("dockingReturns").and_then(|v| serde_json::from_value(v.clone()).ok()).unwrap_or_default();
+    returns.retain(|panel, at| registered(panel) && at.floating.is_none() && floats(&workspace.layout, panel));
+    valid_workspace(&workspace).then_some((workspace, returns))
+}
+
+/// The saved `docking` workspace is from a newer version than craft-ui reads.
+pub(crate) fn newer(saved: &Value) -> bool {
+    saved.get("docking").and_then(|docking| docking.get("version")).and_then(Value::as_u64).is_some_and(|version| version > u64::from(Workspace::VERSION))
 }
 
 fn legacy(app: &PhotocraftApp) -> Layout<String> {
     legacy_layout(app, false)
 }
 
+/// The native dock's arrangement as a craft-ui layout: the canvas beside one dock column of the
+/// shown groups, top to bottom, with their tab order, selected tab and user-set heights. The
+/// Studio themes float Properties over the canvas's top right corner. `all` includes the groups
+/// that are not shown, with every tab.
 fn legacy_layout(app: &PhotocraftApp, all: bool) -> Layout<String> {
-    let pro = matches!(app.ui.theme, crate::theme::ThemeKind::Pro | crate::theme::ThemeKind::ProMedium);
-    let mut layout = Layout::default();
-    for group in app.ui.dock.order().into_iter().rev().filter(|g| all || g.shown(&app.ui.panels)) {
+    let pro = app.ui.theme.is_pro();
+    let mut groups = Vec::new();
+    let mut floating = Vec::new();
+    for group in app.ui.dock.order().into_iter().filter(|g| all || g.shown(&app.ui.panels)) {
         let labels = group.tabs(pro);
         let visible = if all { group.tabs(pro).iter().copied().enumerate().collect() } else { app.ui.dock.visible_tabs(group, pro) };
         let panels: Vec<String> = visible.iter().filter_map(|(_, label)| normalize(label).map(str::to_owned)).collect();
         if panels.is_empty() {
             continue;
         }
-        let selected = match group {
-            Group::Color => app.ui.dock_tabs.color,
-            Group::Properties => app.ui.dock_tabs.properties,
-            Group::Character => app.ui.dock_tabs.character,
-            Group::Navigator => app.ui.dock_tabs.navigator,
-            Group::History => app.ui.dock_tabs.history,
-            Group::Layers => app.ui.dock_tabs.layers,
-            Group::Brushes => app.ui.dock_tabs.brushes,
-        };
+        let selected = *group.tab_mut(&mut app.ui.dock_tabs.clone());
         let active = labels.get(selected).and_then(|label| normalize(label)).and_then(|id| panels.iter().position(|p| p == id)).unwrap_or(0);
         if group == Group::Properties && !pro {
-            layout.floating.push(Floating { panels, active, rect: [120.0, 160.0, 320.0, 440.0] });
+            floating.push(Floating::single(panels, active, studio_properties_rect(app)).with_id(PROPERTIES_WINDOW));
             continue;
         }
-        let node = Node::Tabs { panels, active };
-        layout.root = Some(match layout.root.take() {
-            Some(second) => Node::Split {
-                axis: SplitAxis::Vertical,
-                size: SplitSize::FixedFirst(app.ui.dock.height(group)),
-                first: Box::new(node),
-                second: Box::new(second),
-            },
-            None => node,
-        });
+        let height = app.ui.dock.heights.contains_key(&group).then(|| app.ui.dock.height(group));
+        groups.push(craft_ui::docking::Group { height, ..craft_ui::docking::Group::new(panels, active) });
     }
-    layout
+    let (columns, width) = if groups.is_empty() { (Vec::new(), 0.0) } else { (vec![Column::new(groups, default_width(pro))], default_width(pro)) };
+    Layout { root: Some(with_canvas(Node::Dock { side: Side::End, columns }, width)), floating }
+}
+
+/// Where the Studio themes' Properties card floats: inside the canvas's top right corner.
+fn studio_properties_rect(app: &PhotocraftApp) -> [f32; 4] {
+    let (width, height) = (320.0, 440.0);
+    let canvas = app.last_canvas_rect;
+    if canvas.is_positive() && canvas.width() > width + 24.0 {
+        [canvas.right() - width - 12.0, canvas.top() + 44.0, width, height]
+    } else {
+        [120.0, 160.0, width, height]
+    }
+}
+
+/// The native dock as a workspace: its shown panels, and where each hidden one goes back.
+fn legacy_workspace(app: &PhotocraftApp) -> Workspace {
+    let layout = legacy(app);
+    let hidden = migration_hidden(app, &layout);
+    Workspace { hidden, ..Workspace::new(layout) }
+}
+
+/// The workspace commands change: the customized one, or the native dock's. The lock is the
+/// Lock Workspace preference.
+fn workspace_of(app: &PhotocraftApp) -> Result<Workspace, String> {
+    let mut workspace = match &app.ui.docking {
+        Some(workspace) if !valid_workspace(workspace) => return Err("saved panel layout is invalid; reset the workspace first".into()),
+        Some(workspace) => workspace.clone(),
+        None => legacy_workspace(app),
+    };
+    workspace.locked = app.session.prefs().workspace_locked;
+    Ok(workspace)
+}
+
+fn commit(app: &mut PhotocraftApp, workspace: Workspace, mut returns: Returns) {
+    returns.retain(|panel, _| floats(&workspace.layout, panel));
+    app.ui.docking = Some(workspace);
+    app.ui.docking_returns = returns;
+    app.ui.panels.dock = true;
+    sync_visibility(app);
+}
+
+fn floats(layout: &Layout<String>, panel: &str) -> bool {
+    layout.floating.iter().any(|window| window.contains(&panel.to_owned()))
 }
 
 // Native collapse flags remain app-owned. An intact native tab group keeps its collapsed
 // presentation when the workspace first becomes customizable; mixed custom groups are expanded.
 fn collapsed_members(app: &PhotocraftApp, layout: &Layout<String>) -> std::collections::HashSet<String> {
     let mut collapsed: std::collections::HashSet<String> = app.ui.docking_collapsed.iter().cloned().collect();
-    let mut pending: Vec<_> = layout.root.iter().collect();
-    while let Some(node) = pending.pop() {
-        match node {
-            Node::Split { first, second, .. } => pending.extend([first.as_ref(), second.as_ref()]),
-            Node::Tabs { panels, .. } => {
-                let group = panels.first().and_then(|id| PANELS.iter().find(|p| p.0 == id)).map(|p| p.2);
-                if let Some(group) = group.filter(|group| app.ui.dock.is_collapsed(*group)) {
-                    let pro = matches!(app.ui.theme, crate::theme::ThemeKind::Pro | crate::theme::ThemeKind::ProMedium);
-                    let native: Vec<_> = app.ui.dock.visible_tabs(group, pro).iter().filter_map(|(_, name)| normalize(name)).collect();
-                    if panels.len() == native.len() && panels.iter().all(|panel| native.contains(&panel.as_str())) {
-                        collapsed.extend(panels.iter().cloned());
-                    }
-                }
+    for group in layout.root.iter().flat_map(tree_groups).filter(|group| group.minimized) {
+        collapsed.extend(group.panels);
+    }
+    for panels in root_groups(layout) {
+        let group = panels.first().and_then(|id| PANELS.iter().find(|p| p.0 == id)).map(|p| p.2);
+        if let Some(group) = group.filter(|group| app.ui.dock.is_collapsed(*group)) {
+            let pro = app.ui.theme.is_pro();
+            let native: Vec<_> = app.ui.dock.visible_tabs(group, pro).iter().filter_map(|(_, name)| normalize(name)).collect();
+            if panels.len() == native.len() && panels.iter().all(|panel| native.contains(&panel.as_str())) {
+                collapsed.extend(panels.iter().cloned());
             }
-            _ => {}
         }
     }
     collapsed
 }
 
 fn first_root(layout: &Layout<String>, except: &str) -> Option<String> {
-    let root = Layout { root: layout.root.clone(), floating: Vec::new() };
-    root.panels().into_iter().find(|p| p.as_str() != except).cloned()
+    docked(layout).panels().into_iter().find(|p| p.as_str() != except && p.as_str() != CANVAS).cloned()
 }
 
-fn ensure(layout: &mut Layout<String>, panel: &str) -> Result<(), String> {
-    let anchor = first_root(layout, panel);
-    layout.apply(Action::Open { panel: panel.into(), anchor }).map_err(|e| e.to_string())
+/// Show `panel` if it is not in the layout: a closed panel at its recorded place, one never laid
+/// out where the native dock puts it ([`default_place`]).
+fn ensure(app: &PhotocraftApp, workspace: &mut Workspace, panel: &str) -> Result<(), String> {
+    if workspace.layout.contains(&panel.to_owned()) {
+        return Ok(());
+    }
+    if workspace.hidden.iter().any(|(id, _)| id == panel) {
+        let anchor = first_root(&workspace.layout, panel);
+        return workspace.set_visible(panel.to_owned(), true, anchor, permissions).map_err(|e| e.to_string());
+    }
+    let action = default_place(app, &workspace.layout, panel);
+    workspace.apply(action, permissions).map(drop).map_err(|e| e.to_string())
 }
 
-fn number(params: &Value, key: &str, default: f32) -> Result<f32, String> {
-    match params.get(key) {
-        None => Ok(default),
-        Some(v) => v.as_f64().filter(|v| v.is_finite() && v.abs() <= 1_000_000.0).map(|v| v as f32).ok_or_else(|| format!("{key} must be a finite coordinate")),
+/// Where the native dock shows `panel` in `layout`: a tab of its group, before the next of the
+/// group's tabs; else a new group of the dock column, above the next native group there or below
+/// the one before it; else where craft-ui opens a panel.
+fn default_place(app: &PhotocraftApp, layout: &Layout<String>, panel: &str) -> Action<String> {
+    let open = Action::Open { panel: panel.to_owned(), anchor: None };
+    let Some(group) = PANELS.iter().find(|p| p.0 == panel).map(|p| p.2) else { return open };
+    let pro = app.ui.theme.is_pro();
+    let tabs: Vec<&str> = app.ui.dock.ordered_tabs(group, pro).iter().filter_map(|(_, label)| normalize(label)).collect();
+    if let Some(mate) = tabs.iter().find(|id| layout.contains(&id.to_string())) {
+        let members = group_members(layout, mate);
+        let after = tabs.iter().position(|id| *id == panel).map_or(&[][..], |at| &tabs[at + 1..]);
+        let before = after.iter().find(|id| members.iter().any(|m| m == *id)).map(|id| id.to_string());
+        return Action::OpenAt { panel: panel.to_owned(), anchor: mate.to_string(), placement: Placement::Tab { before } };
+    }
+    let order = app.ui.dock.order();
+    let Some(at) = order.iter().position(|g| *g == group) else { return open };
+    let docked = |g: &Group| PANELS.iter().filter(|p| p.2 == *g).map(|p| p.0).find(|id| in_dock_column(layout, id));
+    let new_group =
+        |anchor: &str, below: bool| Action::OpenAt { panel: panel.to_owned(), anchor: anchor.to_owned(), placement: Placement::Group { below, height: None } };
+    if let Some(anchor) = order[at + 1..].iter().find_map(docked) {
+        new_group(anchor, false)
+    } else if let Some(anchor) = order[..at].iter().rev().find_map(docked) {
+        new_group(anchor, true)
+    } else {
+        open
     }
 }
 
-fn placement(params: &Value) -> Result<Placement<String>, String> {
-    if let Some(before) = params.get("before") {
-        let id = before.as_str().and_then(normalize).ok_or("before must name a panel")?;
-        return Ok(Placement::Tab { before: Some(id.into()) });
+/// The panel a command names, if any.
+fn command_panel(command: &DockCommand<String>) -> Option<&String> {
+    use craft_ui::docking::{DockOperation, UiDock};
+    match command {
+        DockCommand::Move { panel, .. }
+        | DockCommand::Float { panel, .. }
+        | DockCommand::Dock { panel, .. }
+        | DockCommand::Activate { panel }
+        | DockCommand::Close { panel }
+        | DockCommand::CloseGroup { panel }
+        | DockCommand::CloseOthers { panel }
+        | DockCommand::Minimize { panel, .. }
+        | DockCommand::Iconic { panel, .. }
+        | DockCommand::Window { panel, .. } => Some(panel),
+        DockCommand::UiDock(UiDock::Operation(
+            DockOperation::Open { panel }
+            | DockOperation::Activate { panel }
+            | DockOperation::Close { panel }
+            | DockOperation::Float { panel, .. }
+            | DockOperation::Move { panel, .. },
+        )) => Some(panel),
+        DockCommand::Layout { action: Action::Activate { panel } } | DockCommand::UiDock(UiDock::Action { action: Action::Activate { panel } }) => Some(panel),
+        _ => None,
     }
-    let zone = match params.get("zone") {
-        None => "tab",
-        Some(value) => value.as_str().ok_or("zone must be a string")?,
-    };
-    Ok(match zone {
-        "tab" => Placement::Tab { before: None },
-        "center" => Placement::Split(Zone::Center),
-        "left" => Placement::Split(Zone::Left),
-        "right" => Placement::Split(Zone::Right),
-        "top" => Placement::Split(Zone::Top),
-        "bottom" => Placement::Split(Zone::Bottom),
-        _ => return Err("zone must be tab, center, left, right, top or bottom".into()),
-    })
+}
+
+/// Commands that bring their panel to the front.
+fn reveals(command: &DockCommand<String>) -> bool {
+    use craft_ui::docking::{DockOperation, UiDock};
+    matches!(
+        command,
+        DockCommand::Activate { .. }
+            | DockCommand::Layout { action: Action::Activate { .. } }
+            | DockCommand::UiDock(
+                UiDock::Operation(DockOperation::Open { .. } | DockOperation::Activate { .. }) | UiDock::Action { action: Action::Activate { .. } }
+            )
+    )
+}
+
+/// Commands that close their panel, so a hidden one is not shown first.
+fn closes(command: &DockCommand<String>) -> bool {
+    use craft_ui::docking::{DockOperation, UiDock};
+    matches!(
+        command,
+        DockCommand::Close { .. }
+            | DockCommand::CloseGroup { .. }
+            | DockCommand::CloseOthers { .. }
+            | DockCommand::UiDock(UiDock::Operation(DockOperation::Close { .. }))
+    )
 }
 
 pub(crate) fn command(app: &mut PhotocraftApp, id: &str, params: &Value) -> Option<Result<Value, String>> {
     if id == "window.panel.group" {
         return Some(group_command(app, params));
     }
-    if id == "window.panel.layout" {
-        return Some(
-            params
-                .get("action")
-                .ok_or_else(|| "action is required".to_string())
-                .and_then(|value| serde_json::from_value::<Action<String>>(value.clone()).map_err(|error| error.to_string()))
-                .and_then(|action| apply_action(app, action)),
-        );
-    }
     if let Some(panel) = id.strip_prefix("window.panel.").or_else(|| id.strip_prefix("window.toggle.")).and_then(normalize) {
         if app.ui.docking.is_none() && panel != "brushes" {
             return None;
         }
-        let showing = app.ui.docking.as_ref().is_some_and(|layout| layout.contains(&panel.to_string()));
+        let layout = app.ui.docking.as_ref().map(|workspace| &workspace.layout);
+        let showing = layout.is_some_and(|layout| layout.contains(&panel.to_string()));
         let show = match params.get("show").or_else(|| params.get("on")) {
-            None => !showing || app.ui.docking.as_ref().is_some_and(|layout| !panel_active(layout, panel) || collapsed_members(app, layout).contains(panel)),
+            None => !showing || layout.is_some_and(|layout| !panel_active(layout, panel) || collapsed_members(app, layout).contains(panel)),
             Some(value) => match value.as_bool() {
                 Some(show) => show,
                 None => return Some(Err("show must be a boolean".into())),
             },
         };
-        return Some(change(app, if show { "activate" } else { "close" }, &json!({"panel":panel})));
+        let id = if show { "window.panel.activate" } else { "window.panel.close" };
+        return Some(dock_command(app, id, &json!({"panel": panel})));
     }
-    let operation = match id {
-        "window.panel.move" => "move",
-        "window.panel.float" => "float",
-        "window.panel.dock" => "dock",
-        "window.panel.activate" => "activate",
-        "window.panel.close" => "close",
-        "window.panel" if app.ui.docking.is_some() => "activate",
+    let id = match id {
+        "window.panel" if app.ui.docking.is_some() => "window.panel.activate",
+        #[cfg(target_arch = "wasm32")]
+        "window.panel.window" => return Some(Err("floating panels stay in the page on the web".into())),
+        id if DockCommand::<String>::IDS.contains(&id) => id,
         _ => return None,
     };
-    Some(change(app, operation, params))
+    Some(dock_command(app, id, params))
 }
 
 pub(crate) fn checked(app: &PhotocraftApp, id: &str) -> Option<bool> {
-    let layout = app.ui.docking.as_ref()?;
+    let workspace = app.ui.docking.as_ref()?;
     let panel = id.strip_prefix("window.panel.").or_else(|| id.strip_prefix("window.toggle.")).and_then(normalize)?;
-    Some(layout.contains(&panel.to_string()))
+    Some(workspace.layout.contains(&panel.to_string()))
 }
 
-// UI output and automation share this atomic dispatcher. The application owns the registry
-// and saved return locations; craft-ui owns tree validation and structural changes.
-fn apply_action(app: &mut PhotocraftApp, action: Action<String>) -> Result<Value, String> {
-    if app.session.prefs().workspace_locked && !matches!(action, Action::Activate { .. }) {
-        return Err("workspace is locked".into());
+/// Parse a docking command id and its params as craft-ui's [`DockCommand`] and run it. Panels
+/// may be named by id or label, and `onto` stands for `anchor`.
+fn dock_command(app: &mut PhotocraftApp, id: &str, params: &Value) -> Result<Value, String> {
+    let mut fields = match params {
+        Value::Null => Map::new(),
+        Value::Object(fields) => fields.clone(),
+        _ => return Err("params must be an object".into()),
+    };
+    if let Some(onto) = fields.remove("onto") {
+        fields.entry("anchor").or_insert(onto);
     }
-    let registered = |id: &String| normalize(id) == Some(id.as_str());
-    let known = match &action {
-        Action::Move { panel, anchor, placement } | Action::OpenAt { panel, anchor, placement } => {
-            registered(panel)
-                && registered(anchor)
-                && match placement {
-                    Placement::Tab { before: Some(id) } => registered(id),
-                    _ => true,
-                }
+    for key in ["panel", "anchor", "before", "target"] {
+        match fields.get(key) {
+            None | Some(Value::Null) => {}
+            Some(value) => {
+                // Docks and frames open beside the canvas, so it may be an anchor or a target.
+                let canvas = key != "panel" && value.as_str().is_some_and(|raw| raw.trim().eq_ignore_ascii_case(CANVAS));
+                let panel = if canvas { Some(CANVAS) } else { value.as_str().and_then(normalize) };
+                let panel = panel.ok_or_else(|| format!("{key} must name a registered panel"))?;
+                fields.insert(key.into(), json!(panel));
+            }
         }
-        Action::Open { panel, anchor } => registered(panel) && anchor.as_ref().is_none_or(registered),
-        Action::Float { panel, .. }
-        | Action::Close { panel }
-        | Action::Activate { panel }
-        | Action::MoveFloating { panel, .. }
-        | Action::SetStackOpen { panel, .. }
-        | Action::ResizeStack { panel, .. } => registered(panel),
-        Action::ResizeSplit { path, .. } => path.len() <= craft_ui::docking::MAX_DEPTH,
-    };
-    if !known {
-        return Err("docking action contains an unknown panel or an excessive split path".into());
     }
-    if app.ui.docking.as_ref().is_some_and(|layout| !valid(layout)) {
-        return Err("saved panel layout is invalid; reset the workspace first".into());
-    }
-    let mut layout = app.ui.docking.clone().unwrap_or_else(|| legacy(app));
-    let returning = match &action {
-        Action::Close { panel } => layout.location(panel).ok().map(|location| (panel.clone(), location)),
-        Action::Float { panel, .. } => layout.location(panel).ok().filter(|location| location.floating.is_none()).map(|location| (panel.clone(), location)),
-        _ => None,
-    };
-    let reveal = match &action {
-        Action::Activate { panel } => Some(panel.clone()),
-        _ => None,
-    };
-    let activate = match &action {
-        Action::Activate { panel } => PANELS.iter().find(|p| p.0 == panel).map(|p| p.2),
-        _ => None,
-    };
-    layout.apply(action).map_err(|error| error.to_string())?;
-    if let Some(group) = activate {
-        app.ui.dock.set_collapsed(group, false);
-    }
-    if let Some((panel, location)) = returning {
-        app.ui.docking_hidden.insert(panel, location);
-    }
-    if app.ui.docking.is_none() {
-        app.ui.docking_hidden.extend(migration_hidden(app, &layout));
-    }
-    app.ui.docking = Some(layout);
-    app.ui.panels.dock = true;
-    sync_visibility(app);
-    if let Some(panel) = reveal {
-        app.ui.docking_reveal = Some(panel.clone());
-        reveal_group(app, &panel);
-    }
-    Ok(json!({"layout": app.ui.docking}))
+    fields.insert("command".into(), json!(id));
+    let command: DockCommand<String> = serde_json::from_value(Value::Object(fields)).map_err(|error| error.to_string())?;
+    run(app, command)
 }
 
-fn change(app: &mut PhotocraftApp, operation: &str, params: &Value) -> Result<Value, String> {
-    if app.session.prefs().workspace_locked && operation != "activate" {
-        return Err("workspace is locked".into());
+/// UI output and automation share this atomic dispatcher: everything applies, or nothing.
+fn run(app: &mut PhotocraftApp, command: DockCommand<String>) -> Result<Value, String> {
+    if command.is_app_owned() {
+        return app_owned(app, command);
     }
-    let panel = params.get("panel").and_then(Value::as_str).and_then(normalize).ok_or("panel must name a registered panel")?;
-    if app.ui.docking.as_ref().is_some_and(|layout| !valid(layout)) {
-        return Err("saved panel layout is invalid; reset the workspace first".into());
-    }
-    let mut layout = app.ui.docking.clone().unwrap_or_else(|| legacy(app));
-    let migrated = if app.ui.docking.is_none() { migration_hidden(app, &layout) } else { app.ui.docking_hidden.clone() };
-    let mut hidden: std::collections::BTreeMap<_, _> =
-        migrated.iter().filter(|(id, _)| normalize(id).is_some()).take(64).map(|(id, at)| (id.clone(), at.clone())).collect();
-    let mut restored = false;
-    if operation == "dock"
-        && params.get("anchor").or_else(|| params.get("onto")).is_none()
-        && let Some(location) = hidden.get(panel).filter(|location| {
-            location.floating.is_none()
-                && location.anchor.as_ref().is_none_or(|anchor| Layout { root: layout.root.clone(), floating: Vec::new() }.contains(anchor))
-        })
-    {
-        let mut candidate = layout.clone();
-        if candidate.contains(&panel.to_string()) {
-            candidate.apply(Action::Close { panel: panel.into() }).map_err(|e| e.to_string())?;
-        }
-        if candidate.restore(panel.into(), location).is_ok() {
-            layout = candidate;
-            restored = true;
-            hidden.remove(panel);
+    if let DockCommand::Lock { locked } = command {
+        let on = locked.unwrap_or(!app.session.prefs().workspace_locked);
+        app.session.prefs.edit(|p| p.workspace_locked = on);
+        if let Some(workspace) = app.ui.docking.as_mut() {
+            workspace.locked = on;
         }
+        return Ok(json!({"locked": on}));
     }
-    match operation {
-        "dock" if restored => {}
-        "float" => {
-            let rect = [number(params, "x", 400.0)?, number(params, "y", 140.0)?, number(params, "width", 300.0)?, number(params, "height", 400.0)?];
-            ensure(&mut layout, panel)?;
-            if let Ok(location) = layout.location(&panel.to_string())
+    let mut workspace = workspace_of(app)?;
+    let mut returns = app.ui.docking_returns.clone();
+    let panel = command_panel(&command).cloned();
+    // A hidden panel a command moves is shown first, as the Window menu shows it.
+    if let Some(panel) = panel.as_ref().filter(|_| !closes(&command)) {
+        ensure(app, &mut workspace, panel)?;
+    }
+    let space = FloatSpace::new(FLOAT_AREA);
+    let rtl = crate::direction::is_rtl();
+    let closed = match &command {
+        DockCommand::Dock { panel, anchor: None, side: None, zone: None, group: false, column: false, .. } if dock_back(&mut workspace, &returns, panel)? => {
+            Vec::new()
+        }
+        DockCommand::Float { panel, x, y, width, height, group: false, column: false } => {
+            if let Ok(location) = workspace.layout.location(panel)
                 && location.floating.is_none()
             {
-                hidden.insert(panel.into(), location);
+                returns.insert(panel.clone(), location);
             }
-            layout.apply(Action::Float { panel: panel.into(), rect }).map_err(|e| e.to_string())?;
-        }
-        "move" | "dock" => {
-            if operation == "move" && params.get("anchor").or_else(|| params.get("onto")).is_none() {
-                return Err("move requires a destination panel".into());
-            }
-            let anchor = match params.get("anchor").or_else(|| params.get("onto")) {
-                Some(v) => Some(v.as_str().and_then(normalize).ok_or("anchor must name a registered panel")?.to_string()),
-                None => first_root(&layout, panel),
+            let sized = DockCommand::Float {
+                panel: panel.clone(),
+                x: *x,
+                y: *y,
+                width: width.or(Some(FLOAT_SIZE.x)),
+                height: height.or(Some(FLOAT_SIZE.y)),
+                group: false,
+                column: false,
             };
-            let placement = placement(params)?;
-            if let Some(anchor) = anchor {
-                ensure(&mut layout, panel)?;
-                layout.apply(Action::Move { panel: panel.into(), anchor, placement }).map_err(|e| e.to_string())?;
-            } else if operation == "dock" {
-                if layout.contains(&panel.to_string()) {
-                    layout.apply(Action::Close { panel: panel.into() }).map_err(|e| e.to_string())?;
-                }
-                layout.apply(Action::Open { panel: panel.into(), anchor: None }).map_err(|e| e.to_string())?;
-            } else {
-                return Err("move requires an existing destination panel".into());
+            sized.apply(&mut workspace, rtl, &space, permissions).map_err(|e| e.to_string())?
+        }
+        DockCommand::Window { panel, native } if native.unwrap_or(true) => {
+            if workspace.layout.floating.iter().any(|window| window.id == PROPERTIES_WINDOW && window.contains(panel)) {
+                return Err("the Properties card stays over the canvas; float the panel out of it first".into());
             }
-        }
-        "close" => {
-            hidden.insert(panel.into(), layout.location(&panel.to_string()).map_err(|e| e.to_string())?);
-            layout.apply(Action::Close { panel: panel.into() }).map_err(|e| e.to_string())?;
-        }
-        _ => {
-            if !layout.contains(&panel.to_string()) && hidden.contains_key(panel) {
-                // A missing neighbor is allowed: the normal visible dock becomes the fallback.
-                restore_hidden(&mut layout, &mut hidden, panel);
+            if let Ok(location) = workspace.layout.location(panel)
+                && location.floating.is_none()
+            {
+                returns.insert(panel.clone(), location);
             }
-            ensure(&mut layout, panel)?;
-            layout.apply(Action::Activate { panel: panel.into() }).map_err(|e| e.to_string())?;
-            hidden.remove(panel);
+            command.apply(&mut workspace, rtl, &space, permissions).map_err(|e| e.to_string())?
         }
+        command => command.apply(&mut workspace, rtl, &space, permissions).map_err(|e| e.to_string())?,
+    };
+    if !valid_workspace(&workspace) {
+        return Err("docking action contains an unknown panel".into());
     }
-    app.ui.docking = Some(layout);
-    app.ui.docking_hidden = hidden;
-    app.ui.panels.dock = true;
-    sync_visibility(app);
-    if operation == "activate"
-        && let Some((_, _, group)) = PANELS.iter().find(|p| p.0 == panel)
+    let reveal = panel.filter(|_| reveals(&command));
+    if let Some(panel) = &reveal
+        && workspace.layout.panel_state(panel) != PanelState::Front
     {
-        app.ui.dock.set_collapsed(*group, false);
-        app.ui.docking_reveal = Some(panel.to_owned());
+        // A minimized window opens again; where nothing is minimized the action is refused.
+        let _ = workspace.apply(Action::SetMinimized { panel: panel.clone(), minimized: false }, permissions);
+    }
+    commit(app, workspace, returns);
+    if let Some(panel) = &reveal {
+        if let Some((_, _, group)) = PANELS.iter().find(|p| p.0 == panel) {
+            app.ui.dock.set_collapsed(*group, false);
+        }
+        app.ui.docking_reveal = Some(panel.clone());
         reveal_group(app, panel);
     }
-    Ok(json!({"panel": panel, "layout": app.ui.docking}))
+    let layout = app.ui.docking.as_ref().map(|workspace| &workspace.layout);
+    Ok(json!({"panel": command_panel(&command), "layout": layout, "closed": closed}))
 }
 
-pub(crate) fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> bool {
-    let area = egui::Id::new("photocraft-panel-docking");
-    let stale_origin =
-        ui.ctx().data_mut(|data| data.get_temp::<LegacyDrag>(area.with("legacy-origin")).is_some_and(|origin| origin.generation != app.ui.docking_generation));
+/// Return a floating panel to where it floated from, if that place is still in the dock.
+fn dock_back(workspace: &mut Workspace, returns: &Returns, panel: &String) -> Result<bool, String> {
+    let Some(location) = returns.get(panel).filter(|_| floats(&workspace.layout, panel)) else { return Ok(false) };
+    if workspace.locked {
+        return Err("workspace is locked".into());
+    }
+    let docked = Layout { root: workspace.layout.root.clone(), floating: Vec::new() };
+    if location.anchor.as_ref().is_some_and(|anchor| !docked.contains(anchor)) {
+        return Ok(false);
+    }
+    let mut layout = workspace.layout.clone();
+    layout.apply(Action::Close { panel: panel.clone() }).map_err(|e| e.to_string())?;
+    if layout.restore(panel.clone(), location).is_err() || !valid(&layout) {
+        return Ok(false);
+    }
+    workspace.layout = layout;
+    Ok(true)
+}
+
+/// Named workspaces and Reset are PhotoCraft's (Window › Workspace).
+fn app_owned(app: &mut PhotocraftApp, command: DockCommand<String>) -> Result<Value, String> {
+    let (id, params) = match command {
+        DockCommand::Workspace { name } => ("window.workspace.select", json!({"name": name})),
+        DockCommand::NewWorkspace { name } => ("window.workspace.newWorkspace", json!({"name": name})),
+        DockCommand::DeleteWorkspace { name } => ("window.workspace.deleteWorkspace", json!({"name": name})),
+        DockCommand::ResetWorkspace {} => {
+            crate::menus::apply_workspace(app);
+            return Ok(json!({"workspace": app.ui.workspace}));
+        }
+        _ => return Err("not a workspace command".into()),
+    };
+    crate::workspace_ui::menu(app, id, &params).unwrap_or_else(|| Err(format!("`{id}` is not available")))
+}
+
+/// Draw the layout, the canvas included, in the space `ui` has left: the customized workspace,
+/// else the native dock's arrangement.
+pub(crate) fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
+    let area = area_id();
     let changed_workspace = ui.ctx().data_mut(|data| {
         let previous = data.get_temp::<u64>(area.with("generation"));
         data.insert_temp(area.with("generation"), app.ui.docking_generation);
         previous.is_some_and(|generation| generation != app.ui.docking_generation)
     });
-    if changed_workspace || stale_origin {
-        ui.ctx().data_mut(|data| data.insert_temp(area.with("legacy-suppressed"), true));
+    if changed_workspace {
         craft_ui::docking::cancel_drag::<String>(ui.ctx(), area);
-        ui.ctx().data_mut(|data| data.remove::<LegacyDrag>(area.with("legacy-origin")));
     }
-
-    let cancelled =
-        ui.input(|input| !input.focused || input.key_pressed(egui::Key::Escape) || (!input.pointer.primary_down() && !input.pointer.any_released()));
-    if cancelled && cancel_legacy_drag(app, ui.ctx()) {
-        ui.ctx().data_mut(|data| data.insert_temp(area.with("legacy-suppressed"), true));
-        if app.ui.docking.is_none() {
-            return false;
-        }
-    }
-    let Some(layout) = app.ui.docking.as_ref() else { return false };
-    if !valid(layout) {
+    if app.ui.docking.as_ref().is_some_and(|workspace| !valid_workspace(workspace)) {
         app.ui.docking = None;
+        app.ui.docking_returns.clear();
         let message = "Invalid panel layout; restored the default dock";
         app.ui.status = tl!(message).into();
-        return false;
     }
-    let layout = layout.clone();
+    if let Some(width) = ui.ctx().data_mut(|data| data.remove_temp::<f32>(crate::panels::dock_width_id())) {
+        let range = crate::panels::dock_width_range(ui.ctx().content_rect().width());
+        set_dock_width(app, width.clamp(*range.start(), *range.end()));
+    }
+    native_dock_width(app, ui.ctx());
+    let layout = match &app.ui.docking {
+        Some(workspace) => workspace.layout.clone(),
+        None => legacy(app),
+    };
+    let collapsed = collapsed_members(app, &layout);
+    let layout = presented(layout, &collapsed);
+    let fillers = fillers(&layout);
     let reveal = app.ui.docking_reveal.take();
     let t = crate::theme::Tokens::get(ui.ctx());
     let locked = app.session.prefs().workspace_locked;
-    let collapsed = collapsed_members(app, &layout);
-    let requested_width = ui.ctx().data_mut(|data| data.remove_temp::<f32>(crate::panels::dock_width_id()));
+    let mut style = craft_ui::docking::DockStyle::from_ui(ui);
+    style.tab_height = if t.pro { 28.0 } else { 40.0 };
+    style.min_pane = 0.0;
+    style.background = t.card;
+    // Studio themes leave the strip transparent over the dock's card; a floating group has no
+    // card behind it, so the canvas showed through its titles (#4509).
+    style.tab_background = if t.tab_strip.a() == 0 { t.card } else { t.tab_strip };
+    style.active_background = t.card;
+    style.text = t.text;
+    style.inactive_text = t.text_dim;
+    style.border = egui::Stroke::new(1.0, t.card_border);
+    style.accent = t.accent;
+    style.right_to_left = crate::direction::is_rtl();
+    style.new_dock_zones = true;
+    let style = style.localized(|key| DOCK_LABELS.iter().find(|(k, _)| *k == key).map(|(_, english)| tl!(english).to_string()));
+    let mut dock = craft_ui::docking::DockArea::new(area)
+        .locked(locked)
+        .auto_collapse_iconic(app.session.prefs().workspace.auto_collapse_icon_panels)
+        .input_blocked(modal_open(app, ui.ctx()));
+    if let Some(panel) = &reveal {
+        dock = dock.raise_panel(panel.clone());
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        dock = dock.native_input_hook(native_input_hook(ui.ctx()));
+    }
     let mut commands = Vec::new();
-    let mut targets = Vec::new();
-    let mut draw = |ui: &mut egui::Ui| {
-        let mut style = craft_ui::docking::DockStyle::from_ui(ui);
-        style.tab_height = if t.pro { 28.0 } else { 40.0 };
-        style.min_pane = 0.0;
-        style.background = t.card;
-        // Studio themes leave the strip transparent over the dock's card; a floating group has no
-        // card behind it, so the canvas showed through its titles (#4509).
-        style.tab_background = if t.tab_strip.a() == 0 { t.card } else { t.tab_strip };
-        style.active_background = t.card;
-        style.text = t.text;
-        style.inactive_text = t.text_dim;
-        style.border = egui::Stroke::new(1.0, t.card_border);
-        style.accent = t.accent;
-        style.float_label = tl!("Float Panel").to_string();
-        style.close_label = tl!("Close Panel").to_string();
-        style.move_label = tl!("Group with").to_string();
-        style.panels_label = tl!("Panels").to_string();
-        style.resize_label = tl!("Resize panels").to_string();
-        style.resize_window_label = tl!("Resize panel window").to_string();
-        let mut area = craft_ui::docking::DockArea::new(egui::Id::new("photocraft-panel-docking"));
-        if let Some(panel) = &reveal {
-            area = area.raise_panel(panel.clone());
-        }
-        area.show_customized(
-            ui,
-            &layout,
-            &style,
-            |id| PANELS.iter().find(|p| p.0 == id).map(|p| tl!(p.1).to_string()).unwrap_or_else(|| id.clone()),
-            |_| craft_ui::docking::Permissions { movable: !locked, floatable: !locked, closable: !locked, accepts_tabs: !locked },
-            |id| {
-                if collapsed.contains(id) {
-                    craft_ui::docking::PanelLimits { min: egui::vec2(220.0, 0.0), max: egui::vec2(1_000_000.0, 0.0) }
-                } else {
-                    // Layers owns its row scroll and footer; leave room for its fixed controls
-                    // plus a scrolling row area instead of clipping the footer after a split.
-                    let height = if id == "layers" { 220.0 } else { 80.0 };
-                    craft_ui::docking::PanelLimits { min: egui::vec2(220.0, height), ..Default::default() }
-                }
-            },
-            &mut PanelContent { app, collapsed: &collapsed, commands: &mut commands, targets: &mut targets },
-        )
-    };
-    let output = if layout.root.is_some() {
-        let mut panel = egui::Panel::right("shared-panel-dock")
-            .default_size(if t.pro { 290.0 } else { 300.0 })
-            .size_range(crate::panels::dock_width_range(ui.ctx().content_rect().width()))
-            .resizable(!locked)
-            .frame(egui::Frame::NONE.fill(t.card));
-        if let Some(width) = requested_width {
-            panel = panel.exact_size(width);
-        }
-        panel.show(ui, &mut draw).inner
-    } else {
-        draw(ui)
-    };
-    if let Some(error) = output.error {
+    let strip = style.tab_height;
+    let card: std::collections::HashSet<String> =
+        layout.floating.iter().filter(|window| window.id == PROPERTIES_WINDOW).flat_map(|window| window.panels().cloned()).collect();
+    #[cfg(test)]
+    ui.ctx().data_mut(|data| data.insert_temp(bodies_id(), Vec::<(String, egui::Rect)>::new()));
+    // The panel windows' passes, inside this call, note their keyboard focus again.
+    keyboard_focus(ui.ctx()).lock().unwrap_or_else(|e| e.into_inner()).clear();
+    let mut output = dock.show_customized(
+        ui,
+        &layout,
+        &style,
+        |id| PANELS.iter().find(|p| p.0 == id).map(|p| tl!(p.1).to_string()).unwrap_or_else(|| id.clone()),
+        permissions,
+        |id| {
+            if id == CANVAS {
+                craft_ui::docking::PanelLimits { min: egui::vec2(200.0, 120.0), ..Default::default() }
+            } else if collapsed.contains(id) {
+                craft_ui::docking::PanelLimits { min: egui::vec2(220.0, 0.0), max: egui::vec2(1_000_000.0, 0.0) }
+            } else {
+                // The native group's smallest height, tab strip included.
+                let height = PANELS.iter().find(|p| p.0 == id).map_or(80.0, |p| p.2.min_height() - strip);
+                craft_ui::docking::PanelLimits { min: egui::vec2(220.0, height), ..Default::default() }
+            }
+        },
+        &mut PanelContent { app, collapsed: &collapsed, fillers: &fillers, card: &card, strip, commands: &mut commands },
+    );
+    if let Some(error) = output.error.take() {
         app.ui.status = error.to_string();
     }
-    if ui.input(|input| input.pointer.any_released()) {
-        if !output.actions.iter().any(|action| matches!(action, Action::Move { .. } | Action::Float { .. })) && cancel_legacy_drag(app, ui.ctx()) {
-            return app.ui.docking.is_some();
-        }
-        ui.ctx().data_mut(|data| data.remove::<LegacyDrag>(egui::Id::new("photocraft-panel-docking").with("legacy-origin")));
-    }
-    if let Some(panel) = output.group_drag.as_ref()
-        && let Some(pointer) = ui.ctx().pointer_interact_pos()
-    {
-        let members = group_members(&layout, panel);
-        let eligible: Vec<_> = targets.iter().filter(|target| !members.contains(&target.anchor)).cloned().collect();
-        if let Some(proposal) = craft_ui::docking::resolve_drop(panel, pointer, &eligible) {
-            ui.painter().rect_stroke(proposal.preview, 0.0, egui::Stroke::new(2.0, t.accent), egui::StrokeKind::Inside);
-        }
-    }
-    if let Some((panel, pointer)) = output.group_drop {
-        let members = group_members(&layout, &panel);
-        let eligible: Vec<_> = targets.iter().filter(|target| !members.contains(&target.anchor)).cloned().collect();
-        if let Some(proposal) = craft_ui::docking::resolve_drop(&panel, pointer, &eligible) {
-            commands.push(("window.panel.group", json!({"panel":panel,"operation":"move","anchor":proposal.anchor,"placement":proposal.placement})));
-        }
-    }
-    for action in output.actions {
-        if let Err(error) = app.run("window.panel.layout", json!({"action": action})) {
+    #[cfg(not(target_arch = "wasm32"))]
+    open_window_drops(app, ui.ctx(), std::mem::take(&mut output.window_files));
+    // Keys pressed in a floating panel's own OS window run the main window's shortcuts.
+    let forwarded = std::mem::take(&mut output.forwarded_events);
+    crate::shortcuts::handle_forwarded(app, ui.ctx(), forwarded, output.forwarded_modifiers.unwrap_or_default());
+    let mut actions = output.actions;
+    pin_group_heights(ui.ctx(), &layout, &mut actions);
+    for action in actions {
+        let result = match action {
+            // A dock group minimizes as PhotoCraft's collapsed group, which the native dock's
+            // collapse also sets.
+            Action::SetMinimized { panel, minimized } if in_dock_column(&layout, &panel) => {
+                group_command(app, &json!({"panel": panel, "operation": if minimized {"collapse"} else {"expand"}}))
+            }
+            action => app.run("window.panel.layout", json!({"action": action})),
+        };
+        if let Err(error) = result {
             app.ui.status = error;
         }
     }
@@ -492,81 +638,272 @@ pub(crate) fn show(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> bool {
             app.ui.status = error;
         }
     }
-    crate::dock::persist(app, ui.ctx());
-    true
 }
 
-pub(crate) fn legacy_tab(app: &mut PhotocraftApp, ui: &mut egui::Ui, panel: &str, response: &egui::Response) {
-    let suppressed = egui::Id::new("photocraft-panel-docking").with("legacy-suppressed");
-    if ui.input(|input| input.pointer.button_pressed(egui::PointerButton::Primary)) {
-        ui.ctx().data_mut(|data| data.remove::<bool>(suppressed));
+/// A modal dialog or workspace is open. egui's `Modal` blocks input only in the window it shows
+/// in, so the floating panels' own OS windows are blocked meanwhile (`DockArea::input_blocked`).
+/// The app's dialogs count from the frame they open; any other egui modal (a format's options,
+/// a job's progress) from the frame after it first shows.
+pub(crate) fn modal_open(app: &PhotocraftApp, ctx: &egui::Context) -> bool {
+    !app.ui.dialogs.is_empty()
+        || app.ui.layers_panel_dialog.is_some()
+        || app.discard.is_some()
+        || app.camera_raw.is_some()
+        || crate::distort_ui::modal_workspace(app).is_some()
+        || !ctx.memory(|memory| memory.is_above_modal_layer(egui::LayerId::background()))
+}
+
+/// The viewports of the floating windows that may have OS windows of their own. Where egui
+/// embeds viewports, and on the web, every floating window stays in the main window.
+pub(crate) fn native_viewports(app: &PhotocraftApp, ctx: &egui::Context) -> Vec<egui::ViewportId> {
+    #[cfg(not(target_arch = "wasm32"))]
+    if !ctx.embed_viewports()
+        && let Some(workspace) = &app.ui.docking
+    {
+        return workspace
+            .layout
+            .floating
+            .iter()
+            .filter(|window| window.id != PROPERTIES_WINDOW)
+            .map(|window| craft_ui::docking::DockArea::<String>::window_viewport(area_id(), window.id))
+            .collect();
     }
-    if ui.ctx().data(|data| data.get_temp::<bool>(suppressed)).unwrap_or(false) || app.session.prefs().workspace_locked {
+    let _ = (app, ctx);
+    Vec::new()
+}
+
+/// The main window's `raw_input_hook` rewrites that floating panels' own windows need too:
+/// Ctrl+click is a secondary click on macOS. Each window keeps its own press state.
+#[cfg(not(target_arch = "wasm32"))]
+fn native_input_hook(ctx: &egui::Context) -> impl FnMut(&egui::Context, &mut egui::RawInput) + Send + 'static {
+    type Clicks = std::sync::Arc<std::sync::Mutex<std::collections::HashMap<egui::ViewportId, crate::control_click::ControlClick>>>;
+    let clicks = ctx.data_mut(|data| data.get_temp_mut_or_default::<Clicks>(area_id().with("control-click")).clone());
+    move |_, raw| {
+        let mut clicks = clicks.lock().unwrap_or_else(|e| e.into_inner());
+        clicks.entry(raw.viewport_id).or_default().normalize(&mut raw.events, cfg!(target_os = "macos"));
+    }
+}
+
+/// The floating panels' own windows where a widget had keyboard focus in their last pass.
+type KeyboardFocus = std::sync::Arc<std::sync::Mutex<std::collections::HashSet<egui::ViewportId>>>;
+
+fn keyboard_focus(ctx: &egui::Context) -> KeyboardFocus {
+    ctx.data_mut(|data| data.get_temp_mut_or_default::<KeyboardFocus>(area_id().with("keyboard-focus")).clone())
+}
+
+/// Another of the app's windows has the keyboard, by this frame's viewport infos: `Some(true)`
+/// when it is a floating panel's own window and one of its widgets has keyboard focus.
+pub(crate) fn other_window_keyboard(ctx: &egui::Context) -> Option<bool> {
+    let window = ctx.input(|i| i.raw.viewports.iter().find(|(id, info)| **id != egui::ViewportId::ROOT && info.focused == Some(true)).map(|(id, _)| *id))?;
+    Some(keyboard_focus(ctx).lock().unwrap_or_else(|e| e.into_inner()).contains(&window))
+}
+
+/// Files dropped on a floating panel's own OS window open as documents, as files dropped on the
+/// main window away from the canvas and the tab strip do, and the main window comes forward.
+#[cfg(not(target_arch = "wasm32"))]
+fn open_window_drops(app: &mut PhotocraftApp, ctx: &egui::Context, windows: Vec<craft_ui::docking::WindowFiles<String>>) {
+    let dropped: Vec<egui::DroppedFileHandle> = windows.into_iter().flat_map(|window| window.dropped).collect();
+    if !dropped.is_empty() {
+        app.open_dropped(ctx, dropped, None);
+        ctx.send_viewport_cmd_to(egui::ViewportId::ROOT, egui::ViewportCommand::Focus);
+    }
+}
+
+/// A divider drag pins the other open groups of its column at the heights they show, so groups
+/// still at their defaults, which give way to the filler, don't shift while one is resized. The
+/// last open group fills the column and stays unpinned.
+fn pin_group_heights(ctx: &egui::Context, layout: &Layout<String>, actions: &mut Vec<Action<String>>) {
+    use craft_ui::docking::{DockArea, Hit};
+    let resized: Vec<String> = actions.iter().filter_map(|a| if let Action::ResizeGroup { panel, .. } = a { Some(panel.clone()) } else { None }).collect();
+    if resized.is_empty() {
         return;
     }
-    let Some(panel) = normalize(panel) else { return };
-    // Native tab reordering and vertical whole-group moves stay in the dock.
-    // Crossing the dock column horizontally detaches through the shared layout.
-    let strip = egui::Rect::from_min_max(egui::pos2(ui.max_rect().left(), response.rect.top()), egui::pos2(ui.max_rect().right(), response.rect.bottom()));
-    if response.dragged()
-        && ui.input(|input| input.focused && input.pointer.primary_down() && !input.key_pressed(egui::Key::Escape))
-        && ui.ctx().pointer_interact_pos().is_some_and(|position| position.x < strip.left() - 24.0 || position.x > strip.right() + 24.0)
-        && let Some(id) = normalize(panel)
-    {
-        let mut layout = app.ui.docking.clone().unwrap_or_else(|| legacy(app));
-        let bounds = ui.max_rect();
-        let source = egui::Rect::from_min_size(
-            egui::pos2(bounds.left(), response.rect.top()),
-            egui::vec2(bounds.width().clamp(240.0, 600.0), bounds.height().clamp(200.0, 600.0)),
-        );
-        if ensure(&mut layout, id).is_ok() && craft_ui::docking::begin_drag(ui.ctx(), egui::Id::new("photocraft-panel-docking"), id.to_string(), source) {
-            ui.ctx().data_mut(|data| {
-                data.insert_temp(
-                    egui::Id::new("photocraft-panel-docking").with("legacy-origin"),
-                    LegacyDrag {
-                        generation: app.ui.docking_generation,
-                        layout: app.ui.docking.clone(),
-                        tabs: app.ui.dock_tabs,
-                        hidden: app.ui.docking_hidden.clone(),
-                    },
-                )
-            });
-            if app.ui.docking.is_none() {
-                app.ui.docking_hidden = migration_hidden(app, &layout);
+    let hits = DockArea::<String>::hit_rects(ctx, area_id());
+    let mut pins = Vec::new();
+    let mut pending: Vec<&Node<String>> = layout.root.iter().collect();
+    while let Some(node) = pending.pop() {
+        match node {
+            Node::Split { first, second, .. } => pending.extend([first.as_ref(), second.as_ref()]),
+            Node::Dock { columns, .. } => {
+                for column in columns.iter().filter(|c| c.groups.iter().any(|g| g.panels.first().is_some_and(|p| resized.contains(p)))) {
+                    let open: Vec<_> = column.groups.iter().filter(|g| !g.minimized).collect();
+                    for group in open.iter().take(open.len().saturating_sub(1)).filter(|g| g.height.is_none()) {
+                        let Some(first) = group.panels.first().filter(|p| !resized.contains(p)) else { continue };
+                        let top = hits
+                            .iter()
+                            .filter(|(hit, _)| matches!(hit, Hit::Tab(p) | Hit::DragBar(p) if group.panels.contains(p)))
+                            .map(|(_, rect)| rect.top())
+                            .reduce(f32::min);
+                        let bottom =
+                            hits.iter().find(|(hit, _)| *hit == Hit::Divider(craft_ui::docking::Divider::Group(first.clone()))).map(|(_, r)| r.center().y);
+                        if let (Some(top), Some(bottom)) = (top, bottom) {
+                            pins.push(Action::ResizeGroup { panel: first.clone(), height: Some(bottom - top) });
+                        }
+                    }
+                }
             }
-            app.ui.docking = Some(layout);
+            _ => {}
         }
     }
+    actions.splice(0..0, pins);
+}
+
+/// `ui.set {dockWidth}`: the width of the end dock's outer column.
+fn set_dock_width(app: &mut PhotocraftApp, width: f32) {
+    let Ok(mut workspace) = workspace_of(app) else { return };
+    let outer = match workspace.layout.root.as_ref() {
+        Some(Node::Split { second, .. }) => match second.as_ref() {
+            Node::Dock { columns, .. } => columns.first().map(|column| (column.width, column.groups.iter().flat_map(|g| g.panels.first()).next().cloned())),
+            _ => None,
+        },
+        _ => None,
+    };
+    let Some((current, Some(panel))) = outer else { return };
+    if current == width {
+        return;
+    }
+    workspace.locked = false;
+    if workspace.apply(Action::ResizeColumn { panel, width }, permissions).is_ok() {
+        workspace.locked = app.session.prefs().workspace_locked;
+        let returns = app.ui.docking_returns.clone();
+        commit(app, workspace, returns);
+    }
+}
+
+/// A dock width saved by earlier versions is in egui's remembered memory under the `dock` side
+/// panel's id. The default layout's column takes it once, after the canvas has been laid out so
+/// the Studio Properties card keeps its place.
+fn native_dock_width(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    let id = crate::panels::panel_state_id(ctx, "dock");
+    let Some(state) = ctx.data_mut(|data| data.get_persisted::<egui::PanelState>(id)) else { return };
+    if app.ui.docking.is_none() && !app.last_canvas_rect.is_positive() {
+        return;
+    }
+    ctx.data_mut(|data| data.remove::<egui::PanelState>(id));
+    let pro = app.ui.theme.is_pro();
+    let range = crate::panels::dock_width_range(ctx.content_rect().width());
+    let width = state.size().x;
+    if app.ui.docking.is_none() && width.is_finite() && (width - default_width(pro)).abs() >= 1.0 {
+        set_dock_width(app, width.clamp(*range.start(), *range.end()));
+    }
+}
+
+/// `layout` as drawn: a dock group whose panels are all collapsed shows only its tab strip.
+fn presented(mut layout: Layout<String>, collapsed: &std::collections::HashSet<String>) -> Layout<String> {
+    let mut pending: Vec<&mut Node<String>> = layout.root.iter_mut().collect();
+    while let Some(node) = pending.pop() {
+        match node {
+            Node::Split { first, second, .. } => pending.extend([first.as_mut(), second.as_mut()]),
+            Node::Dock { columns, .. } => {
+                for group in columns.iter_mut().flat_map(|c| c.groups.iter_mut()) {
+                    group.minimized |= group.panels.iter().all(|id| collapsed.contains(id));
+                }
+            }
+            _ => {}
+        }
+    }
+    layout
+}
+
+/// The panels of each dock column's last open group, which fills the column.
+fn fillers(layout: &Layout<String>) -> std::collections::HashSet<String> {
+    let mut out = std::collections::HashSet::new();
+    let mut pending: Vec<&Node<String>> = layout.root.iter().collect();
+    while let Some(node) = pending.pop() {
+        match node {
+            Node::Split { first, second, .. } => pending.extend([first.as_ref(), second.as_ref()]),
+            Node::Dock { columns, .. } => {
+                for column in columns {
+                    out.extend(column.groups.iter().rev().find(|g| !g.minimized).into_iter().flat_map(|g| g.panels.iter().cloned()));
+                }
+            }
+            _ => {}
+        }
+    }
+    out
 }
 
 fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, id: &str) {
     let Some((_, label, group)) = PANELS.iter().find(|p| p.0 == id) else { return };
     let pro = crate::theme::Tokens::get(ui.ctx()).pro;
     let Some(tab) = group.tabs(pro).iter().position(|name| name == label) else { return };
-    *group.tab_mut(&mut app.ui.dock_tabs) = tab;
+    // The native group's selected tab is this panel while its body draws, so a custom group
+    // holding several of the group's panels keeps the selection `sync_visibility` chose.
+    let shown = std::mem::replace(group.tab_mut(&mut app.ui.dock_tabs), tab);
     if group.scrolls_itself(tab) {
+        ui.set_min_height(ui.available_height().max(0.0));
         crate::panels::dock_body(app, ui, *group, tab);
     } else {
         crate::panels::offer_color_field_fill(ui, pro, *group, tab);
+        // No scroll fade: it darkens real colours, swatches and previews at the edge (#2726).
+        ui.spacing_mut().scroll.fade.strength = 0.0;
         egui::ScrollArea::vertical()
             .id_salt(("shared-panel-body", id))
             .auto_shrink([false, false])
             .show(ui, |ui| crate::panels::dock_body(app, ui, *group, tab));
     }
     let selected = *group.tab_mut(&mut app.ui.dock_tabs);
-    if selected != tab
-        && let Some(label) = group.tabs(pro).get(selected)
-    {
+    if selected == tab {
+        *group.tab_mut(&mut app.ui.dock_tabs) = shown;
+    } else if let Some(label) = group.tabs(pro).get(selected) {
         let _ = app.run("window.panel.activate", json!({"panel":label}));
     }
 }
 
+/// Where tests find panels and docking controls as drawn last frame.
+#[cfg(test)]
+pub(crate) mod probe {
+    use super::*;
+    use craft_ui::docking::{DockArea, Hit};
+    use egui::Rect;
+
+    pub(crate) fn hit_rect(ctx: &egui::Context, hit: &Hit<String>) -> Option<Rect> {
+        DockArea::<String>::hit_rects(ctx, area_id()).into_iter().find(|(drawn, _)| drawn == hit).map(|(_, rect)| rect)
+    }
+
+    pub(crate) fn tab_rect(ctx: &egui::Context, panel: &str) -> Option<Rect> {
+        hit_rect(ctx, &Hit::Tab(panel.to_owned()))
+    }
+
+    /// The body of `panel`, when it is its group's selected tab.
+    pub(crate) fn panel_rect(ctx: &egui::Context, panel: &str) -> Option<Rect> {
+        last_bodies(ctx).into_iter().find(|(id, _)| id == panel).map(|(_, rect)| rect)
+    }
+
+    /// The panels of the tab group holding `panel`, in tab order.
+    pub(crate) fn group_of(app: &PhotocraftApp, panel: &str) -> Vec<String> {
+        let layout = app.ui.docking.as_ref().map_or_else(|| legacy(app), |workspace| workspace.layout.clone());
+        group_members(&layout, panel)
+    }
+
+    /// The tab group holding `panel`: its tab strip and its selected panel's body.
+    pub(crate) fn group_rect(app: &PhotocraftApp, ctx: &egui::Context, panel: &str) -> Option<Rect> {
+        let members = group_of(app, panel);
+        let strip = DockArea::<String>::hit_rects(ctx, area_id()).into_iter().filter_map(|(hit, rect)| match hit {
+            Hit::Tab(p) | Hit::DragBar(p) | Hit::Border(p) | Hit::Overflow(p) => members.contains(&p).then_some(rect),
+            _ => None,
+        });
+        let bodies = last_bodies(ctx).into_iter().filter_map(|(id, rect)| members.contains(&id).then_some(rect));
+        strip.chain(bodies).reduce(|a, b| a.union(b))
+    }
+
+    /// [`group_rect`] of the first panel of the native `group` that is laid out.
+    pub(crate) fn native_group_rect(app: &PhotocraftApp, ctx: &egui::Context, group: Group) -> Option<Rect> {
+        PANELS.iter().filter(|p| p.2 == group).find_map(|p| group_rect(app, ctx, p.0))
+    }
+}
+
 #[cfg(test)]
 #[path = "panel_docking_tests.rs"]
 mod tests;
 
+#[cfg(test)]
+#[cfg(not(target_arch = "wasm32"))]
+#[path = "panel_docking_native_tests.rs"]
+mod native_tests;
+
 /// Return positions for panels already hidden in a legacy workspace.
-fn migration_hidden(app: &PhotocraftApp, visible: &Layout<String>) -> std::collections::BTreeMap<String, craft_ui::docking::Location<String>> {
+fn migration_hidden(app: &PhotocraftApp, visible: &Layout<String>) -> Vec<(String, Location<String>)> {
     let full = legacy_layout(app, true);
     PANELS
         .iter()
@@ -575,22 +912,54 @@ fn migration_hidden(app: &PhotocraftApp, visible: &Layout<String>) -> std::colle
         .collect()
 }
 
-fn group_members(layout: &Layout<String>, panel: &str) -> Vec<String> {
-    let mut pending: Vec<_> = layout.root.iter().collect();
+/// A tab group of a layout tree.
+struct TabGroup {
+    panels: Vec<String>,
+    active: usize,
+    /// In a dock column, where craft-ui minimizes it to its tab strip.
+    dock: bool,
+    minimized: bool,
+}
+
+/// The tab groups of a tree, top to bottom: frames, each accordion entry, and each dock
+/// column's groups.
+fn tree_groups(root: &Node<String>) -> Vec<TabGroup> {
+    let mut out = Vec::new();
+    let mut pending = vec![root];
     while let Some(node) = pending.pop() {
         match node {
             Node::Split { first, second, .. } => pending.extend([second.as_ref(), first.as_ref()]),
-            Node::Tabs { panels, .. } if panels.iter().any(|id| id == panel) => return panels.clone(),
-            Node::Stack { entries } if entries.iter().any(|entry| entry.panel == panel) => return vec![panel.to_owned()],
+            Node::Tabs { panels, active } => out.push(TabGroup { panels: panels.clone(), active: *active, dock: false, minimized: false }),
+            Node::Stack { entries } => out.extend(entries.iter().map(|e| TabGroup { panels: vec![e.panel.clone()], active: 0, dock: false, minimized: false })),
+            Node::Dock { columns, .. } => out.extend(columns.iter().flat_map(|c| &c.groups).map(|g| TabGroup {
+                panels: g.panels.clone(),
+                active: g.active,
+                dock: true,
+                minimized: g.minimized,
+            })),
             _ => {}
         }
     }
-    layout.floating.iter().find(|group| group.panels.iter().any(|id| id == panel)).map(|group| group.panels.clone()).unwrap_or_default()
+    out
+}
+
+/// The tab group holding `panel` in a tree; an accordion entry is a group of its own.
+fn tree_group(root: &Node<String>, panel: &str) -> Option<Vec<String>> {
+    tree_groups(root).into_iter().find(|group| group.panels.iter().any(|id| id == panel)).map(|group| group.panels)
+}
+
+/// Is `panel` in a group of a docked dock column?
+fn in_dock_column(layout: &Layout<String>, panel: &str) -> bool {
+    layout.root.iter().flat_map(tree_groups).any(|group| group.dock && group.panels.iter().any(|id| id == panel))
+}
+
+fn group_members(layout: &Layout<String>, panel: &str) -> Vec<String> {
+    layout.root.iter().chain(layout.floating.iter().map(|window| &window.root)).find_map(|root| tree_group(root, panel)).unwrap_or_default()
 }
 
 fn reveal_group(app: &mut PhotocraftApp, panel: &str) {
-    if let Some(layout) = &app.ui.docking {
-        let members = group_members(layout, panel);
+    if let Some(workspace) = &app.ui.docking {
+        let members = group_members(&workspace.layout, panel);
         app.ui.docking_collapsed.retain(|id| !members.contains(id));
         for id in members {
             if let Some((_, _, group)) = PANELS.iter().find(|p| p.0 == id) {
@@ -601,22 +970,19 @@ fn reveal_group(app: &mut PhotocraftApp, panel: &str) {
 }
 
 pub(crate) fn rail_on(app: &PhotocraftApp, group: Group) -> bool {
-    app.ui.docking.as_ref().is_some_and(|layout| {
+    app.ui.docking.as_ref().is_some_and(|workspace| {
+        let layout = &workspace.layout;
         let collapsed = collapsed_members(app, layout);
         PANELS.iter().filter(|p| p.2 == group).any(|p| layout.contains(&p.0.to_owned()) && !collapsed.contains(p.0))
     })
 }
 
 pub(crate) fn rail_click(app: &mut PhotocraftApp, group: Group) {
-    let Some(layout) = app.ui.docking.as_ref() else { return };
-    let floating = PANELS.iter().filter(|p| p.2 == group).any(|p| layout.floating.iter().any(|g| g.panels.iter().any(|id| id == p.0)));
+    let Some(workspace) = app.ui.docking.as_ref() else { return };
+    let layout = &workspace.layout;
+    let floating = PANELS.iter().filter(|p| p.2 == group).any(|p| floats(layout, p.0));
     let existing = PANELS.iter().find(|p| p.2 == group && layout.contains(&p.0.to_owned())).map(|p| p.0);
-    let panel = existing.or_else(|| {
-        group
-            .tabs(matches!(app.ui.theme, crate::theme::ThemeKind::Pro | crate::theme::ThemeKind::ProMedium))
-            .get(*group.tab_mut(&mut app.ui.dock_tabs))
-            .and_then(|label| normalize(label))
-    });
+    let panel = existing.or_else(|| group.tabs(app.ui.theme.is_pro()).get(*group.tab_mut(&mut app.ui.dock_tabs)).and_then(|label| normalize(label)));
     if let Some(panel) = panel {
         let result = if existing.is_some() && rail_on(app, group) {
             if floating {
@@ -625,7 +991,7 @@ pub(crate) fn rail_click(app: &mut PhotocraftApp, group: Group) {
                 group_command(app, &json!({"panel": panel, "operation":"collapse"}))
             }
         } else {
-            change(app, "activate", &json!({"panel":panel}))
+            dock_command(app, "window.panel.activate", &json!({"panel":panel}))
         };
         if let Err(error) = result {
             app.ui.status = error;
@@ -633,105 +999,80 @@ pub(crate) fn rail_click(app: &mut PhotocraftApp, group: Group) {
     }
 }
 
+/// The docked tab groups, top to bottom, without the canvas.
 fn root_groups(layout: &Layout<String>) -> Vec<Vec<String>> {
-    let mut out = Vec::new();
-    let mut pending: Vec<_> = layout.root.iter().collect();
-    while let Some(node) = pending.pop() {
-        match node {
-            Node::Split { first, second, .. } => pending.extend([second.as_ref(), first.as_ref()]),
-            Node::Tabs { panels, .. } => out.push(panels.clone()),
-            Node::Stack { entries } => out.extend(entries.iter().map(|e| vec![e.panel.clone()])),
-        }
-    }
-    out
+    layout.root.iter().flat_map(tree_groups).map(|group| group.panels).filter(|panels| !panels.iter().any(|id| id == CANVAS)).collect()
 }
 
+/// `window.panel.group {panel, operation}`: PhotoCraft's commands for a panel's whole group.
 fn group_command(app: &mut PhotocraftApp, params: &Value) -> Result<Value, String> {
     let panel = params.get("panel").and_then(Value::as_str).and_then(normalize).ok_or("panel must name a registered panel")?;
     let operation = params.get("operation").and_then(Value::as_str).ok_or("operation is required")?;
     if app.session.prefs().workspace_locked {
         return Err("workspace is locked".into());
     }
-    let mut layout = app.ui.docking.clone().unwrap_or_else(|| legacy(app));
-    if !valid(&layout) {
-        return Err("invalid panel layout".into());
-    }
-    let members = group_members(&layout, panel);
+    let mut workspace = workspace_of(app)?;
+    let members = group_members(&workspace.layout, panel);
     if members.is_empty() {
         return Err("panel is hidden".into());
     }
-    let mut hidden = if app.ui.docking.is_none() { migration_hidden(app, &layout) } else { app.ui.docking_hidden.clone() };
-    let mut collapsed = collapsed_members(app, &layout);
+    let mut collapsed = collapsed_members(app, &workspace.layout);
     match operation {
         "close" => {
-            for id in &members {
-                hidden.insert(id.clone(), layout.location(id).map_err(|e| e.to_string())?);
-                layout.apply(Action::Close { panel: id.clone() }).map_err(|e| e.to_string())?;
-            }
-            collapsed.retain(|id| !members.contains(id));
-        }
-        "collapse" => {
-            collapsed.extend(members.iter().cloned());
-        }
-        "expand" => {
+            workspace.apply(Action::CloseGroup { panel: panel.to_owned() }, permissions).map_err(|e| e.to_string())?;
             collapsed.retain(|id| !members.contains(id));
         }
+        "collapse" => collapsed.extend(members.iter().cloned()),
+        "expand" => collapsed.retain(|id| !members.contains(id)),
         "move" => {
-            let anchor = params.get("anchor").and_then(Value::as_str).and_then(normalize).ok_or("anchor must name a registered panel")?;
-            let placement = params
-                .get("placement")
-                .map(|v| serde_json::from_value::<Placement<String>>(v.clone()).map_err(|e| e.to_string()))
-                .unwrap_or_else(|| placement(params))?;
-            if members.iter().any(|id| id == anchor) {
+            if params.get("anchor").and_then(Value::as_str).and_then(normalize).is_some_and(|anchor| members.iter().any(|id| id == anchor)) {
                 return Err("group cannot be moved into itself".into());
             }
-            let first = members.first().ok_or("group is empty")?;
-            layout.apply(Action::Move { panel: first.clone(), anchor: anchor.to_owned(), placement }).map_err(|e| e.to_string())?;
-            let destination = group_members(&layout, first);
-            let before = destination.iter().position(|id| id == first).and_then(|index| destination.get(index + 1)).cloned();
-            for id in members.iter().skip(1) {
-                layout
-                    .apply(Action::Move { panel: id.clone(), anchor: first.clone(), placement: Placement::Tab { before: before.clone() } })
-                    .map_err(|e| e.to_string())?;
+            let mut params = params.clone();
+            params["group"] = json!(true);
+            if let Some(fields) = params.as_object_mut() {
+                fields.remove("operation");
+            }
+            let before = (app.ui.docking.clone(), app.ui.docking_returns.clone());
+            dock_command(app, "window.panel.move", &params)?;
+            workspace = workspace_of(app)?;
+            if let Err(error) = workspace.apply(Action::Activate { panel: panel.to_owned() }, permissions) {
+                (app.ui.docking, app.ui.docking_returns) = before;
+                sync_visibility(app);
+                return Err(error.to_string());
             }
-            layout.apply(Action::Activate { panel: panel.to_owned() }).map_err(|e| e.to_string())?;
         }
         "up" | "down" => {
-            let groups = root_groups(&layout);
+            let groups = root_groups(&workspace.layout);
             let index = groups.iter().position(|g| g.contains(&panel.to_owned())).ok_or("floating groups cannot move within the dock")?;
             let neighbor = if operation == "up" { index.checked_sub(1) } else { index.checked_add(1).filter(|i| *i < groups.len()) };
             let anchor = neighbor.and_then(|i| groups.get(i)).and_then(|g| g.first()).ok_or("group is already at the edge")?;
-            let first = members.first().ok_or("group is empty")?;
-            layout
-                .apply(Action::Move {
-                    panel: first.clone(),
-                    anchor: anchor.clone(),
-                    placement: Placement::Split(if operation == "up" { Zone::Top } else { Zone::Bottom }),
-                })
+            let zone = if operation == "up" { Zone::Top } else { Zone::Bottom };
+            let placement = Placement::for_zone(&workspace.layout, anchor, zone, crate::direction::is_rtl()).map_err(|e| e.to_string())?;
+            workspace
+                .apply_all(
+                    [
+                        Action::MoveGroup { panel: panel.to_owned(), to: Target::At { anchor: anchor.clone(), placement } },
+                        Action::Activate { panel: panel.to_owned() },
+                    ],
+                    permissions,
+                )
                 .map_err(|e| e.to_string())?;
-            for id in members.iter().skip(1) {
-                layout
-                    .apply(Action::Move { panel: id.clone(), anchor: first.clone(), placement: Placement::Tab { before: None } })
-                    .map_err(|e| e.to_string())?;
-            }
-            layout.apply(Action::Activate { panel: panel.to_owned() }).map_err(|e| e.to_string())?;
         }
         _ => return Err("operation must be close, collapse, expand, move, up or down".into()),
     }
-    app.ui.docking = Some(layout);
-    app.ui.docking_hidden = hidden;
+    let returns = app.ui.docking_returns.clone();
+    commit(app, workspace, returns);
     app.ui.docking_collapsed = collapsed.into_iter().collect();
-    sync_visibility(app);
     // Native collapse flags must not re-collapse a custom group after explicit expansion.
     if operation == "expand" || operation == "move" {
         reveal_group(app, panel);
     }
-    Ok(json!({"layout":app.ui.docking}))
+    Ok(json!({"layout": app.ui.docking.as_ref().map(|workspace| &workspace.layout)}))
 }
 
 pub(crate) struct LegacyUpdate {
-    layout: Layout<String>,
-    hidden: std::collections::BTreeMap<String, craft_ui::docking::Location<String>>,
+    workspace: Workspace,
     clear_collapse: Vec<Group>,
 }
 
@@ -748,7 +1089,7 @@ pub(crate) fn prepare_legacy_update(
     if panels.is_none() && tabs.is_none() && dock.is_none() {
         return Ok(None);
     }
-    if !valid(current) {
+    if !valid_workspace(current) {
         return Err("invalid panel layout; reset the workspace first".into());
     }
     // A legacy flat-column replacement cannot represent arbitrary custom splits. Reject it
@@ -764,15 +1105,15 @@ pub(crate) fn prepare_legacy_update(
     let clear_collapse: Vec<_> =
         dock.map(|d| Group::ALL.into_iter().filter(|g| d.is_collapsed(*g) != app.ui.dock.is_collapsed(*g)).collect()).unwrap_or_default();
     if !clear_collapse.is_empty()
-        && root_groups(current).iter().any(|ids| {
+        && root_groups(&current.layout).iter().any(|ids| {
             let groups: std::collections::HashSet<_> = ids.iter().filter_map(|id| PANELS.iter().find(|p| p.0 == id).map(|p| p.2)).collect();
             groups.len() > 1
         })
     {
         return Err("legacy collapse settings cannot replace mixed custom groups; use window.panel.group".into());
     }
-    let mut layout = current.clone();
-    let mut hidden = app.ui.docking_hidden.clone();
+    let mut workspace = current.clone();
+    workspace.locked = false;
     for group in Group::ALL {
         let visibility = request.get("panels").and_then(|p| p.get(group.key())).and_then(Value::as_bool);
         let selected = request.get("dockTabs").and_then(|p| p.get(group.key())).is_some();
@@ -781,15 +1122,9 @@ pub(crate) fn prepare_legacy_update(
             let explicitly_hidden = dock.is_some_and(|d| d.hidden_tabs.get(&group).is_some_and(|names| names.iter().any(|name| name == label)));
             let explicitly_shown = dock.is_some() && !explicitly_hidden;
             if visibility == Some(false) || explicitly_hidden {
-                if layout.contains(&id.to_owned()) {
-                    hidden.insert(id.to_owned(), layout.location(&id.to_owned()).map_err(|e| e.to_string())?);
-                    layout.apply(Action::Close { panel: id.to_owned() }).map_err(|e| e.to_string())?;
-                }
-            } else if (visibility == Some(true) || explicitly_shown) && !layout.contains(&id.to_owned()) {
-                if hidden.contains_key(id) {
-                    restore_hidden(&mut layout, &mut hidden, id);
-                }
-                ensure(&mut layout, id)?;
+                workspace.set_visible(id.to_owned(), false, None, permissions).map_err(|e| e.to_string())?;
+            } else if visibility == Some(true) || explicitly_shown {
+                ensure(app, &mut workspace, id)?;
             }
         }
         if selected {
@@ -807,16 +1142,11 @@ pub(crate) fn prepare_legacy_update(
             if visibility == Some(false) {
                 return Err("cannot select a tab in a hidden group".into());
             }
-            if !layout.contains(&id.to_owned()) {
-                if hidden.contains_key(id) {
-                    restore_hidden(&mut layout, &mut hidden, id);
-                }
-                ensure(&mut layout, id)?;
-            }
-            layout.apply(Action::Activate { panel: id.to_owned() }).map_err(|e| e.to_string())?;
+            ensure(app, &mut workspace, id)?;
+            workspace.apply(Action::Activate { panel: id.to_owned() }, permissions).map_err(|e| e.to_string())?;
         }
     }
-    Ok(Some(LegacyUpdate { layout, hidden, clear_collapse }))
+    Ok(Some(LegacyUpdate { workspace, clear_collapse }))
 }
 
 pub(crate) fn commit_legacy_update(app: &mut PhotocraftApp, update: LegacyUpdate, request: &Value) {
@@ -824,9 +1154,8 @@ pub(crate) fn commit_legacy_update(app: &mut PhotocraftApp, update: LegacyUpdate
         let ids: Vec<_> = PANELS.iter().filter(|p| p.2 == group).map(|p| p.0).collect();
         app.ui.docking_collapsed.retain(|id| !ids.contains(&id.as_str()));
     }
-    app.ui.docking = Some(update.layout);
-    app.ui.docking_hidden = update.hidden;
-    sync_visibility(app);
+    let returns = app.ui.docking_returns.clone();
+    commit(app, update.workspace, returns);
     for group in Group::ALL {
         if request.get("dockTabs").and_then(|p| p.get(group.key())).is_some()
             || request.get("panels").and_then(|p| p.get(group.key())).and_then(Value::as_bool) == Some(true)
@@ -841,8 +1170,12 @@ pub(crate) fn commit_legacy_update(app: &mut PhotocraftApp, update: LegacyUpdate
 struct PanelContent<'a> {
     app: &'a mut PhotocraftApp,
     collapsed: &'a std::collections::HashSet<String>,
+    fillers: &'a std::collections::HashSet<String>,
+    /// The panels of the Studio themes' Properties card, which stays over the canvas.
+    card: &'a std::collections::HashSet<String>,
+    /// The tab strip's height, which the native groups' heights include.
+    strip: f32,
     commands: &'a mut Vec<(&'static str, Value)>,
-    targets: &'a mut Vec<craft_ui::docking::DropTarget<String>>,
 }
 
 fn panel_menu(app: &mut PhotocraftApp, ui: &mut egui::Ui, panel: &str) {
@@ -871,48 +1204,50 @@ fn panel_menu(app: &mut PhotocraftApp, ui: &mut egui::Ui, panel: &str) {
             crate::actions::panel_menu(app, ui);
             ui.separator();
         }
+        "histogram" => {
+            crate::histogram_panel::panel_menu(app, ui);
+            ui.separator();
+        }
         _ => {}
     }
 }
 
 impl craft_ui::docking::DockContent<String> for PanelContent<'_> {
     fn body(&mut self, ui: &mut egui::Ui, id: &String) {
-        if let Some(target) = self.targets.iter_mut().find(|target| target.anchor == *id) {
-            target.rect = target.rect.union(ui.max_rect());
-            if let Some(strip) = target.tab_strip.as_mut() {
-                strip.min.x = target.rect.left();
-                strip.max.x = target.rect.right();
-            }
-            let members = self.app.ui.docking.as_ref().map(|layout| group_members(layout, id)).unwrap_or_default();
-            target.tabs = members
-                .into_iter()
-                .filter_map(|panel| {
-                    ui.ctx().read_response(egui::Id::new("photocraft-panel-docking").with(("tab", &panel))).map(|response| (panel, response.rect))
-                })
-                .collect();
+        #[cfg(test)]
+        ui.ctx().data_mut(|data| data.get_temp_mut_or_default::<Vec<(String, egui::Rect)>>(bodies_id()).push((id.clone(), ui.max_rect())));
+        if id == CANVAS {
+            crate::panels::canvas_panel(self.app, ui);
+            return;
         }
-        if !self.collapsed.contains(id) {
-            egui::Frame::NONE.inner_margin(egui::Margin::same(8)).show(ui, |ui| body(self.app, ui, id));
+        let viewport = ui.ctx().viewport_id();
+        if viewport != egui::ViewportId::ROOT && ui.memory(|m| m.focused().is_some()) {
+            keyboard_focus(ui.ctx()).lock().unwrap_or_else(|e| e.into_inner()).insert(viewport);
         }
+        // A window too small for the dock squeezes its column below the panels' minimum width,
+        // which their layouts do not take.
+        if !self.collapsed.contains(id) && ui.available_width() >= 200.0 {
+            let pro = crate::theme::Tokens::get(ui.ctx()).pro;
+            ui.spacing_mut().item_spacing.y = if pro { 0.0 } else { 6.0 };
+            egui::Frame::NONE.inner_margin(crate::widgets::body_margin(pro)).show(ui, |ui| body(self.app, ui, id));
+        }
+    }
+    fn dock_heights(&self, id: &String) -> Option<DockHeights> {
+        let group = PANELS.iter().find(|p| p.0 == id)?.2;
+        let body = |height: f32| (height - self.strip).max(0.0);
+        let fill = if self.fillers.contains(id) { body(group.preferred_fill()).max(1.0) } else { 0.0 };
+        Some(DockHeights::new(body(group.default_height())).compact(body(group.compact_height())).fill(fill))
     }
     fn panel_menu(&mut self, ui: &mut egui::Ui, id: &String) {
         panel_menu(self.app, ui, id);
     }
-    fn group_header_width(&self, _panels: &[String], _active: &String, _floating: bool) -> f32 {
+    fn allow_native(&self, id: &String) -> bool {
+        !self.card.contains(id)
+    }
+    fn group_header_width(&self, _panels: &[String], _active: &String, _floating: bool, _strip_width: f32) -> f32 {
         28.0
     }
     fn group_header(&mut self, ui: &mut egui::Ui, panels: &[String], active: &String, floating: bool) {
-        if !floating {
-            let rect = ui.max_rect();
-            self.targets.push(craft_ui::docking::DropTarget {
-                anchor: active.clone(),
-                rect,
-                tab_strip: Some(rect),
-                tabs: Vec::new(),
-                allow_splits: true,
-                accepts_tabs: !self.app.session.prefs().workspace_locked,
-            });
-        }
         let collapsed = panels.iter().all(|id| self.collapsed.contains(id));
         let locked = self.app.session.prefs().workspace_locked;
         let resp = crate::icons::button(ui, "ellipsis", ui.available_height().min(28.0), false, tl!("Panel menu"));
@@ -928,7 +1263,7 @@ impl craft_ui::docking::DockContent<String> for PanelContent<'_> {
                 ui.close();
             }
             if !floating {
-                let groups = self.app.ui.docking.as_ref().map(root_groups).unwrap_or_default();
+                let groups = self.app.ui.docking.as_ref().map(|workspace| root_groups(&workspace.layout)).unwrap_or_default();
                 let index = groups.iter().position(|g| g.contains(active));
                 for (operation, label, enabled) in
                     [("up", tl!("Move Group Up"), index.is_some_and(|i| i > 0)), ("down", tl!("Move Group Down"), index.is_some_and(|i| i + 1 < groups.len()))]
@@ -949,11 +1284,12 @@ impl craft_ui::docking::DockContent<String> for PanelContent<'_> {
 }
 
 pub(crate) fn sync_visibility(app: &mut PhotocraftApp) {
-    if let Some(layout) = &app.ui.docking {
+    if let Some(workspace) = &app.ui.docking {
+        let layout = &workspace.layout;
         if !valid(layout) {
             return;
         }
-        let pro = matches!(app.ui.theme, crate::theme::ThemeKind::Pro | crate::theme::ThemeKind::ProMedium);
+        let pro = app.ui.theme.is_pro();
         for group in Group::ALL {
             *group.shown_mut(&mut app.ui.panels) = PANELS.iter().filter(|p| p.2 == group).any(|p| layout.contains(&p.0.to_owned()));
             for (index, label) in group.tabs(pro).iter().enumerate() {
@@ -975,68 +1311,13 @@ pub(crate) fn sync_visibility(app: &mut PhotocraftApp) {
     }
 }
 
+/// Is `panel` the selected tab of its group (or an accordion entry)?
 fn panel_active(layout: &Layout<String>, panel: &str) -> bool {
-    let mut pending: Vec<_> = layout.root.iter().collect();
-    while let Some(node) = pending.pop() {
-        match node {
-            Node::Split { first, second, .. } => pending.extend([first.as_ref(), second.as_ref()]),
-            Node::Tabs { panels, active } if panels.iter().any(|p| p == panel) => return panels.get(*active).is_some_and(|p| p == panel),
-            Node::Stack { entries } if entries.iter().any(|e| e.panel == panel) => return true,
-            _ => {}
-        }
-    }
-    layout.floating.iter().any(|g| g.panels.get(g.active).is_some_and(|p| p == panel))
-}
-
-/// Extra legacy menu choices use the same commands as the customized renderer.
-pub(crate) fn legacy_menu(app: &mut PhotocraftApp, ui: &mut egui::Ui, label: &str) {
-    let Some(panel) = normalize(label) else { return };
-    let locked = app.session.prefs().workspace_locked;
-    ui.add_enabled_ui(!locked, |ui| {
-        if ui.button(tl!("Float Panel")).clicked() {
-            if let Err(error) = app.run("window.panel.float", json!({"panel":panel})) {
-                app.ui.status = error;
-            }
-            ui.close();
-        }
-        ui.menu_button(tl!("Group with"), |ui| {
-            for &(anchor, label, _) in PANELS {
-                if anchor != panel && ui.button(tl!(label)).clicked() {
-                    let result = app
-                        .run("window.panel.activate", json!({"panel":anchor}))
-                        .and_then(|_| app.run("window.panel.move", json!({"panel":panel,"anchor":anchor})));
-                    if let Err(error) = result {
-                        app.ui.status = error;
-                    }
-                    ui.close();
-                }
-            }
-        });
-    });
-}
-
-// A closed group forms a bounded chain of hidden tab neighbors. Restore just the requested
-// panel at the first surviving return position, then let the remaining tabs rejoin it.
-fn restore_hidden(layout: &mut Layout<String>, hidden: &mut std::collections::BTreeMap<String, craft_ui::docking::Location<String>>, panel: &str) {
-    let Some(mut at) = hidden.get(panel).cloned() else { return };
-    let mut terminal = panel.to_owned();
-    let mut seen = vec![terminal.clone()];
-    while let Some(anchor) = at.anchor.as_ref().filter(|id| !layout.contains(id)).cloned() {
-        if seen.len() >= PANELS.len() || seen.contains(&anchor) {
-            return;
-        }
-        let Some(next) = hidden.get(&anchor).cloned() else { return };
-        seen.push(anchor.clone());
-        terminal = anchor;
-        at = next;
-    }
-    if layout.restore(panel.to_owned(), &at).is_ok()
-        && terminal != panel
-        && let Some(last) = hidden.get_mut(&terminal)
-    {
-        last.anchor = Some(panel.to_owned());
-        last.placement = Placement::Tab { before: None };
-        last.size = None;
-        last.sibling.clear();
-    }
+    layout
+        .root
+        .iter()
+        .chain(layout.floating.iter().map(|window| &window.root))
+        .flat_map(tree_groups)
+        .find(|group| group.panels.iter().any(|id| id == panel))
+        .is_some_and(|group| group.panels.get(group.active).is_some_and(|id| id == panel))
 }
diff --git a/crates/ui-egui/src/panel_docking_native_tests.rs b/crates/ui-egui/src/panel_docking_native_tests.rs
new file mode 100644
index 0000000000..af87601a45
--- /dev/null
+++ b/crates/ui-egui/src/panel_docking_native_tests.rs
@@ -0,0 +1,396 @@
+//! Floating panels in their own OS windows. A stand-in for the window system runs each native
+//! window's frame on the harness's context with its own input and desktop rect, as eframe does.
+
+use super::*;
+use egui::{Event, Key, Modifiers, PointerButton, Pos2, Rect, ViewportId, pos2, vec2};
+use egui_kittest::Harness;
+use std::{cell::RefCell, collections::HashMap, rc::Rc};
+
+/// Where the main window's content sits on the desktop.
+const ORIGIN: Pos2 = pos2(200.0, 100.0);
+
+struct Window {
+    rect: Rect,
+    events: Vec<Event>,
+    dropped: Vec<egui::DroppedFileHandle>,
+    /// The window asked for the clipboard text.
+    paste_requested: bool,
+    hidden: bool,
+}
+
+#[derive(Default)]
+struct Host {
+    windows: HashMap<ViewportId, Window>,
+    /// The window with the keyboard; `None` is the main window.
+    focus: Option<ViewportId>,
+    time: f64,
+    size: egui::Vec2,
+}
+
+impl Host {
+    fn infos(&self) -> egui::ViewportIdMap<egui::ViewportInfo> {
+        let info = |rect: Rect, focused: bool| egui::ViewportInfo {
+            inner_rect: Some(rect),
+            outer_rect: Some(rect),
+            focused: Some(focused),
+            native_pixels_per_point: Some(1.0),
+            ..Default::default()
+        };
+        std::iter::once((ViewportId::ROOT, info(Rect::from_min_size(ORIGIN, self.size), self.focus.is_none())))
+            .chain(self.windows.iter().map(|(id, window)| (*id, info(window.rect, self.focus == Some(*id)))))
+            .collect()
+    }
+
+    fn render(host: &RefCell<Self>, ctx: &egui::Context, mut viewport: egui::ImmediateViewport<'_>) {
+        let id = viewport.ids.this;
+        let input = {
+            let mut host = host.borrow_mut();
+            let builder = &viewport.builder;
+            let rect = Rect::from_min_size(builder.position.unwrap_or_default(), builder.inner_size.unwrap_or(vec2(300.0, 200.0)));
+            host.windows.entry(id).or_insert(Window { rect, events: Vec::new(), dropped: Vec::new(), paste_requested: false, hidden: false });
+            let (viewports, focused, time) = (host.infos(), host.focus == Some(id), host.time);
+            let window = host.windows.get_mut(&id).expect("just added");
+            egui::RawInput {
+                viewport_id: id,
+                viewports,
+                screen_rect: Some(Rect::from_min_size(Pos2::ZERO, window.rect.size())),
+                events: std::mem::take(&mut window.events),
+                dropped_files: std::mem::take(&mut window.dropped),
+                focused,
+                time: Some(time),
+                ..Default::default()
+            }
+        };
+        let mut full = ctx.run_ui(input, |ui| (viewport.viewport_ui_cb)(ui));
+        full.textures_delta.clear();
+        let mut host = host.borrow_mut();
+        for command in full.viewport_output.get(&id).map(|output| output.commands.as_slice()).unwrap_or_default() {
+            let Some(window) = host.windows.get_mut(&id) else { continue };
+            match command {
+                egui::ViewportCommand::OuterPosition(pos) => window.rect = Rect::from_min_size(*pos, window.rect.size()),
+                egui::ViewportCommand::InnerSize(size) => window.rect = Rect::from_min_size(window.rect.min, *size),
+                egui::ViewportCommand::RequestPaste => window.paste_requested = true,
+                _ => {}
+            }
+        }
+    }
+}
+
+struct Desktop {
+    h: Harness<'static, PhotocraftApp>,
+    host: Rc<RefCell<Host>>,
+}
+
+impl Desktop {
+    fn new(app: PhotocraftApp) -> Self {
+        let size = vec2(1400.0, 900.0);
+        let host = Rc::new(RefCell::new(Host { size, ..Default::default() }));
+        let shared = host.clone();
+        egui::Context::set_immediate_viewport_renderer(move |ctx, viewport| Host::render(&shared, ctx, viewport));
+        let mut ready = false;
+        let h = Harness::builder().with_size(size).with_step_dt(1.0 / 60.0).build_ui_state(
+            move |ui, app: &mut PhotocraftApp| {
+                if !ready {
+                    PhotocraftApp::setup_context(ui.ctx(), app.ui.theme);
+                    ui.ctx().set_embed_viewports(false);
+                    ready = true;
+                    return;
+                }
+                crate::panels::dock_area(app, ui);
+                egui::CentralPanel::default().show(ui, |_| {});
+            },
+            app,
+        );
+        let mut desktop = Self { h, host };
+        desktop.steps(4);
+        desktop
+    }
+
+    fn steps(&mut self, n: usize) {
+        for _ in 0..n {
+            let (infos, main_focused) = {
+                let mut host = self.host.borrow_mut();
+                host.time += 1.0 / 60.0;
+                (host.infos(), host.focus.is_none())
+            };
+            let input = self.h.input_mut();
+            input.viewports = infos;
+            input.focused = main_focused;
+            self.h.step();
+            // A command sent to a window from the main window's pass is in the main pass's output;
+            // one sent from the window's own pass is in that pass's output (`Host::render`).
+            let mut host = self.host.borrow_mut();
+            for (id, output) in &self.h.output().viewport_output {
+                if let Some(window) = host.windows.get_mut(id) {
+                    window.paste_requested |= output.commands.contains(&egui::ViewportCommand::RequestPaste);
+                    for command in &output.commands {
+                        if let egui::ViewportCommand::Visible(visible) = command {
+                            window.hidden = !visible;
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    /// The OS window of the floating window holding `panel`, once the dock area opened one.
+    fn window_of(&self, panel: &str) -> Option<ViewportId> {
+        let window = lay(self.h.state()).floating.iter().find(|window| window.contains(&panel.to_owned()))?;
+        let viewport = craft_ui::docking::DockArea::<String>::window_viewport(area_id(), window.id);
+        self.host.borrow().windows.contains_key(&viewport).then_some(viewport)
+    }
+
+    fn window_rect(&self, viewport: ViewportId) -> Rect {
+        self.host.borrow().windows[&viewport].rect
+    }
+
+    /// Give `events` to the native window `viewport` and run two frames.
+    fn send(&mut self, viewport: ViewportId, events: Vec<Event>) {
+        self.host.borrow_mut().windows.get_mut(&viewport).expect("a native window").events.extend(events);
+        self.steps(2);
+    }
+
+    fn click(&mut self, viewport: ViewportId, at: Pos2) {
+        let button = |pressed| Event::PointerButton { pos: at, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE };
+        self.send(viewport, vec![Event::PointerMoved(at), button(true)]);
+        self.send(viewport, vec![button(false)]);
+    }
+
+    fn key(&mut self, viewport: ViewportId, key: Key, modifiers: Modifiers) {
+        let event = |pressed| Event::Key { key, physical_key: None, pressed, repeat: false, modifiers };
+        self.send(viewport, vec![event(true)]);
+        self.send(viewport, vec![event(false)]);
+    }
+}
+
+fn lay(app: &PhotocraftApp) -> &Layout<String> {
+    &app.ui.docking.as_ref().expect("a customized workspace").layout
+}
+
+fn app_with_document() -> PhotocraftApp {
+    let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+    app.run("file.new", json!({"width": 64, "height": 48})).unwrap();
+    app
+}
+
+/// The × of a native window's bar, in its coordinates: an 18 pt square 7 pt from the trailing
+/// edge (craft-ui's `OTHER_CLOSE`; this host is not macOS).
+fn close_button(rect: Rect) -> Pos2 {
+    pos2(rect.width() - 16.0, 9.0)
+}
+
+#[test]
+fn undocking_a_panel_opens_its_own_window_and_the_studio_card_stays_in_the_main_window() {
+    let mut desktop = Desktop::new(app_with_document());
+    desktop.h.state_mut().run("window.panel.float", json!({"panel": "info"})).unwrap();
+    desktop.steps(3);
+    let viewport = desktop.window_of("info").expect("Info floats in its own OS window");
+    let window = lay(desktop.h.state()).floating.iter().find(|window| window.contains(&"info".to_owned())).unwrap().clone();
+    assert!(
+        craft_ui::docking::DockArea::<String>::floating_layer(area_id(), &window).is_none_or(|layer| desktop.h.ctx.memory(|m| m.area_rect(layer.id)).is_none()),
+        "and not in the main window"
+    );
+    // Undock Panel's window opens over its place in the main window.
+    let [x, y, ..] = window.rect;
+    assert_eq!(desktop.window_rect(viewport).min, ORIGIN + vec2(x, y));
+    assert!(native_viewports(desktop.h.state(), &desktop.h.ctx).contains(&viewport));
+
+    // window.panel.window floats a docked panel's group into its own window.
+    desktop.h.state_mut().run("window.panel.window", json!({"panel": "history"})).unwrap();
+    desktop.steps(3);
+    assert!(desktop.window_of("history").is_some(), "History has its own window");
+
+    let mut studio = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+    studio.ui.theme = crate::theme::ThemeKind::Studio;
+    studio.run("file.new", json!({"width": 64, "height": 48})).unwrap();
+    let mut desktop = Desktop::new(studio);
+    desktop.steps(3);
+    let card = legacy(desktop.h.state()).floating.into_iter().find(|window| window.id == PROPERTIES_WINDOW).expect("the Studio Properties card");
+    assert!(desktop.host.borrow().windows.is_empty(), "the card opens no OS window");
+    let layer = craft_ui::docking::DockArea::<String>::floating_layer(area_id(), &card).unwrap();
+    assert!(desktop.h.ctx.memory(|m| m.area_rect(layer.id)).is_some(), "the card is drawn in the main window");
+    let refused = desktop.h.state_mut().run("window.panel.window", json!({"panel": "properties"}));
+    assert!(refused.is_err(), "{refused:?}");
+}
+
+fn studio_app() -> PhotocraftApp {
+    let mut app = app_with_document();
+    app.ui.theme = crate::theme::ThemeKind::Studio;
+    app
+}
+
+#[test]
+fn the_studio_card_stays_in_the_main_window_after_a_reload() {
+    let mut desktop = Desktop::new(studio_app());
+    desktop.h.state_mut().run("window.panel.close", json!({"panel": "layers"})).unwrap();
+    desktop.steps(3);
+    assert!(desktop.host.borrow().windows.is_empty());
+    let saved: Value = serde_json::from_str(&crate::dock::snapshot(desktop.h.state()).to_string()).unwrap();
+    drop(desktop);
+    let mut reloaded = studio_app();
+    crate::dock::apply(&mut reloaded, &saved);
+    let mut desktop = Desktop::new(reloaded);
+    desktop.steps(3);
+    let card = lay(desktop.h.state()).floating.iter().find(|window| window.contains(&"properties".to_owned())).expect("the card").clone();
+    assert_eq!(card.id, PROPERTIES_WINDOW);
+    assert!(desktop.host.borrow().windows.is_empty(), "the card opens no OS window");
+    let layer = craft_ui::docking::DockArea::<String>::floating_layer(area_id(), &card).unwrap();
+    assert!(desktop.h.ctx.memory(|m| m.area_rect(layer.id)).is_some(), "the card is drawn in the main window");
+    let refused = desktop.h.state_mut().run("window.panel.window", json!({"panel": "properties"}));
+    assert!(refused.is_err(), "{refused:?}");
+}
+
+#[test]
+fn keys_pressed_in_a_panel_window_run_photocrafts_shortcuts() {
+    let mut desktop = Desktop::new(app_with_document());
+    desktop.h.state_mut().run("window.panel.float", json!({"panel": "info"})).unwrap();
+    desktop.steps(3);
+    let viewport = desktop.window_of("info").unwrap();
+    desktop.host.borrow_mut().focus = Some(viewport);
+    desktop.h.state_mut().ui.tool = crate::state::Tool::Move;
+    desktop.key(viewport, Key::B, Modifiers::NONE);
+    assert_eq!(desktop.h.state().ui.tool, crate::state::Tool::Brush, "B in the Info window picks the Brush");
+
+    let layers = |desktop: &Desktop| desktop.h.state().session.active().unwrap().doc.layers.len();
+    let before = layers(&desktop);
+    desktop.h.state_mut().run("layer.new.layer", json!({})).unwrap();
+    assert_eq!(layers(&desktop), before + 1);
+    desktop.key(viewport, Key::Z, Modifiers::COMMAND);
+    assert_eq!(layers(&desktop), before, "⌘Z in the Info window undoes");
+}
+
+/// The Mac menu bar, reporting one key equivalent.
+struct MenuKey(Vec<crate::native_menu::Event>);
+
+impl crate::native_menu::Backend for MenuKey {
+    fn sync(&mut self, _: &crate::native_menu::MenuBar) {}
+    fn drain(&mut self) -> Vec<crate::native_menu::Event> {
+        std::mem::take(&mut self.0)
+    }
+}
+
+#[test]
+fn a_menu_key_typed_in_a_panel_windows_text_field_goes_to_the_field() {
+    let mut desktop = Desktop::new(app_with_document());
+    let app = desktop.h.state_mut();
+    app.run("select.rect", json!({"x": 0, "y": 0, "width": 8, "height": 4})).unwrap();
+    app.run("edit.copy", json!({})).unwrap();
+    app.run("window.panel.float", json!({"panel": "gradients"})).unwrap();
+    desktop.steps(3);
+    let viewport = desktop.window_of("gradients").unwrap();
+    desktop.host.borrow_mut().focus = Some(viewport);
+    desktop.h.state_mut().ui.presets_ui.renaming = Some(("gradients".into(), "key".into(), "Name".into()));
+    desktop.steps(3);
+
+    let layers = |desktop: &Desktop| desktop.h.state().session.active().unwrap().doc.layers.len();
+    let before = layers(&desktop);
+    let paste = crate::native_menu::Chord::parse("Cmd+V").unwrap();
+    desktop.h.state_mut().services.native_menu = Some(crate::native_menu::NativeMenu::new(Box::new(MenuKey(vec![crate::native_menu::Event::Key(paste)]))));
+    let mut raw = egui::RawInput { viewports: desktop.host.borrow().infos(), ..Default::default() };
+    let ctx = desktop.h.ctx.clone();
+    eframe::App::raw_input_hook(desktop.h.state_mut(), &ctx, &mut raw);
+    desktop.h.input_mut().events.extend(raw.events);
+    desktop.steps(1);
+    let main = desktop.h.output().viewport_output.get(&ViewportId::ROOT).map(|output| output.commands.clone()).unwrap_or_default();
+    assert!(!main.contains(&egui::ViewportCommand::RequestPaste), "the main window asks for no paste: {main:?}");
+    desktop.steps(2);
+    assert_eq!(layers(&desktop), before, "nothing is pasted into the document");
+    assert!(desktop.host.borrow().windows[&viewport].paste_requested, "the field's window asks for the clipboard text");
+}
+
+#[test]
+fn keys_held_in_a_panel_window_count_as_released_once_it_loses_the_keyboard() {
+    let mut desktop = Desktop::new(app_with_document());
+    desktop.h.state_mut().run("window.panel.float", json!({"panel": "gradients"})).unwrap();
+    desktop.steps(3);
+    let viewport = desktop.window_of("gradients").unwrap();
+    desktop.host.borrow_mut().focus = Some(viewport);
+    let space = |pressed| Event::Key { key: Key::Space, physical_key: None, pressed, repeat: false, modifiers: Modifiers::NONE };
+    // The main window's shortcuts, in a pass with the host's focus.
+    let held = |desktop: &mut Desktop| {
+        let ctx = desktop.h.ctx.clone();
+        let raw = {
+            let host = desktop.host.borrow();
+            egui::RawInput { viewports: host.infos(), focused: host.focus.is_none(), ..Default::default() }
+        };
+        ctx.run_ui(raw, |ui| crate::shortcuts::handle(desktop.h.state_mut(), ui.ctx())).textures_delta.clear();
+        crate::shortcuts::forwarded_keys_down(&ctx)
+    };
+    desktop.send(viewport, vec![space(true)]);
+    assert_eq!(held(&mut desktop), [Key::Space], "held while the window has the keyboard");
+    desktop.host.borrow_mut().focus = Some(ViewportId::from_hash_of("another app"));
+    assert_eq!(held(&mut desktop), [], "released once no window of the app has the keyboard");
+
+    desktop.host.borrow_mut().focus = Some(viewport);
+    desktop.send(viewport, vec![space(true)]);
+    assert_eq!(held(&mut desktop), [Key::Space]);
+    desktop.h.state_mut().ui.presets_ui.renaming = Some(("gradients".into(), "key".into(), "Name".into()));
+    desktop.steps(3);
+    assert_eq!(held(&mut desktop), [], "released once a field of the window takes keyboard focus");
+}
+
+#[test]
+fn a_dialog_blocks_the_panel_windows() {
+    let about = |app: &mut PhotocraftApp| _ = app.ui.open_dialog(crate::state::DialogKind::About, Default::default());
+    let blur = |app: &mut PhotocraftApp| _ = crate::dialogs::open_command_dialog(app, "filter.blur.gaussianBlur", "Gaussian Blur");
+    for (name, open) in [("About", &about as &dyn Fn(&mut PhotocraftApp)), ("Gaussian Blur", &blur)] {
+        let mut desktop = Desktop::new(app_with_document());
+        desktop.h.state_mut().run("window.panel.float", json!({"panel": "info"})).unwrap();
+        desktop.steps(3);
+        let viewport = desktop.window_of("info").unwrap();
+        desktop.host.borrow_mut().focus = Some(viewport);
+        open(desktop.h.state_mut());
+        assert!(modal_open(desktop.h.state(), &desktop.h.ctx), "{name}");
+        // The click arrives in the dialog's first frame.
+        let close = close_button(desktop.window_rect(viewport));
+        desktop.click(viewport, close);
+        assert!(lay(desktop.h.state()).contains(&"info".to_owned()), "{name}: the × takes no click under the dialog");
+        desktop.h.state_mut().ui.tool = crate::state::Tool::Move;
+        desktop.key(viewport, Key::B, Modifiers::NONE);
+        assert_eq!(desktop.h.state().ui.tool, crate::state::Tool::Move, "{name}: nor do the shortcuts get its keys");
+        desktop.host.borrow_mut().focus = Some(ViewportId::from_hash_of("another app"));
+        desktop.steps(30);
+        assert!(!desktop.host.borrow().windows[&viewport].hidden, "{name}: the panel window stays shown while the app is in the background");
+        desktop.host.borrow_mut().focus = Some(viewport);
+
+        desktop.h.state_mut().ui.dialogs.clear();
+        desktop.steps(3);
+        assert!(!modal_open(desktop.h.state(), &desktop.h.ctx), "{name}");
+        desktop.click(viewport, close);
+        assert!(!lay(desktop.h.state()).contains(&"info".to_owned()), "{name}: the × closes the panel once the dialog is gone");
+    }
+}
+
+#[derive(Debug)]
+struct Dropped(std::path::PathBuf, Vec<u8>);
+
+impl egui::DroppedFile for Dropped {
+    fn path(&self) -> &std::path::Path {
+        &self.0
+    }
+    fn bytes(&self) -> Result<Vec<u8>, String> {
+        Ok(self.1.clone())
+    }
+}
+
+#[test]
+fn a_file_dropped_on_a_panel_window_opens_as_a_document() {
+    // An importer that names the document after the file, as photocraft-io does.
+    let import = |name: &str, _: &[u8], _: &photocraft_io::ImportOptions| {
+        let size = photocraft_geom::Size::new(4, 4);
+        Ok((photocraft_doc::Document::new(name, size, photocraft_color::ColorMode::Rgb, photocraft_color::SampleType::U8), Vec::new()))
+    };
+    let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services { import: Some(Box::new(import)), ..Default::default() });
+    app.run("file.new", json!({"width": 64, "height": 48})).unwrap();
+    let mut desktop = Desktop::new(app);
+    desktop.h.state_mut().run("window.panel.float", json!({"panel": "info"})).unwrap();
+    desktop.steps(3);
+    let viewport = desktop.window_of("info").unwrap();
+    let documents = desktop.h.state().session.documents().len();
+    let file: egui::DroppedFileHandle = std::sync::Arc::new(Dropped("dropped.psd".into(), b"x".to_vec()));
+    desktop.host.borrow_mut().windows.get_mut(&viewport).unwrap().dropped.push(file);
+    desktop.steps(2);
+    let names: Vec<String> = desktop.h.state().session.documents().iter().map(|d| d.doc.name.clone()).collect();
+    assert_eq!(names.len(), documents + 1, "{names:?}");
+    assert_eq!(names.last().map(String::as_str), Some("dropped.psd"));
+}
diff --git a/crates/ui-egui/src/panel_docking_tests.rs b/crates/ui-egui/src/panel_docking_tests.rs
index 71916158f8..85d452a61c 100644
--- a/crates/ui-egui/src/panel_docking_tests.rs
+++ b/crates/ui-egui/src/panel_docking_tests.rs
@@ -6,40 +6,74 @@ fn app() -> PhotocraftApp {
     PhotocraftApp::new(photocraft_engine::Session::new(), Default::default())
 }
 
+fn lay(app: &PhotocraftApp) -> &Layout<String> {
+    &app.ui.docking.as_ref().expect("a customized workspace").layout
+}
+
+fn hidden(app: &PhotocraftApp, panel: &str) -> bool {
+    app.ui.docking.as_ref().is_some_and(|workspace| workspace.hidden.iter().any(|(id, _)| id == panel))
+}
+
+fn hit_rect(h: &Harness<'static, PhotocraftApp>, hit: craft_ui::docking::Hit<String>) -> egui::Rect {
+    let hits = craft_ui::docking::DockArea::<String>::hit_rects(&h.ctx, area_id());
+    hits.iter().find(|(drawn, _)| *drawn == hit).map(|(_, rect)| *rect).unwrap_or_else(|| panic!("{hit:?} is not drawn"))
+}
+
+fn tab_rect(h: &Harness<'static, PhotocraftApp>, panel: &str) -> egui::Rect {
+    hit_rect(h, craft_ui::docking::Hit::Tab(panel.to_owned()))
+}
+
+fn floating_rect(h: &Harness<'static, PhotocraftApp>, panel: &str) -> egui::Rect {
+    let window = lay(h.state()).floating.iter().find(|window| window.contains(&panel.to_owned())).unwrap();
+    let layer = craft_ui::docking::DockArea::<String>::floating_layer(area_id(), window).unwrap();
+    h.ctx.memory(|memory| memory.area_rect(layer.id)).unwrap()
+}
+
 #[test]
 fn panel_commands_group_split_reorder_float_and_restore_without_duplicate_ownership() {
     let mut app = app();
     app.run("window.panel.move", json!({"panel":"swatches", "anchor":"layers", "zone":"top"})).unwrap();
     app.run("window.panel.move", json!({"panel":"properties", "anchor":"swatches", "before":"swatches"})).unwrap();
-    let before_float = app.ui.docking.clone().unwrap();
+    let before_float = lay(&app).clone();
     app.run("window.panel.float", json!({"panel":"properties", "x":50,"y":70,"width":330,"height":410})).unwrap();
-    assert!(app.ui.docking.as_ref().unwrap().floating.iter().any(|g| g.panels == ["properties"]));
+    assert!(lay(&app).floating.iter().any(|g| g.panels().map(String::as_str).eq(["properties"])));
     app.run("window.panel.dock", json!({"panel":"properties"})).unwrap();
-    assert_eq!(app.ui.docking.as_ref().unwrap(), &before_float);
+    assert_eq!(lay(&app), &before_float);
     app.run("window.panel.close", json!({"panel":"properties"})).unwrap();
-    assert!(!app.ui.docking.as_ref().unwrap().contains(&"properties".into()));
+    assert!(!lay(&app).contains(&"properties".into()));
     app.run("window.panel.activate", json!({"panel":"properties"})).unwrap();
-    assert_eq!(app.ui.docking.as_ref().unwrap(), &before_float);
-    let layout = app.ui.docking.as_ref().unwrap();
+    assert_eq!(lay(&app), &before_float);
+    let layout = lay(&app);
     assert!(valid(layout));
     let unique: std::collections::HashSet<_> = layout.panels().into_iter().collect();
     assert_eq!(unique.len(), layout.panels().len());
     let saved = serde_json::to_value(&app.ui).unwrap();
     let restored: crate::state::UiState = serde_json::from_value(saved).unwrap();
     assert_eq!(restored.docking, app.ui.docking);
-    assert_eq!(restored.docking_hidden, app.ui.docking_hidden);
+    assert_eq!(restored.docking_returns, app.ui.docking_returns);
+}
+
+#[test]
+fn docking_a_floating_group_docks_all_of_its_panels() {
+    let mut app = app();
+    app.run("window.panel.float", json!({"panel":"paths"})).unwrap();
+    app.run("window.panel.move", json!({"panel":"history", "anchor":"paths"})).unwrap();
+    assert!(lay(&app).floating.iter().any(|w| w.contains("paths") && w.contains("history")));
+    app.run("window.panel.dock", json!({"panel":"paths", "group": true})).unwrap();
+    assert!(lay(&app).floating.iter().all(|w| !w.contains("paths") && !w.contains("history")), "{:?}", lay(&app).floating);
+    assert!(lay(&app).contains(&"paths".into()) && lay(&app).contains(&"history".into()));
 }
 
 #[test]
 fn floating_panel_rail_toggle_closes_the_float_window() {
     let mut app = app();
     app.run("window.panel.float", json!({"panel":"properties","x":50,"y":70,"width":330,"height":410})).unwrap();
-    assert!(app.ui.docking.as_ref().unwrap().floating.iter().any(|g| g.panels.contains(&"properties".into())));
+    assert!(lay(&app).floating.iter().any(|g| g.contains("properties")));
 
     rail_click(&mut app, Group::Properties);
 
-    assert!(app.ui.docking.as_ref().unwrap().floating.iter().all(|g| !g.panels.contains(&"properties".into())));
-    assert!(app.ui.docking.as_ref().unwrap().contains(&"adjustments".into()));
+    assert!(lay(&app).floating.iter().all(|g| !g.contains("properties")));
+    assert!(lay(&app).contains(&"adjustments".into()));
     assert!(app.ui.panels.properties, "the docked Adjustments tab keeps the group visible");
 }
 
@@ -48,15 +82,15 @@ fn brushes_menu_action_uses_the_shared_docking_layout() {
     let mut app = app();
     let before = app.ui.docking.clone();
     assert!(crate::menus::invoke(&mut app, &egui::Context::default(), "window.panel.brushes", json!({})).is_ok());
-    let layout = app.ui.docking.as_ref().expect("brushes panel must be registered in docking");
+    let layout = app.ui.docking.as_ref().map(|w| &w.layout).expect("brushes panel must be registered in docking");
     assert!(layout.contains(&"brushes".to_string()));
     assert!(app.ui.panels.brushes);
     assert_ne!(app.ui.docking, before);
 
     app.run("window.panel.float", json!({"panel":"brushes"})).unwrap();
-    assert!(app.ui.docking.as_ref().unwrap().floating.iter().any(|group| group.panels.contains(&"brushes".into())));
+    assert!(lay(&app).floating.iter().any(|group| group.contains("brushes")));
     app.run("window.panel.dock", json!({"panel":"brushes"})).unwrap();
-    assert!(!app.ui.docking.as_ref().unwrap().floating.iter().any(|group| group.panels.contains(&"brushes".into())));
+    assert!(!lay(&app).floating.iter().any(|group| group.contains("brushes")));
 }
 
 #[test]
@@ -71,10 +105,10 @@ fn invalid_panel_requests_are_atomic_and_do_not_enter_a_custom_workspace() {
         ("window.panel.float", json!({"panel":"layers","x":"invalid"})),
     ] {
         let old = app.ui.docking.clone();
-        let hidden = app.ui.docking_hidden.clone();
+        let hidden = app.ui.docking_returns.clone();
         assert!(app.run(id, params).is_err(), "{id}");
         assert_eq!(app.ui.docking, old);
-        assert_eq!(app.ui.docking_hidden, hidden);
+        assert_eq!(app.ui.docking_returns, hidden);
     }
 }
 
@@ -87,7 +121,7 @@ fn harness(app: PhotocraftApp, size: egui::Vec2) -> Harness<'static, PhotocraftA
                 ready = true;
                 return;
             }
-            crate::panels::right_dock(app, ui);
+            crate::panels::dock_area(app, ui);
             egui::CentralPanel::default().show(ui, |_| {});
         },
         app,
@@ -109,36 +143,123 @@ fn drag(h: &mut Harness<'static, PhotocraftApp>, from: Pos2, to: Pos2) {
     h.run_steps(3);
 }
 
-#[test]
-fn ordinary_panel_tab_drag_enters_shared_docking_and_can_redock_into_another_tab_group() {
-    let mut h = harness(app(), vec2(1280.0, 800.0));
-    let source = h.query_all_by_label("Layers").find(|node| node.rect().height() <= 45.0).unwrap().rect().center();
-    drag(&mut h, source, egui::pos2(160.0, 140.0));
-    let layout = h.state().ui.docking.as_ref().expect("ordinary tab drag starts shared docking");
-    assert!(layout.floating.iter().any(|g| g.panels.contains(&"layers".into())), "{layout:?}");
-    let source = h.ctx.read_response(egui::Id::new("photocraft-panel-docking").with(("tab", &"layers".to_string()))).unwrap().rect.center();
-    let destination = h.ctx.read_response(egui::Id::new("photocraft-panel-docking").with(("tab", &"properties".to_string()))).unwrap().rect.center();
-    drag(&mut h, source, destination);
-    let layout = h.state().ui.docking.as_ref().unwrap();
-    assert!(!layout.floating.iter().any(|g| g.panels.contains(&"layers".into())));
-    assert!(valid(layout));
+/// The canvas's rect: from the area's start to the dock column's inner edge.
+fn canvas_rect(h: &Harness<'static, PhotocraftApp>) -> egui::Rect {
+    let hits = craft_ui::docking::DockArea::<String>::hit_rects(&h.ctx, area_id());
+    let divider = hits
+        .iter()
+        .find(|(hit, _)| matches!(hit, craft_ui::docking::Hit::Divider(craft_ui::docking::Divider::Column(_))))
+        .map(|(_, rect)| *rect)
+        .expect("the dock column's edge is drawn");
+    egui::Rect::from_min_max(egui::pos2(0.0, divider.top()), egui::pos2(divider.left(), divider.bottom()))
+}
+
+/// The panels of the root split's canvas side, which a drop beside the canvas splits.
+fn canvas_side(layout: &Layout<String>) -> Layout<String> {
+    let Some(Node::Split { first, .. }) = &layout.root else { panic!("the canvas is beside the dock: {layout:?}") };
+    Layout { root: Some(first.as_ref().clone()), floating: Vec::new() }
 }
 
 #[test]
-fn brushes_tab_drag_floats_and_can_redock_into_another_tab_group() {
+fn a_fresh_launch_draws_the_native_groups_beside_the_protected_canvas() {
+    let mut h = harness(app(), vec2(1280.0, 800.0));
+    assert!(h.state().ui.docking.is_none(), "drawing the default does not customize the workspace");
+    let layout = legacy(h.state());
+    assert!(valid(&layout));
+    assert_eq!(
+        root_groups(&layout),
+        [vec!["color", "swatches", "gradients", "patterns"], vec!["properties", "adjustments"], vec!["layers", "channels", "paths"]]
+    );
+    assert!(in_dock_column(&layout, "layers"), "the groups are a dock column: {layout:?}");
+    let canvas = canvas_rect(&h);
+    let tops: Vec<f32> = ["color", "properties", "layers"].iter().map(|panel| tab_rect(&h, panel).top()).collect();
+    assert!(tops.windows(2).all(|pair| pair[0] < pair[1]), "top to bottom: {tops:?}");
+    assert!(tab_rect(&h, "color").left() > canvas.right(), "the dock is at the end edge");
+    let hits = craft_ui::docking::DockArea::<String>::hit_rects(&h.ctx, area_id());
+    assert!(!hits.iter().any(|(hit, _)| *hit == craft_ui::docking::Hit::Tab(CANVAS.into())), "the canvas has no tab");
+    for command in ["window.panel.close", "window.panel.float"] {
+        assert!(h.state_mut().run(command, json!({"panel": CANVAS})).is_err(), "{command}");
+    }
+    h.state_mut().run("window.panel.move", json!({"panel":"layers","anchor":CANVAS,"zone":"center"})).unwrap_err();
+    assert!(h.state().ui.docking.is_none(), "a refused command leaves the default");
+
+    let mut studio = crate::PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+    studio.ui.theme = crate::theme::ThemeKind::Studio;
+    let layout = legacy(&studio);
+    let window = layout.floating.first().expect("Studio floats Properties");
+    assert_eq!((window.id, window.panels().cloned().collect::<Vec<_>>()), (PROPERTIES_WINDOW, vec!["properties".to_string(), "adjustments".into()]));
+    assert_eq!(legacy(&studio).floating, layout.floating, "the same window every frame");
+
+    h.state_mut().ui.dock.set_collapsed(Group::Color, true);
+    h.run_steps(2);
+    assert!(collapsed_members(h.state(), &legacy(h.state())).contains("swatches"));
+    let color = tab_rect(&h, "color");
+    assert!(tab_rect(&h, "properties").top() - color.bottom() < 12.0, "a collapsed group shows only its tabs");
+}
+
+/// A panel no saved workspace has placed opens in its native group, or as that group in its
+/// native place in the dock column, not as a tab of whichever group comes first.
+#[test]
+fn a_panel_never_laid_out_opens_in_its_default_group_and_side() {
+    let mut app = app();
+    app.ui.docking = Some(Workspace::new(legacy(&app)));
+    app.run("window.panel.activate", json!({"panel":"navigator"})).unwrap();
+    let layout = lay(&app);
+    assert!(in_dock_column(layout, "navigator"), "{layout:?}");
+    assert_eq!(
+        root_groups(layout),
+        [vec!["color", "swatches", "gradients", "patterns"], vec!["properties", "adjustments"], vec!["navigator"], vec!["layers", "channels", "paths"]]
+    );
+    app.run("window.panel.activate", json!({"panel":"info"})).unwrap();
+    app.run("window.panel.activate", json!({"panel":"histogram"})).unwrap();
+    assert_eq!(group_members(lay(&app), "info"), ["navigator", "histogram", "info"]);
+    app.run("window.panel.activate", json!({"panel":"brushes"})).unwrap();
+    assert_eq!(root_groups(lay(&app)).last().unwrap(), &["brushes"]);
+}
+
+#[test]
+fn a_tab_dropped_on_the_canvas_floats_there_and_redocks() {
+    let mut h = harness(app(), vec2(1280.0, 800.0));
+    let canvas = canvas_rect(&h);
+    let source = tab_rect(&h, "layers").center();
+    let target = egui::pos2(canvas.left() + canvas.width() / 6.0, canvas.center().y);
+    drag(&mut h, source, target);
+    let layout = lay(h.state());
+    assert!(valid(layout));
+    assert!(!canvas_side(layout).contains(&"layers".to_string()) && !in_dock_column(layout, "layers"), "{layout:?}");
+    assert!(layout.floating.iter().any(|window| window.panels().eq(["layers".to_string()].iter())), "{layout:?}");
+    assert!(tab_rect(&h, "layers").expand(4.0).contains(target), "the tab stays under the pointer");
+
+    let source = tab_rect(&h, "layers").center();
+    let destination = tab_rect(&h, "properties").center();
+    drag(&mut h, source, destination);
+    let layout = lay(h.state());
+    let mut members = group_members(layout, "layers");
+    members.sort();
+    assert_eq!(members, ["adjustments", "layers", "properties"]);
+    assert!(in_dock_column(layout, "layers") && valid(layout));
+}
+
+#[test]
+fn brushes_tab_drag_opens_above_the_canvas_and_can_redock_into_another_tab_group() {
     let mut app = app();
     crate::menus::invoke(&mut app, &egui::Context::default(), "window.panel.brushes", json!({})).unwrap();
     let mut h = harness(app, vec2(1280.0, 800.0));
-    let source = h.query_all_by_label("Brushes").find(|node| node.rect().height() <= 45.0).unwrap().rect().center();
-    drag(&mut h, source, egui::pos2(160.0, 140.0));
-    let layout = h.state().ui.docking.as_ref().expect("brushes drag starts shared docking");
-    assert!(layout.floating.iter().any(|group| group.panels.contains(&"brushes".into())), "{layout:?}");
+    let canvas = canvas_rect(&h);
+    let source = tab_rect(&h, "brushes").center();
+    // The outer edge band along the canvas column's top.
+    drag(&mut h, source, egui::pos2(canvas.center().x, canvas.top() + 6.0));
+    let layout = lay(h.state());
+    assert!(canvas_side(layout).contains(&"brushes".to_string()), "{layout:?}");
+    assert!(!layout.floating.iter().any(|window| window.contains("brushes")));
+    let canvas_body = last_bodies(&h.ctx).into_iter().find(|(id, _)| id == CANVAS).expect("the canvas is drawn").1;
+    assert!(tab_rect(&h, "brushes").bottom() <= canvas_body.top(), "brushes is above the canvas");
 
-    let source = h.ctx.read_response(egui::Id::new("photocraft-panel-docking").with(("tab", &"brushes".to_string()))).unwrap().rect.center();
-    let destination = h.ctx.read_response(egui::Id::new("photocraft-panel-docking").with(("tab", &"layers".to_string()))).unwrap().rect.center();
+    let source = tab_rect(&h, "brushes").center();
+    let destination = tab_rect(&h, "layers").center();
     drag(&mut h, source, destination);
-    let layout = h.state().ui.docking.as_ref().unwrap();
-    assert!(!layout.floating.iter().any(|group| group.panels.contains(&"brushes".into())));
+    let layout = lay(h.state());
+    assert!(in_dock_column(layout, "brushes"));
     assert!(valid(layout));
 }
 
@@ -150,13 +271,13 @@ fn saved_workspace_restores_the_custom_tree_and_hidden_panel_placement() {
     app.run("window.panel.float", json!({"panel":"properties","x":50,"y":80})).unwrap();
     app.run("window.panel.close", json!({"panel":"swatches"})).unwrap();
     let layout = app.ui.docking.clone();
-    let hidden = app.ui.docking_hidden.clone();
+    let hidden = app.ui.docking_returns.clone();
     crate::menus::invoke(&mut app, &ctx, "window.workspace.newWorkspace", json!({"name":"Custom docking"})).unwrap();
     crate::menus::invoke(&mut app, &ctx, "window.workspace.essentials", json!({})).unwrap();
     assert!(app.ui.docking.is_none());
     crate::menus::invoke(&mut app, &ctx, "window.workspace.select", json!({"name":"Custom docking"})).unwrap();
     assert_eq!(app.ui.docking, layout);
-    assert_eq!(app.ui.docking_hidden, hidden);
+    assert_eq!(app.ui.docking_returns, hidden);
 }
 
 #[test]
@@ -170,6 +291,8 @@ fn shared_layout_keeps_panel_identity_across_themes_and_respects_workspace_lock(
     assert!(app.run("window.panel.float", json!({"panel":"color"})).is_err());
     assert_eq!(app.ui.docking, layout);
     assert!(app.run("window.panel.activate", json!({"panel":"color"})).is_ok());
+    assert!(!crate::menus::is_enabled(&app, "window.panel.window"));
+    assert!(crate::menus::is_enabled(&app, "window.panel.activate"));
 }
 
 /// Explicit offscreen evidence; this creates no native windows.
@@ -194,7 +317,7 @@ fn capture_custom_panel_docking_visual_fixtures() {
                             ready = true;
                             return;
                         }
-                        crate::panels::right_dock(app, ui);
+                        crate::panels::dock_area(app, ui);
                         egui::CentralPanel::default().show(ui, |ui| {
                             ui.label("Custom panel workspace");
                         });
@@ -203,7 +326,7 @@ fn capture_custom_panel_docking_visual_fixtures() {
                 );
                 harness.input_mut().max_texture_side = Some(8192);
                 harness.run_steps(5);
-                assert!(valid(harness.state().ui.docking.as_ref().unwrap()));
+                assert!(valid(lay(harness.state())));
                 harness.render().unwrap().save(directory.join(format!("photocraft-shared-docking-{}-{width}-{scale}x.png", theme.id()))).unwrap();
             }
         }
@@ -225,13 +348,13 @@ fn floating_group_titles_are_opaque_in_studio_themes() {
                 ready = true;
                 return;
             }
-            crate::panels::right_dock(app, ui);
+            crate::panels::dock_area(app, ui);
             egui::CentralPanel::default().frame(egui::Frame::NONE.fill(egui::Color32::from_rgb(255, 0, 255))).show(ui, |_| {});
         },
         app,
     );
     h.run_steps(5);
-    let area = h.ctx.memory(|m| m.area_rect(egui::Id::new("photocraft-panel-docking").with(("floating", &"swatches".to_string())))).unwrap();
+    let area = floating_rect(&h, "swatches");
     let image = h.render().unwrap();
     let ppp = image.width() as f32 / 1280.0;
     let strip = egui::Rect::from_min_size(area.min, vec2(area.width(), 40.0)).shrink(2.0);
@@ -252,7 +375,7 @@ fn escape_cancels_the_first_drag_without_replacing_the_legacy_workspace() {
     h.run_steps(1);
     h.event(Event::PointerMoved(source - vec2(90.0, 0.0)));
     h.run_steps(2);
-    assert!(h.state().ui.docking.is_some());
+    assert!(h.state().ui.docking.is_none(), "a drag changes nothing before its drop");
     h.event(Event::Key { key: egui::Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE });
     h.run_steps(1);
     assert!(h.state().ui.docking.is_none());
@@ -266,19 +389,14 @@ fn serialized_layout_actions_cover_geometry_reorder_accordion_and_atomic_rejecti
     let mut app = app();
     app.run("window.panel.move", json!({"panel":"swatches","anchor":"layers","zone":"top"})).unwrap();
     app.run("window.panel.layout", json!({"action":{"ResizeSplit":{"path":[],"size":{"Ratio":0.35}}}})).unwrap();
-    assert!(
-        matches!(app.ui.docking.as_ref().unwrap().root, Some(Node::Split { size: craft_ui::layout::SplitSize::Ratio(value), .. }) if (value - 0.35).abs() < 0.001)
-    );
+    assert!(matches!(lay(&app).root, Some(Node::Split { size: craft_ui::layout::SplitSize::Ratio(value), .. }) if (value - 0.35).abs() < 0.001));
     app.run("window.panel.float", json!({"panel":"properties"})).unwrap();
     app.run("window.panel.layout", json!({"action":{"MoveFloating":{"panel":"properties","rect":[44,66,360,450]}}})).unwrap();
-    assert_eq!(
-        app.ui.docking.as_ref().unwrap().floating.iter().find(|group| group.panels.iter().any(|p| p == "properties")).unwrap().rect,
-        [44.0, 66.0, 360.0, 450.0]
-    );
+    assert_eq!(lay(&app).floating.iter().find(|group| group.contains(&"properties".to_string())).unwrap().rect, [44.0, 66.0, 360.0, 450.0]);
     app.run("window.panel.layout", json!({"action":{"Move":{"panel":"properties","anchor":"swatches","placement":{"Tab":{"before":"swatches"}}}}})).unwrap();
-    assert_eq!(group_members_for_test(app.ui.docking.as_ref().unwrap(), "swatches"), ["properties", "swatches"]);
+    assert_eq!(group_members(lay(&app), "swatches"), ["properties", "swatches"]);
     let before = app.ui.docking.clone();
-    let hidden = app.ui.docking_hidden.clone();
+    let hidden = app.ui.docking_returns.clone();
     for action in [
         json!({"MoveFloating":{"panel":"properties","rect":[0,0,-5,30]}}),
         json!({"ResizeSplit":{"path":[true,true,true],"size":{"Ratio":0.2}}}),
@@ -287,37 +405,24 @@ fn serialized_layout_actions_cover_geometry_reorder_accordion_and_atomic_rejecti
     ] {
         assert!(app.run("window.panel.layout", json!({"action":action})).is_err());
         assert_eq!(app.ui.docking, before);
-        assert_eq!(app.ui.docking_hidden, hidden);
+        assert_eq!(app.ui.docking_returns, hidden);
     }
-    app.ui.docking = Some(Layout {
-        root: Some(Node::Stack { entries: vec![craft_ui::docking::StackEntry { panel: "layers".into(), open: true, height: Some(100.0) }] }),
-        floating: Vec::new(),
-    });
+    let stack = Node::Stack { entries: vec![craft_ui::docking::StackEntry { panel: "layers".into(), open: true, height: Some(100.0) }] };
+    app.ui.docking = Some(Workspace::new(Layout { root: Some(with_canvas(stack, 300.0)), floating: Vec::new() }));
     app.run("window.panel.layout", json!({"action":{"SetStackOpen":{"panel":"layers","open":false}}})).unwrap();
     app.run("window.panel.layout", json!({"action":{"ResizeStack":{"panel":"layers","height":150}}})).unwrap();
-    let Some(Node::Stack { entries }) = &app.ui.docking.as_ref().unwrap().root else { panic!("expected stack") };
+    let Some(Node::Split { second, .. }) = &lay(&app).root else { panic!("expected the canvas split") };
+    let Node::Stack { entries } = second.as_ref() else { panic!("expected stack") };
     assert!(!entries[0].open);
     assert_eq!(entries[0].height, Some(150.0));
 }
 
-fn group_members_for_test(layout: &Layout<String>, panel: &str) -> Vec<String> {
-    let mut pending: Vec<_> = layout.root.iter().collect();
-    while let Some(node) = pending.pop() {
-        match node {
-            Node::Tabs { panels, .. } if panels.iter().any(|p| p == panel) => return panels.clone(),
-            Node::Split { first, second, .. } => pending.extend([first.as_ref(), second.as_ref()]),
-            _ => {}
-        }
-    }
-    Vec::new()
-}
-
 #[test]
 fn customization_retains_native_collapsed_groups_until_their_tab_is_activated() {
     let mut app = app();
     app.ui.dock.set_collapsed(Group::Color, true);
     app.run("window.panel.float", json!({"panel":"properties"})).unwrap();
-    let layout = app.ui.docking.as_ref().unwrap();
+    let layout = lay(&app);
     assert!(collapsed_members(&app, layout).contains("swatches"));
     let saved = serde_json::to_value(&app.ui).unwrap();
     let restored: crate::state::UiState = serde_json::from_value(saved).unwrap();
@@ -372,14 +477,14 @@ fn populated_canvas_keeps_a_real_opacity_edit_after_floating_and_redocking() {
             crate::panels::title_bar(app, ui);
             crate::panels::options_bar(app, ui);
             crate::panels::toolbar(app, ui);
-            crate::panels::right_dock(app, ui);
+            crate::panels::dock_area(app, ui);
             egui::CentralPanel::default().show(ui, |ui| crate::canvas::document_area(app, ui));
         },
         app,
     );
     h.input_mut().max_texture_side = Some(8192);
     h.run_steps(5);
-    let floating = h.ctx.memory(|m| m.area_rect(egui::Id::new("photocraft-panel-docking").with(("floating", &"properties".to_string())))).unwrap();
+    let floating = floating_rect(&h, "properties");
     let mut sliders: Vec<_> = h.ctx.viewport(|vp| {
         vp.prev_pass
             .widgets
@@ -404,10 +509,10 @@ fn populated_canvas_keeps_a_real_opacity_edit_after_floating_and_redocking() {
         std::fs::create_dir_all(directory).unwrap();
         h.render().unwrap().save(directory.join("photocraft-populated-opacity-floating.png")).unwrap();
     }
-    let from = h.ctx.read_response(egui::Id::new("photocraft-panel-docking").with(("tab", &"properties".to_string()))).unwrap().rect.center();
-    let to = h.ctx.read_response(egui::Id::new("photocraft-panel-docking").with(("tab", &"layers".to_string()))).unwrap().rect.center();
+    let from = tab_rect(&h, "properties").center();
+    let to = tab_rect(&h, "layers").center();
     drag(&mut h, from, to);
-    assert!(h.state().ui.docking.as_ref().unwrap().floating.iter().all(|group| !group.panels.iter().any(|panel| panel == "properties")));
+    assert!(lay(h.state()).floating.iter().all(|group| !group.contains(&"properties".to_string())));
     assert_eq!(h.state().session.active().unwrap().doc.layer(layer).unwrap().opacity, opacity);
     if let Some(directory) = &directory {
         h.render().unwrap().save(directory.join("photocraft-populated-opacity-redocked.png")).unwrap();
@@ -440,63 +545,6 @@ fn changing_workspace_during_a_drag_cancels_the_stale_gesture() {
     assert_eq!(h.state().ui.docking, destination);
 }
 
-#[test]
-fn first_legacy_drag_workspace_switch_preserves_custom_and_legacy_destinations() {
-    let layout_state = |app: &PhotocraftApp| json!({"panels":app.ui.panels,"dock":app.ui.dock,"tabs":app.ui.dock_tabs,"layout":app.ui.docking,"hidden":app.ui.docking_hidden,"collapsed":app.ui.docking_collapsed,"timeline":app.ui.timeline.open});
-    for customized_destination in [true, false] {
-        for cancellation in ["release", "escape", "focus-loss"] {
-            let mut app = app();
-            let ctx = egui::Context::default();
-            if customized_destination {
-                app.run("window.panel.move", json!({"panel":"swatches","anchor":"layers","zone":"top"})).unwrap();
-                crate::menus::invoke(&mut app, &ctx, "window.workspace.newWorkspace", json!({"name":"Destination"})).unwrap();
-                crate::menus::invoke(&mut app, &ctx, "window.workspace.essentials", json!({})).unwrap();
-            }
-            let mut h = harness(app, vec2(1280.0, 800.0));
-            let source = h.query_all_by_label("Layers").find(|node| node.rect().height() <= 45.0).unwrap().rect().center();
-            h.event(Event::PointerMoved(source));
-            h.run_steps(1);
-            h.event(Event::PointerButton { pos: source, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-            h.run_steps(1);
-            h.event(Event::PointerMoved(source - vec2(90.0, 0.0)));
-            // One frame installs the first legacy drag; no shared dock has rendered yet.
-            h.run_steps(1);
-            assert!(h.state().ui.docking.is_some());
-            let origin = egui::Id::new("photocraft-panel-docking").with("legacy-origin");
-            assert!(h.ctx.data_mut(|data| data.get_temp::<LegacyDrag>(origin)).unwrap().layout.is_none());
-            let ctx = h.ctx.clone();
-            let command = if customized_destination { "window.workspace.select" } else { "window.workspace.painting" };
-            crate::menus::invoke(h.state_mut(), &ctx, command, json!({"name":"Destination"})).unwrap();
-            assert_eq!(h.state().ui.docking.is_some(), customized_destination);
-            let destination = layout_state(h.state());
-            let tabs = serde_json::to_value(h.state().ui.dock_tabs).unwrap();
-            match cancellation {
-                "escape" => h.event(Event::Key { key: egui::Key::Escape, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::NONE }),
-                "focus-loss" => h.event(Event::WindowFocused(false)),
-                _ => {
-                    h.event(Event::PointerButton { pos: source - vec2(90.0, 0.0), button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE })
-                }
-            }
-            h.run_steps(1);
-            assert_eq!(layout_state(h.state()), destination, "{customized_destination}/{cancellation}");
-            if cancellation == "focus-loss" {
-                let at = source - vec2(90.0, 0.0);
-                h.event(Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed: true, modifiers: Modifiers::NONE });
-                h.run_steps(1);
-                assert_eq!(layout_state(h.state()), destination, "secondary press must not resume the stale primary drag");
-                h.event(Event::PointerButton { pos: at, button: PointerButton::Secondary, pressed: false, modifiers: Modifiers::NONE });
-                h.run_steps(1);
-            }
-            assert_eq!(serde_json::to_value(h.state().ui.dock_tabs).unwrap(), tabs);
-            assert!(h.ctx.data_mut(|data| data.get_temp::<LegacyDrag>(origin)).is_none(), "stale origin: {customized_destination}/{cancellation}");
-            h.event(Event::WindowFocused(true));
-            h.event(Event::PointerButton { pos: source, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-            h.run_steps(2);
-            assert_eq!(layout_state(h.state()), destination);
-        }
-    }
-}
-
 fn control_set(app: &mut PhotocraftApp, ctx: &egui::Context, params: Value) -> Value {
     let (request, _) = crate::control::ControlRequest::new("ui.set", params);
     match crate::control::handle(app, ctx, &request) {
@@ -522,12 +570,12 @@ fn current_main_hidden_tabs_migrate_by_name_and_selected_identity() {
         restored.ui.theme = theme;
         crate::dock::apply(&mut restored, &saved);
         restored.run("window.panel.float", json!({"panel":"properties"})).unwrap();
-        let layout = restored.ui.docking.as_ref().unwrap();
+        let layout = lay(&restored);
         assert!(!layout.contains(&"swatches".into()) && !layout.contains(&"paths".into()));
         assert!(panel_active(layout, "color"));
-        assert!(restored.ui.docking_hidden.contains_key("swatches") && restored.ui.docking_hidden.contains_key("paths"));
+        assert!(hidden(&restored, "swatches") && hidden(&restored, "paths"));
         restored.run("window.panel.swatches", json!({"show":true})).unwrap();
-        assert!(panel_active(restored.ui.docking.as_ref().unwrap(), "swatches"));
+        assert!(panel_active(lay(&restored), "swatches"));
     }
 }
 
@@ -538,12 +586,12 @@ fn legacy_control_updates_authoritative_custom_visibility_and_selection_atomical
     app.run("window.panel.float", json!({"panel":"properties"})).unwrap();
     let ctx = egui::Context::default();
     assert_eq!(control_set(&mut app, &ctx, json!({"dockTabs":{"layers":1}}))["ok"], true);
-    assert!(panel_active(app.ui.docking.as_ref().unwrap(), "channels"));
+    assert!(panel_active(lay(&app), "channels"));
     assert_eq!(control_set(&mut app, &ctx, json!({"panels":{"layers":false}}))["ok"], true);
-    assert!(PANELS.iter().filter(|p| p.2 == Group::Layers).all(|p| !app.ui.docking.as_ref().unwrap().contains(&p.0.into())));
+    assert!(PANELS.iter().filter(|p| p.2 == Group::Layers).all(|p| !lay(&app).contains(&p.0.into())));
     assert!(!app.ui.panels.layers);
     assert_eq!(control_set(&mut app, &ctx, json!({"panels":{"layers":true},"dockTabs":{"layers":2}}))["ok"], true);
-    assert!(panel_active(app.ui.docking.as_ref().unwrap(), "paths"));
+    assert!(panel_active(lay(&app), "paths"));
     let before = serde_json::to_value(&app.ui).unwrap();
     for request in [
         json!({"panels":{"color":false},"dockTabs":{"layers":999}}),
@@ -566,8 +614,9 @@ fn legacy_dock_width_is_consumed_by_custom_renderer_and_clamped_to_existing_rang
     for (requested, expected) in [(410.0, 410.0), (700.0, 700.0), (900.0, 880.0), (20.0, 250.0)] {
         assert_eq!(control_set(h.state_mut(), &ctx, json!({"dockWidth":requested}))["ok"], true);
         h.run_steps(2);
-        let state = egui::containers::panel::PanelState::load(&h.ctx, egui::Id::new("shared-panel-dock")).unwrap();
-        assert!((state.outer_rect.width() - expected).abs() < 1.0, "{} / {expected}", state.outer_rect.width());
+        let Some(Node::Split { second, .. }) = &lay(h.state()).root else { panic!("expected the canvas split") };
+        let Node::Dock { columns, .. } = second.as_ref() else { panic!("expected the dock") };
+        assert!((columns[0].width - expected).abs() < 1.0, "{} / {expected}", columns[0].width);
         assert!(h.ctx.data(|data| data.get_temp::<f32>(crate::panels::dock_width_id())).is_none());
     }
 }
@@ -578,10 +627,10 @@ fn explicit_reveal_activates_existing_tab_and_expands_custom_group() {
     app.run("window.panel.move", json!({"panel":"properties","anchor":"layers"})).unwrap();
     app.run("window.panel.group", json!({"panel":"layers","operation":"collapse"})).unwrap();
     app.run("window.panel.layers", json!({"show":true})).unwrap();
-    assert!(panel_active(app.ui.docking.as_ref().unwrap(), "layers"));
-    assert!(!collapsed_members(&app, app.ui.docking.as_ref().unwrap()).contains("layers"));
+    assert!(panel_active(lay(&app), "layers"));
+    assert!(!collapsed_members(&app, lay(&app)).contains("layers"));
     app.run("window.panel.layers", json!({"show":true})).unwrap();
-    assert!(app.ui.docking.as_ref().unwrap().contains(&"layers".into()));
+    assert!(lay(&app).contains(&"layers".into()));
     let before = app.ui.docking.clone();
     assert!(app.run("window.panel.layers", json!({"show":"yes"})).is_err());
     assert_eq!(app.ui.docking, before);
@@ -609,30 +658,30 @@ fn pro_color_field_fills_a_tall_custom_group() {
 fn a_new_adjustment_layer_activates_properties_in_a_custom_workspace() {
     let mut app = app();
     app.run("window.panel.activate", json!({"panel":"adjustments"})).unwrap();
-    assert!(panel_active(app.ui.docking.as_ref().unwrap(), "adjustments"));
+    assert!(panel_active(lay(&app), "adjustments"));
     app.run("file.new", json!({"width":64,"height":64})).unwrap();
     app.run("layer.newAdjustmentLayer.curves", json!({})).unwrap();
-    assert!(panel_active(app.ui.docking.as_ref().unwrap(), "properties"));
+    assert!(panel_active(lay(&app), "properties"));
 }
 
 #[test]
 fn custom_group_commands_preserve_members_and_workspace_timeline() {
     let mut app = app();
     app.run("window.panel.move", json!({"panel":"properties","anchor":"layers"})).unwrap();
-    let members = group_members(app.ui.docking.as_ref().unwrap(), "layers");
+    let members = group_members(lay(&app), "layers");
     app.run("window.panel.group", json!({"panel":"layers","operation":"up"})).unwrap();
-    assert_eq!(group_members(app.ui.docking.as_ref().unwrap(), "layers"), members);
+    assert_eq!(group_members(lay(&app), "layers"), members);
     app.ui.timeline.open = true;
     app.run("window.panel.group", json!({"panel":"layers","operation":"collapse"})).unwrap();
-    let saved = json!({"panels":app.ui.panels,"dock":app.ui.dock,"dockTabs":app.ui.dock_tabs,"docking":app.ui.docking,"dockingHidden":app.ui.docking_hidden,"dockingCollapsed":app.ui.docking_collapsed,"timelineOpen":true});
+    let saved = json!({"panels":app.ui.panels,"dock":app.ui.dock,"dockTabs":app.ui.dock_tabs,"docking":app.ui.docking,"dockingReturns":app.ui.docking_returns,"dockingCollapsed":app.ui.docking_collapsed,"timelineOpen":true});
     let mut restored = self::app();
     crate::dock::apply(&mut restored, &saved);
     assert_eq!(restored.ui.docking, app.ui.docking);
     assert!(restored.ui.timeline.open);
-    assert!(collapsed_members(&restored, restored.ui.docking.as_ref().unwrap()).contains("layers"));
+    assert!(collapsed_members(&restored, lay(&restored)).contains("layers"));
     app.run("window.panel.group", json!({"panel":"layers","operation":"close"})).unwrap();
-    assert!(members.iter().all(|id| !app.ui.docking.as_ref().unwrap().contains(id)));
-    assert!(members.iter().all(|id| app.ui.docking_hidden.contains_key(id)));
+    assert!(members.iter().all(|id| !lay(&app).contains(id)));
+    assert!(members.iter().all(|id| hidden(&app, id)));
     app.session.prefs.edit(|p| p.workspace_locked = true);
     let before = serde_json::to_value(&app.ui).unwrap();
     assert!(app.run("window.panel.group", json!({"panel":"color","operation":"close"})).is_err());
@@ -649,7 +698,7 @@ fn customized_panel_menus_and_rail_remain_reachable_after_float_and_restore() {
     let mut h = harness(app, vec2(1280.0, 800.0));
     assert!(h.query_all_by_label("Panel menu").count() > 0);
     assert!(h.query_all_by_label("Color & Swatches").count() > 0);
-    let floating = h.ctx.memory(|memory| memory.area_rect(egui::Id::new("photocraft-panel-docking").with(("floating", &"swatches".to_string())))).unwrap();
+    let floating = floating_rect(&h, "swatches");
     let first = h.query_all_by_label("Panel menu").find(|node| floating.contains_rect(node.rect())).unwrap().rect().center();
     h.hover_at(first);
     for pressed in [true, false] {
@@ -682,7 +731,7 @@ fn floated_color_panel_menu_picks_the_mode() {
     let mut app = app();
     app.run("window.panel.float", json!({"panel":"color","x":20,"y":40})).unwrap();
     let mut h = harness(app, vec2(1280.0, 800.0));
-    let floating = h.ctx.memory(|memory| memory.area_rect(egui::Id::new("photocraft-panel-docking").with(("floating", &"color".to_string())))).unwrap();
+    let floating = floating_rect(&h, "color");
     let button = h.query_all_by_label("Panel menu").find(|node| floating.contains_rect(node.rect())).unwrap().rect().center();
     h.hover_at(button);
     for pressed in [true, false] {
@@ -739,13 +788,13 @@ fn custom_workspace_saves_shared_layout_and_timeline_without_embedding_flags() {
 fn closing_and_reopening_a_whole_group_retains_its_return_position_and_tab_order() {
     let mut app = app();
     app.run("window.panel.float", json!({"panel":"properties"})).unwrap();
-    let before = app.ui.docking.clone().unwrap();
+    let before = lay(&app).clone();
     let members = group_members(&before, "layers");
     app.run("window.panel.group", json!({"panel":"layers","operation":"close"})).unwrap();
     for panel in &members {
         app.run("window.panel.activate", json!({"panel":panel})).unwrap();
     }
-    let after = app.ui.docking.as_ref().unwrap();
+    let after = lay(&app);
     assert_eq!(group_members(after, "layers"), members);
     assert_eq!(root_groups(after), root_groups(&before));
     assert!(valid(after));
@@ -757,11 +806,11 @@ fn floating_group_grip_redocks_all_tabs_as_one_atomic_move() {
     app.run("window.panel.float", json!({"panel":"swatches","x":30,"y":60})).unwrap();
     app.run("window.panel.move", json!({"panel":"patterns","anchor":"swatches"})).unwrap();
     let mut h = harness(app, vec2(1280.0, 800.0));
-    let from = h.ctx.read_response(egui::Id::new("photocraft-panel-docking").with(("move-group", Some(&"swatches".to_string())))).unwrap().rect.center();
-    let to = h.ctx.read_response(egui::Id::new("photocraft-panel-docking").with(("tab", &"layers".to_string()))).unwrap().rect.center();
+    let from = hit_rect(&h, craft_ui::docking::Hit::DragBar("swatches".into())).center();
+    let to = tab_rect(&h, "layers").center();
     drag(&mut h, from, to);
-    let layout = h.state().ui.docking.as_ref().unwrap();
-    assert!(layout.floating.iter().all(|group| !group.panels.iter().any(|id| id == "swatches" || id == "patterns")));
+    let layout = lay(h.state());
+    assert!(layout.floating.iter().all(|group| !group.contains(&"swatches".to_string()) && !group.contains(&"patterns".to_string())));
     let members = group_members(layout, "layers");
     let swatches = members.iter().position(|id| id == "swatches").unwrap();
     assert_eq!(members.get(swatches + 1).map(String::as_str), Some("patterns"));
@@ -778,38 +827,13 @@ fn mixed_theme_and_legacy_selection_projects_the_selected_panel_in_the_new_theme
     app.run("window.panel.float", json!({"panel":"properties"})).unwrap();
     let ctx = egui::Context::default();
     assert_eq!(control_set(&mut app, &ctx, json!({"theme":"studio","dockTabs":{"color":0}}))["ok"], true);
-    assert!(panel_active(app.ui.docking.as_ref().unwrap(), "swatches"));
+    assert!(panel_active(lay(&app), "swatches"));
     assert_eq!(app.ui.dock_tabs.color, 0);
     assert_eq!(control_set(&mut app, &ctx, json!({"theme":"proMedium","dockTabs":{"color":0}}))["ok"], true);
-    assert!(panel_active(app.ui.docking.as_ref().unwrap(), "color"));
+    assert!(panel_active(lay(&app), "color"));
     assert_eq!(app.ui.dock_tabs.color, 0);
 }
 
-#[test]
-fn native_tab_reorder_stays_native_until_drag_crosses_the_strip() {
-    let mut h = harness(app(), vec2(1280.0, 800.0));
-    let source = h.query_all_by_label("Layers").find(|node| node.rect().height() <= 45.0).unwrap().rect().center();
-    let target = h.query_all_by_label("Channels").find(|node| node.rect().height() <= 45.0).unwrap().rect().right_center() - vec2(1.0, 0.0);
-    h.event(Event::PointerMoved(source));
-    h.run_steps(1);
-    h.event(Event::PointerButton { pos: source, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
-    h.run_steps(1);
-    let near_edge = egui::pos2(target.x, source.y - 21.0);
-    h.event(Event::PointerMoved(near_edge));
-    h.run_steps(1);
-    assert!(h.state().ui.docking.is_none(), "native near-edge reorder tolerance must not promote to custom docking");
-    h.event(Event::PointerMoved(target));
-    h.run_steps(1);
-    assert!(h.state().ui.docking.is_none(), "native horizontal reorder must not promote to custom docking");
-    h.event(Event::PointerButton { pos: target, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
-    h.run_steps(2);
-    assert!(h.state().ui.docking.is_none());
-    let tabs = h.state().ui.dock.visible_tabs(Group::Layers, false);
-    let layers = tabs.iter().position(|(_, label)| *label == "Layers").unwrap();
-    let channels = tabs.iter().position(|(_, label)| *label == "Channels").unwrap();
-    assert!(channels < layers, "upstream native reorder remains effective");
-}
-
 /// #7896: the dock's widest is the window less what the toolbar and the canvas keep, never
 /// below the old 520 points, so a wide window allows a two-column dock.
 #[test]
@@ -819,3 +843,51 @@ fn the_dock_can_be_as_wide_as_the_window_allows() {
         assert_eq!((*range.start(), *range.end()), (crate::panels::DOCK_MIN_WIDTH, max), "{window}");
     }
 }
+
+/// A workspace file written by main: a bare `docking` layout with `dockingHidden` and
+/// `dockingCollapsed` beside the native keys. It loads as the default built from the native
+/// keys, and the first change saves a versioned workspace.
+#[test]
+fn main_workspace_file_loads_as_the_default_and_saves_as_a_workspace() {
+    let saved: Value = serde_json::from_str(include_str!("../tests/fixtures/main-docking-workspace.json")).unwrap();
+    let mut app = app();
+    app.ui.theme = crate::theme::ThemeKind::ProMedium;
+    crate::dock::apply(&mut app, &saved);
+    assert!(app.ui.docking.is_none() && app.ui.docking_returns.is_empty() && app.ui.docking_collapsed.is_empty());
+    let workspace = legacy_workspace(&app);
+    let layout = &workspace.layout;
+    assert_eq!(
+        root_groups(layout),
+        [vec!["color", "swatches", "gradients", "patterns"], vec!["properties", "adjustments"], vec!["history", "actions"], vec!["layers", "channels"]]
+    );
+    assert!(in_dock_column(layout, "layers") && panel_active(layout, "actions"));
+    for (panel, _, _) in PANELS {
+        let panel = panel.to_string();
+        assert!(layout.contains(&panel) || workspace.hidden.iter().any(|(id, _)| *id == panel), "{panel} is shown or can be reopened");
+    }
+
+    app.run("window.panel.float", json!({"panel":"properties"})).unwrap();
+    let written = crate::dock::snapshot(&app);
+    assert!(written.get("dockingHidden").is_none());
+    assert_eq!(written["docking"]["version"], 2);
+    let mut reloaded = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
+    crate::dock::apply(&mut reloaded, &written);
+    let again = reloaded.ui.docking.as_ref().expect("the workspace loads as saved");
+    let now = app.ui.docking.as_ref().unwrap();
+    assert_eq!((&again.layout, &again.hidden), (&now.layout, &now.hidden));
+    assert_eq!(reloaded.ui.docking_returns, app.ui.docking_returns);
+}
+
+/// The width a user gave the native dock, kept in egui's memory, sizes the default column once.
+#[test]
+fn the_native_dock_width_sizes_the_default_column() {
+    let mut h = harness(app(), vec2(1280.0, 800.0));
+    let state = egui::PanelState { outer_rect: egui::Rect::from_min_size(egui::pos2(900.0, 0.0), vec2(380.0, 700.0)) };
+    let key = crate::panels::panel_state_id(&h.ctx, "dock");
+    h.ctx.data_mut(|data| data.insert_persisted(key, state));
+    h.run_steps(2);
+    let Some(Node::Split { second, .. }) = &lay(h.state()).root else { panic!("expected the canvas split") };
+    let Node::Dock { columns, .. } = second.as_ref() else { panic!("expected the dock") };
+    assert_eq!(columns[0].width, 380.0);
+    assert!(h.ctx.data_mut(|data| data.get_persisted::<egui::PanelState>(key)).is_none(), "taken once");
+}
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index b6bd34d9d2..b86d7b2af9 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -11,6 +11,103 @@ use crate::state::Tool;
 use crate::theme::{self, Tokens};
 use crate::{PhotocraftApp, icons, widgets};
 
+// ----------------------------------------------------------------------------- panel state
+
+/// The persisted [`egui::PanelState`] key for the panel named `salt` in this context's root UI.
+///
+/// egui 0.37 derives a panel's id from its parent [`egui::Ui`]:
+/// `panel_ui.scope_id().with_salt(salt)`. For the root Ui that is
+/// `ctx.viewport_id().root_ui_id().with(salt)`, whereas 0.36 stored the same panels under
+/// `Id::new(salt)` (`Id::unique(salt)` has the same hash). Use this in tests and migrations; never
+/// substitute [`egui::Ui::unique_id`], which is unstable.
+pub fn panel_state_id(ctx: &egui::Context, salt: impl egui::AsIdSalt) -> egui::Id {
+    ctx.viewport_id().root_ui_id().with(salt)
+}
+
+/// The panels whose saved sizes moved to a parent-scoped key in 0.37.
+const PANEL_STATE_KEYS: &[&str] = &["dock", "title_bar", "options_bar", "status_bar", "toolbar", "rail", "shared-panel-dock"];
+
+/// What the two keys held when this build last looked at a panel, so a later startup can tell
+/// which one a 0.36 rollback or a 0.37 session wrote last.
+#[derive(Clone, Copy, serde::Serialize, serde::Deserialize)]
+struct PanelStamp {
+    old: [f32; 4],
+    new: [f32; 4],
+}
+
+fn rect_key(state: egui::containers::panel::PanelState) -> [f32; 4] {
+    let r = state.outer_rect;
+    [r.min.x, r.min.y, r.max.x, r.max.y]
+}
+
+fn stamp_id(name: &str) -> egui::Id {
+    egui::Id::unique(format!("photocraft-panel-state-stamp:{name}"))
+}
+
+/// Copy 0.36 `PanelState` entries to their 0.37 parent-scoped keys.
+///
+/// The old `Id::unique(name)` entry is left in place so a 0.36 build still reads the same saved
+/// widths. On a later startup, a stamp of both keys decides which one is newer: if a 0.36 build
+/// resized the panel after the migration (the old key differs from the stamp, the new one does
+/// not), the old key wins; a 0.37 resize (the new key differs) is kept. If both changed the order
+/// is unknown; the new key is kept, so a 0.37 resize *after* a 0.36 rollback resize can still be
+/// lost (documented in the plan's rollback section). Data-only: call it before any panel is shown.
+pub fn migrate_panel_state(ctx: &egui::Context) {
+    use egui::containers::panel::PanelState;
+    let done = egui::Id::unique("photocraft-panel-state-migrated");
+    if ctx.data(|d| d.get_temp::<bool>(done).unwrap_or(false)) {
+        return;
+    }
+    for name in PANEL_STATE_KEYS {
+        let old_id = egui::Id::unique(*name);
+        let new_id = panel_state_id(ctx, *name);
+        let id = stamp_id(name);
+        let old = PanelState::load(ctx, old_id);
+        let new = PanelState::load(ctx, new_id);
+        let stamp = ctx.data_mut(|d| d.get_persisted::<PanelStamp>(id));
+        let Some(old) = old else { continue };
+        let old_key = rect_key(old);
+        match (new, stamp) {
+            (None, _) => {
+                // First migration: copy, and remember what both keys held.
+                ctx.data_mut(|d| d.insert_persisted(new_id, old));
+                ctx.data_mut(|d| d.insert_persisted(id, PanelStamp { old: old_key, new: old_key }));
+            }
+            (Some(new), None) => {
+                // A partial migration or a pre-existing 0.37 value: keep it and start stamping.
+                ctx.data_mut(|d| d.insert_persisted(id, PanelStamp { old: old_key, new: rect_key(new) }));
+            }
+            (Some(new), Some(stamp)) => {
+                let old_changed = old_key != stamp.old;
+                let new_changed = rect_key(new) != stamp.new;
+                if old_changed && !new_changed {
+                    // A 0.36 rollback resized the panel after the migration: its key is newer.
+                    ctx.data_mut(|d| d.insert_persisted(new_id, old));
+                    ctx.data_mut(|d| d.insert_persisted(id, PanelStamp { old: old_key, new: old_key }));
+                } else if new_changed {
+                    ctx.data_mut(|d| d.insert_persisted(id, PanelStamp { old: old_key, new: rect_key(new) }));
+                }
+            }
+        }
+    }
+    ctx.data_mut(|d| d.insert_temp(done, true));
+}
+
+/// Remember the 0.37 panel sizes this session ends a pass with, so a later 0.36 rollback's newer
+/// old-key values can be recognized. Cheap when nothing changed (no write).
+pub fn remember_panel_state(ctx: &egui::Context) {
+    use egui::containers::panel::PanelState;
+    for name in PANEL_STATE_KEYS {
+        let Some(new) = PanelState::load(ctx, panel_state_id(ctx, *name)) else { continue };
+        let id = stamp_id(name);
+        let Some(stamp) = ctx.data_mut(|d| d.get_persisted::<PanelStamp>(id)) else { continue };
+        let new_key = rect_key(new);
+        if new_key != stamp.new {
+            ctx.data_mut(|d| d.insert_persisted(id, PanelStamp { old: stamp.old, new: new_key }));
+        }
+    }
+}
+
 // ----------------------------------------------------------------------------- toolbar
 
 /// Tool groups separated by hairlines, Photoshop order.
@@ -30,7 +127,7 @@ const TOOL_SECTIONS: &[&[&[Tool]]] = &[
         &[Tool::Remove, Tool::SpotHealing, Tool::Healing, Tool::Patch, Tool::ContentAwareMove, Tool::RedEye],
         &[Tool::Brush, Tool::Pencil, Tool::MixerBrush, Tool::ColorReplacement],
         &[Tool::CloneStamp, Tool::PatternStamp],
-        &[Tool::HistoryBrush],
+        &[Tool::HistoryBrush, Tool::ArtHistoryBrush],
         &[Tool::Eraser, Tool::BackgroundEraser, Tool::MagicEraser],
         &[Tool::Gradient, Tool::PaintBucket],
         &[Tool::Blur, Tool::Sharpen, Tool::Smudge],
@@ -107,7 +204,7 @@ pub fn toolbar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             let (cr, resp) = ui.allocate_exact_size(vec2(bx, 14.0), Sense::click());
             let (shrink, grow) = if crate::direction::is_rtl() { ("chevrons-right", "chevrons-left") } else { ("chevrons-left", "chevrons-right") };
             icons::paint(ui, cr, if double { shrink } else { grow }, 11.0, if resp.hovered() { t.text } else { t.text_faint });
-            resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Toolbar")));
+            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Toolbar")));
             if resp.clicked() {
                 app.ui.panels.toolbar_double = !double;
             }
@@ -128,7 +225,7 @@ pub fn toolbar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 ui.painter().add(mesh);
             }
             ui.spacing_mut().item_spacing = vec2(2.0, 3.0);
-            let flyout_id = egui::Id::new("tool-flyout");
+            let flyout_id = egui::Id::unique("tool-flyout");
             let held_id = flyout_id.with("held");
             if ui.input(|i| i.pointer.any_pressed()) {
                 ui.data_mut(|d| d.remove::<egui::Id>(held_id));
@@ -165,7 +262,7 @@ pub fn toolbar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                         for row in rows {
                             ui.horizontal(|ui| {
                                 for (slot_index, slot) in row.iter() {
-                                    let key = egui::Id::new(("tool-slot", *slot_index));
+                                    let key = egui::Id::unique(("tool-slot", *slot_index));
                                     let tool = slot_tool(ui, app.ui.tool, slot, key);
                                     let sel = slot.contains(&app.ui.tool);
                                     let tip = match crate::tool_shortcuts::shortcut(app, tool) {
@@ -485,8 +582,8 @@ fn color_chips(app: &mut PhotocraftApp, ui: &mut egui::Ui, two_columns: bool, co
         frame(fg);
     }
     // Photoshop: clicking a chip opens the Color Picker for that colour.
-    let bg_resp = ui.interact(bg, ui.id().with("bgchip"), Sense::click());
-    let fg_resp = ui.interact(fg, ui.id().with("fgchip"), Sense::click());
+    let bg_resp = ui.interact(bg, ui.scope_id().with("bgchip"), Sense::click());
+    let fg_resp = ui.interact(fg, ui.scope_id().with("fgchip"), Sense::click());
     if fg_resp.on_hover_text(tl!("Set foreground color")).clicked() {
         crate::color_picker_ui::open(app, "foreground");
     } else if bg_resp.on_hover_text(tl!("Set background color")).clicked() {
@@ -512,8 +609,8 @@ fn color_chips(app: &mut PhotocraftApp, ui: &mut egui::Ui, two_columns: bool, co
         let icon = |x: f32| Rect::from_min_size(pos2(x, rect.top()), vec2(CHIP_ICON, CHIP_ICON));
         (Some(icon(left)), icon(left + group - CHIP_ICON))
     };
-    let d = dr.map(|dr| ui.interact(dr, ui.id().with("default-colors"), Sense::click()));
-    let s = ui.interact(sr, ui.id().with("swap-colors"), Sense::click());
+    let d = dr.map(|dr| ui.interact(dr, ui.scope_id().with("default-colors"), Sense::click()));
+    let s = ui.interact(sr, ui.scope_id().with("swap-colors"), Sense::click());
     let p = ui.painter();
     for (r, resp) in dr.into_iter().zip(d.iter()).chain([(sr, &s)]) {
         if resp.hovered() && !studio {
@@ -563,9 +660,9 @@ fn color_chips(app: &mut PhotocraftApp, ui: &mut egui::Ui, two_columns: bool, co
         p.rect_stroke(b, 1.0, Stroke::new(1.0, ink(d)), StrokeKind::Inside);
     }
     if let Some(d) = &d {
-        d.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Default colours (D)")));
+        d.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Default colours (D)")));
     }
-    s.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Swap colours (X)")));
+    s.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Swap colours (X)")));
     if s.on_hover_text(tl!("Swap colours (X)")).clicked() {
         chip_command(app, "tools.swapColors");
     }
@@ -611,11 +708,11 @@ pub fn title_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             // Only the free gap between the menus and the far-end controls drags the window: a
             // press on a menu title must open the menu, never move the window. The gap is last
             // frame's, as the menus are laid out after this.
-            let span_id = ui.id().with("titledrag-span");
+            let span_id = ui.scope_id().with("titledrag-span");
             let (gap_l, gap_r) = ui.ctx().data(|d| d.get_temp::<(f32, f32)>(span_id)).unwrap_or((full.right(), full.right()));
             let gap = egui::Rect::from_x_y_ranges(gap_l.max(full.left())..=gap_r.min(full.right()).max(gap_l), full.y_range());
             ui.ctx().data_mut(|d| d.insert_temp(crate::titlebar::modal_drag_area_id(), gap));
-            let drag = ui.interact(gap, ui.id().with("titledrag"), Sense::click_and_drag());
+            let drag = ui.interact(gap, ui.scope_id().with("titledrag"), Sense::click_and_drag());
             if drag.drag_started_by(egui::PointerButton::Primary) {
                 crate::titlebar::start_os_move(ui.ctx());
             }
@@ -684,7 +781,7 @@ pub fn title_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                         0
                     };
                     let ws_width = (room - f32::from(icons_shown) * ICON_SLOT - 6.0).clamp(WORKSPACE_MIN, 130.0);
-                    if room >= WORKSPACE_MIN && widgets::dropdown(ui, "workspace", &mut ws, &opts, ws_width) {
+                    if room >= WORKSPACE_MIN && widgets::dropdown(ui, "workspace", tl!("Workspace"), &mut ws, &opts, ws_width) {
                         app.ui.workspace = ws;
                         crate::menus::apply_workspace(app);
                     }
@@ -938,7 +1035,7 @@ fn reveal_focused_control(ui: &egui::Ui) {
         return;
     }
     let focused = ui.memory(|memory| memory.focused());
-    let key = ui.id().with("scroll-focused-control");
+    let key = ui.scope_id().with("scroll-focused-control");
     let changed = ui.data_mut(|data| {
         let previous = data.get_temp::<Option<egui::Id>>(key).flatten();
         data.insert_temp(key, focused);
@@ -1025,12 +1122,23 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                             crate::brush_picker::settings_toggle(app, ui);
                             widgets::vline(ui, 22.0);
                         }
-                        if tool == Tool::CloneStamp {
+                        if matches!(tool, Tool::CloneStamp | Tool::PatternStamp | Tool::HistoryBrush | Tool::Healing) {
                             let before = app.session.tools.brush.clone();
                             let mut brush = before.clone();
-                            let width = if t.pro { 62.0 } else { 66.0 };
-                            percent_field(ui, tl!("Opacity"), &mut brush.opacity, 1.0..=100.0, width);
-                            percent_field(ui, tl!("Flow"), &mut brush.flow, 1.0..=100.0, width);
+                            // Mode is the tool's own brush's, kept per tool like its size.
+                            if let Some(modes) = crate::blend_keys::tool_modes(tool) {
+                                opt_label(ui, tl!("Mode"));
+                                if let Some(Some(m)) =
+                                    tool_mode_dropdown(ui, "retouch-mode", &modes, Some(crate::blend_keys::brush_tool_mode(tool, brush.mode)))
+                                {
+                                    brush.mode = m;
+                                }
+                            }
+                            if tool == Tool::CloneStamp {
+                                let width = if t.pro { 62.0 } else { 66.0 };
+                                percent_field(ui, tl!("Opacity"), &mut brush.opacity, 1.0..=100.0, width);
+                                percent_field(ui, tl!("Flow"), &mut brush.flow, 1.0..=100.0, width);
+                            }
                             crate::brush_panel::commit_gesture(app, ui.ctx(), &before, &brush);
                             widgets::vline(ui, 22.0);
                         }
@@ -1195,7 +1303,10 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                                     ("fixedRatio".to_string(), tl!("Fixed Ratio")),
                                     ("fixedSize".to_string(), tl!("Fixed Size")),
                                 ];
-                                if ui.add_enabled_ui(sized, |ui| widgets::dropdown(ui, "marquee-style", &mut o.marquee_style, &styles, 96.0)).inner {
+                                if ui
+                                    .add_enabled_ui(sized, |ui| widgets::dropdown(ui, "marquee-style", tl!("Style"), &mut o.marquee_style, &styles, 96.0))
+                                    .inner
+                                {
                                     (o.marquee_width, o.marquee_height) = if o.marquee_style == "fixedSize" { (64.0, 64.0) } else { (1.0, 1.0) };
                                 }
                                 let fixed = sized && o.marquee_style != "normal";
@@ -1289,9 +1400,20 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                             Tool::PaintBucket => {
                                 opt_label(ui, tl!("Fill"));
                                 let mut src = u8::from(app.ui.tool_options.bucket_fill_pattern);
-                                if widgets::dropdown(ui, "bucket-src", &mut src, &[(0u8, tl!("Foreground")), (1, tl!("Pattern"))], 100.0) {
+                                if widgets::dropdown(ui, "bucket-src", tl!("Source"), &mut src, &[(0u8, tl!("Foreground")), (1, tl!("Pattern"))], 100.0) {
                                     app.ui.tool_options.bucket_fill_pattern = src == 1;
                                 }
+                                opt_label(ui, tl!("Mode"));
+                                if let Some(modes) = crate::blend_keys::tool_modes(tool) {
+                                    let o = &mut app.ui.tool_options;
+                                    let current = if o.bucket_clear { None } else { Some(o.bucket_blend_mode) };
+                                    if let Some(m) = tool_mode_dropdown(ui, "bucket-mode", &modes, current) {
+                                        o.bucket_clear = m.is_none();
+                                        if let Some(m) = m {
+                                            o.bucket_blend_mode = m;
+                                        }
+                                    }
+                                }
                                 opt_label(ui, tl!("Opacity"));
                                 widgets::value_field(ui, &mut app.ui.tool_options.fill_opacity, 1.0..=100.0, "%", 62.0);
                                 opt_label(ui, tl!("Tolerance"));
@@ -1303,7 +1425,8 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                             Tool::Gradient => {
                                 // Live "Gradient" (a Gradient Fill layer) or "Classic gradient" (pixels).
                                 let mut classic = app.ui.tool_options.gradient_classic;
-                                if widgets::dropdown(ui, "gradient-mode", &mut classic, &[(false, "Gradient"), (true, "Classic gradient")], 118.0) {
+                                if widgets::dropdown(ui, "gradient-mode", tl!("Mode"), &mut classic, &[(false, "Gradient"), (true, "Classic gradient")], 118.0)
+                                {
                                     app.ui.tool_options.gradient_classic = classic;
                                 }
                                 // Live "Gradient" (a Gradient Fill layer) or "Classic gradient" (pixels):
@@ -1331,7 +1454,14 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                                 opt_label(ui, tl!("Mode"));
                                 let opts: Vec<(BlendMode, &str)> = BlendMode::LAYER_MODES.iter().map(|m| (*m, m.label())).collect();
                                 // The wheel over it steps the mode, as over the Layers panel's (#2061).
-                                widgets::dropdown_wheel_hovered(ui, "gradient-blend-mode", &mut app.ui.tool_options.gradient_blend_mode, &opts, 96.0);
+                                widgets::dropdown_wheel_hovered(
+                                    ui,
+                                    "gradient-blend-mode",
+                                    tl!("Blend Mode"),
+                                    &mut app.ui.tool_options.gradient_blend_mode,
+                                    &opts,
+                                    96.0,
+                                );
                                 opt_label(ui, tl!("Opacity"));
                                 let r = widgets::value_field(ui, &mut app.ui.tool_options.fill_opacity, 1.0..=100.0, "%", 62.0);
                                 // Live while scrubbed, one undo step per scrub (#5012).
@@ -1376,7 +1506,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                                     }
                                     // Every ratio typed or scrubbed in one edit fits from the frame the edit
                                     // started with: 1:3 on the way to 16:3 mustn't shrink it first (#7752).
-                                    let base_id = egui::Id::new("crop-ratio-edit-base");
+                                    let base_id = egui::Id::unique("crop-ratio-edit-base");
                                     if cw || ch {
                                         ratio_base = ui.data(|d| d.get_temp::<[f64; 4]>(base_id)).or(app.ui.crop_rect);
                                     }
@@ -1388,11 +1518,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                                 }
                                 widgets::vline(ui, 22.0);
                                 if widgets::secondary_button(ui, tl!("Clear"), 0.0).clicked() {
-                                    if o.crop_ratio == crate::crop_size::WHR {
-                                        crate::crop_size::clear(o);
-                                    } else {
-                                        o.crop_ratio.clear();
-                                    }
+                                    crate::crop_size::clear_ratio(o);
                                 }
                                 crate::crop_straighten::options_button(&mut app.crop.straighten, ui);
                                 crate::crop_overlay::options_button(o, ui);
@@ -1404,6 +1530,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                                 widgets::dropdown(
                                     ui,
                                     "crop-fill",
+                                    tl!("Fill:"),
                                     &mut o.crop_content_aware,
                                     &[(false, tl!("Background (Default)")), (true, tl!("Content-Aware Fill"))],
                                     150.0,
@@ -1442,6 +1569,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                                 widgets::dropdown(
                                     ui,
                                     "move-target",
+                                    tl!("Auto-Select:"),
                                     &mut o.move_target,
                                     &[("layer".to_string(), tl!("Layer")), ("group".to_string(), tl!("Group"))],
                                     76.0,
@@ -1646,7 +1774,7 @@ fn fixed_size_field(ui: &mut egui::Ui, px: &mut f32, units: widgets::FieldUnits,
 fn percent_field(ui: &mut egui::Ui, label: &str, value: &mut f32, range: std::ops::RangeInclusive<f32>, width: f32) {
     opt_label(ui, label);
     let mut percent = *value * 100.0;
-    if widgets::value_field(ui, &mut percent, range, "%", width).changed() {
+    if widgets::value_field_named(ui, label, &mut percent, range, "%", width).changed() {
         *value = percent / 100.0;
     }
 }
@@ -1688,6 +1816,7 @@ pub fn status_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                         (st.doc.size.width, st.doc.size.height, crate::canvas::mode_label(&st.doc), st.doc.depth.bits(), st.doc.layer_count());
                     let mut pct = app.ui.views[i].zoom * 100.0;
                     if widgets::compact_wrapping_value_field(ui, &mut pct, crate::zoom_levels::percent_range(&app.ui.views[i]), "%", vec2(78.0, control_h))
+                        .accessible_name(tl!("Zoom"))
                         .changed()
                     {
                         app.ui.views[i].zoom = crate::zoom_levels::clamp(pct / 100.0, app.ui.views[i].doc_size);
@@ -1730,54 +1859,65 @@ pub fn status_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
 
 // ----------------------------------------------------------------------------- dock
 
-pub fn right_dock(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
-    // Even legacy destinations must discard gestures captured by an earlier workspace.
-    let customized = crate::panel_docking::show(app, ui);
+/// The panels and the canvas in the space left by the menus, bars and toolbar: craft-ui's
+/// docking layout, with the icon rail at the window's end edge in the Studio themes.
+pub fn dock_area(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
-    let p = app.ui.panels.clone();
-    if t.pro && !customized {
-        dock_panels(app, ui, &p, &t);
+    if app.ui.panels.rail && !t.pro {
+        rail(app, ui, &t);
     }
-    // Narrow icon rail, unless an embedding app hides it: shows, expands or collapses panel groups.
-    if p.rail {
-        let (rw, rb) = if t.pro { (36.0, 28.0) } else { (44.0, 32.0) };
-        crate::direction::end_panel("rail")
-            .resizable(false)
-            .exact_size(rw)
-            .frame(egui::Frame::NONE.fill(t.chrome).inner_margin(egui::Margin::symmetric(4, 8)))
-            .show(ui, |ui| {
-                // The separator is on the canvas side.
-                let r = ui.max_rect();
-                let x = if crate::direction::is_rtl() { r.right() + 6.0 } else { r.left() - 6.0 };
-                ui.painter().line_segment([pos2(x, r.top() - 8.0), pos2(x, r.bottom() + 8.0)], Stroke::new(1.0, t.separator));
-                ui.spacing_mut().item_spacing.y = 4.0;
-                use crate::dock::Group;
-                let entries: [(&str, &str, Group); 6] = [
-                    ("sliders-horizontal", tl!("Properties"), Group::Properties),
-                    ("navigation", tl!("Navigator"), Group::Navigator),
-                    ("palette", tl!("Color & Swatches"), Group::Color),
-                    ("layers", tl!("Layers"), Group::Layers),
-                    ("clock", tl!("History"), Group::History),
-                    ("brush", tl!("Brushes"), Group::Brushes),
-                ];
-                for (icon, name, g) in entries {
-                    // Studio floats Properties outside the dock.
-                    let docked = t.pro || g != Group::Properties;
-                    let on = if customized { crate::panel_docking::rail_on(app, g) } else { g.shown(&p) && !(docked && app.ui.dock.is_collapsed(g)) };
-                    if icons::rail_button(ui, icon, rb, on, name).clicked() {
-                        if customized {
-                            crate::panel_docking::rail_click(app, g);
-                        } else {
-                            crate::dock::rail_click(app, g, docked);
-                        }
+    egui::CentralPanel::default().frame(egui::Frame::NONE).show(ui, |ui| crate::panel_docking::show(app, ui));
+    crate::dock::persist(app, ui.ctx());
+}
+
+/// The docking layout's protected canvas panel: the document area, with the icon rail on its end
+/// side, beside the dock, in the Pro themes.
+pub(crate) fn canvas_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
+    let t = Tokens::get(ui.ctx());
+    let backdrop = if app.ui.view.hides_chrome() { egui::Color32::BLACK } else { crate::prefs_ui::pasteboard_color(app).unwrap_or(t.canvas) };
+    if app.ui.panels.rail && t.pro {
+        rail(app, ui, &t);
+    }
+    egui::CentralPanel::default().frame(egui::Frame::NONE.fill(backdrop)).show(ui, |ui| crate::canvas::document_area(app, ui));
+}
+
+/// Narrow icon rail, unless an embedding app hides it: shows, expands or collapses panel groups.
+fn rail(app: &mut PhotocraftApp, ui: &mut egui::Ui, t: &Tokens) {
+    let customized = app.ui.docking.is_some();
+    let p = app.ui.panels.clone();
+    let (rw, rb) = if t.pro { (36.0, 28.0) } else { (44.0, 32.0) };
+    crate::direction::end_panel("rail")
+        .resizable(false)
+        .exact_size(rw)
+        .frame(egui::Frame::NONE.fill(t.chrome).inner_margin(egui::Margin::symmetric(4, 8)))
+        .show(ui, |ui| {
+            // The separator is on the canvas side.
+            let r = ui.max_rect();
+            let x = if crate::direction::is_rtl() { r.right() + 6.0 } else { r.left() - 6.0 };
+            ui.painter().line_segment([pos2(x, r.top() - 8.0), pos2(x, r.bottom() + 8.0)], Stroke::new(1.0, t.separator));
+            ui.spacing_mut().item_spacing.y = 4.0;
+            use crate::dock::Group;
+            let entries: [(&str, &str, Group); 6] = [
+                ("sliders-horizontal", tl!("Properties"), Group::Properties),
+                ("navigation", tl!("Navigator"), Group::Navigator),
+                ("palette", tl!("Color & Swatches"), Group::Color),
+                ("layers", tl!("Layers"), Group::Layers),
+                ("clock", tl!("History"), Group::History),
+                ("brush", tl!("Brushes"), Group::Brushes),
+            ];
+            for (icon, name, g) in entries {
+                // Studio floats Properties outside the dock.
+                let docked = t.pro || g != Group::Properties;
+                let on = if customized { crate::panel_docking::rail_on(app, g) } else { g.shown(&p) && !(docked && app.ui.dock.is_collapsed(g)) };
+                if icons::rail_button(ui, icon, rb, on, name).clicked() {
+                    if customized {
+                        crate::panel_docking::rail_click(app, g);
+                    } else {
+                        crate::dock::rail_click(app, g, docked);
                     }
                 }
-            });
-    }
-    if !t.pro && !customized {
-        dock_panels(app, ui, &p, &t);
-    }
-    crate::dock::persist(app, ui.ctx());
+            }
+        });
 }
 
 /// The dock's narrowest width (points). It is the right dock, on the left in a right-to-left UI.
@@ -1794,7 +1934,7 @@ pub(crate) fn dock_width_range(window_width: f32) -> std::ops::RangeInclusive<f3
 }
 
 pub(crate) fn dock_width_id() -> egui::Id {
-    egui::Id::new("dock-width-request")
+    egui::Id::unique("dock-width-request")
 }
 
 /// Set the right dock's width on the next frame (`ui.set {dockWidth}`); clamped to its range.
@@ -1804,39 +1944,7 @@ pub fn request_dock_width(ctx: &egui::Context, w: f32) {
     ctx.data_mut(|d| d.insert_temp(dock_width_id(), w));
 }
 
-fn dock_panels(app: &mut PhotocraftApp, ui: &mut egui::Ui, p: &crate::state::Panels, t: &Tokens) {
-    use crate::dock::Group;
-    // Floating in Studio, Properties docks only in Pro (Photoshop).
-    let shown: Vec<Group> = [
-        (Group::Color, p.color),
-        (Group::Properties, t.pro && p.properties),
-        (Group::Character, p.character),
-        (Group::Navigator, p.navigator),
-        (Group::History, p.history),
-        (Group::Layers, p.layers),
-        (Group::Brushes, p.brushes),
-    ]
-    .into_iter()
-    .filter_map(|(g, on)| on.then_some(g))
-    .collect();
-    if shown.is_empty() {
-        return;
-    }
-    let margin = if t.pro { 2 } else { 8 };
-    let mut panel = crate::direction::end_panel("dock")
-        .resizable(true)
-        .default_size(if t.pro { 290.0 } else { 300.0 })
-        .size_range(dock_width_range(ui.ctx().content_rect().width()));
-    if let Some(w) = ui.ctx().data_mut(|d| d.remove_temp::<f32>(dock_width_id())) {
-        panel = panel.exact_size(w);
-    }
-    panel.frame(egui::Frame::NONE.fill(t.dock).inner_margin(egui::Margin::same(margin))).show(ui, |ui| {
-        // Groups keep their heights whatever they show (#88): see `dock`.
-        crate::dock::show(app, ui, &shown, dock_body);
-    });
-}
-
-/// One dock group's tab content; `dock` bounds it and scrolls it when it's taller.
+/// One dock group's tab content; `panel_docking` bounds it and scrolls it when it's taller.
 pub(crate) fn dock_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, group: crate::dock::Group, tab: usize) {
     use crate::dock::Group;
     let pro = Tokens::get(ui.ctx()).pro;
@@ -1851,7 +1959,7 @@ pub(crate) fn dock_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, group: crate
         (Group::Properties, _) => adjustments_grid(app, ui),
         (Group::Character, tab) => crate::type_tool::character_panel(app, ui, tab == 1),
         (Group::Navigator, 0) => navigator(app, ui),
-        (Group::Navigator, 1) => crate::tone::histogram_panel(app, ui),
+        (Group::Navigator, 1) => crate::histogram_panel::show(app, ui),
         (Group::Navigator, _) => info_panel(app, ui),
         (Group::History, 0) => history(app, ui),
         (Group::History, 1) => crate::actions::panel(app, ui),
@@ -1863,6 +1971,29 @@ pub(crate) fn dock_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, group: crate
     }
 }
 
+/// The active document's pixel under the pointer, if the pointer is over the image.
+pub(crate) fn hover_pixel(app: &PhotocraftApp) -> Option<(i32, i32)> {
+    let size = app.session.active()?.doc.size;
+    app.hover_doc.map(|p| (p[0].floor() as i32, p[1].floor() as i32)).filter(|(x, y)| *x >= 0 && *y >= 0 && *x < size.width as i32 && *y < size.height as i32)
+}
+
+/// The colour the Info panel reads at document pixel `(x, y)`, straight RGBA 0..1: averaged over
+/// the Eyedropper's Sample Size, as in Photoshop (#1649), and cached per pixel and revision.
+pub(crate) fn pointer_sample(app: &mut PhotocraftApp, (x, y): (i32, i32)) -> Option<[f32; 4]> {
+    let rev = app.session.active()?.revision;
+    let sample_size = app.ui.tool_options.eyedropper_size;
+    if let Some(((cx, cy, cr, cs), v)) = app.info_sample
+        && (cx, cy, cr, cs) == (x, y, rev, sample_size)
+    {
+        return Some(v);
+    }
+    let params = json!({"x": f64::from(x) + 0.5, "y": f64::from(y) + 0.5, "size": sample_size});
+    let v: Vec<f32> = serde_json::from_value(app.session.execute("document.sampleColor", params).ok()?).ok()?;
+    let v = [*v.first()?, *v.get(1)?, *v.get(2)?, *v.get(3)?];
+    app.info_sample = Some(((x, y, rev, sample_size), v));
+    Some(v)
+}
+
 /// Photoshop's Info panel: colour under the pointer (RGB and CMYK), position, selection size.
 fn info_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
@@ -1870,7 +2001,7 @@ fn info_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         empty(ui, tl!("No document"));
         return;
     };
-    let (rev, size, origin) = (st.revision, st.doc.size, st.doc.ruler_origin);
+    let (size, origin) = (st.doc.size, st.doc.ruler_origin);
     let cmyk_space = photocraft_compose::cmyk_space(&st.doc);
     // Positions and sizes in the ruler unit (Preferences › Units & Rulers).
     let units = app.session.prefs().units_and_rulers.clone();
@@ -1879,10 +2010,7 @@ fn info_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let units_y = app.session.prefs().units_and_rulers.clone();
     let fy = move |px: f64| units_y.format(px, dpi, size.height as f64);
     let sel = st.doc.selection.as_ref().map(photocraft_compose::bounds::content_bounds);
-    let pos = app
-        .hover_doc
-        .map(|p| (p[0].floor() as i32, p[1].floor() as i32))
-        .filter(|(x, y)| *x >= 0 && *y >= 0 && *x < size.width as i32 && *y < size.height as i32);
+    let pos = hover_pixel(app);
     // While a guide is dragged (#5728), the Info panel shows its position in one axis only, even
     // when the pointer is outside the canvas (ruler drags do not update `hover_doc` there).
     let (guide_x, guide_y) = match app.guide_drag {
@@ -1890,20 +2018,7 @@ fn info_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         Some(d) => (None, Some(d.pos)),
         None => (None, None),
     };
-    // The readout averages the Eyedropper's Sample Size, as in Photoshop (#1649).
-    let sample_size = app.ui.tool_options.eyedropper_size;
-    let rgba = pos.and_then(|(x, y)| {
-        if let Some(((cx, cy, cr, cs), v)) = app.info_sample
-            && (cx, cy, cr, cs) == (x, y, rev, sample_size)
-        {
-            return Some(v);
-        }
-        let params = json!({"x": f64::from(x) + 0.5, "y": f64::from(y) + 0.5, "size": sample_size});
-        let v: Vec<f32> = serde_json::from_value(app.session.execute("document.sampleColor", params).ok()?).ok()?;
-        let v = [*v.first()?, *v.get(1)?, *v.get(2)?, *v.get(3)?];
-        app.info_sample = Some(((x, y, rev, sample_size), v));
-        Some(v)
-    });
+    let rgba = pos.and_then(|p| pointer_sample(app, p));
     let mono = theme::mono(11.5);
     let row = |ui: &mut egui::Ui, k: &str, v: String| {
         ui.horizontal(|ui| {
@@ -2059,16 +2174,21 @@ fn navigator(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     }
     // The Navigator has its own zoom target: an unmodified wheel over the preview
     // should zoom even when the document canvas is configured to scroll on wheel.
-    // Use the canvas wheel classifier to honour one ×1.1 step per notch without
-    // applying egui's smoothed wheel tail a second time.
+    // Use the canvas wheel classifier to honour one ×1.1 step per notch,
+    // eased over its frames or instant as General › Animated Zoom says.
     let pinch_zooms = app.session.prefs().enhanced_controls.zoom_with_trackpad_pinch;
+    let animated_zoom = app.session.prefs().general.animated_zoom;
     let touch_gestures = app.session.prefs().enhanced_controls.touch_gestures;
+    let navigator_wheel = egui::Id::unique("pc-navigator-wheel");
     if resp.hovered()
         && let Some(crate::wheel_nav::Wheel::Zoom(factor)) =
-            crate::wheel_nav::read_with(&ctx, true, pinch_zooms, egui::Id::new("pc-navigator-wheel"), true, true, touch_gestures)
+            crate::wheel_nav::read_with(&ctx, true, pinch_zooms, animated_zoom, navigator_wheel, true, true, touch_gestures)
     {
         let view = &mut app.ui.views[idx];
         let next = crate::zoom_levels::clamp(view.zoom * factor, view.doc_size);
+        if next != view.zoom * factor {
+            crate::wheel_nav::settle(&ctx, navigator_wheel);
+        }
         if next != view.zoom {
             view.zoom = next;
             view.zoom_animating = false;
@@ -2103,7 +2223,8 @@ fn navigator(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 app.ui.views[idx].fit_pending = false;
             };
             let mut pct = v.zoom * 100.0;
-            let field = widgets::compact_wrapping_value_field(ui, &mut pct, crate::zoom_levels::percent_range(&app.ui.views[idx]), "%", vec2(64.0, NAV_ROW_H));
+            let field = widgets::compact_wrapping_value_field(ui, &mut pct, crate::zoom_levels::percent_range(&app.ui.views[idx]), "%", vec2(64.0, NAV_ROW_H))
+                .accessible_name(tl!("Zoom"));
             if field.changed() {
                 set(app, pct / 100.0, false);
             }
@@ -2147,7 +2268,7 @@ fn navigator_fit(frame: Rect, w: u32, h: u32) -> Rect {
 
 /// Where a ⌘/Ctrl-drag over the Navigator's preview started, while it lasts.
 fn navigator_zoom_drag_id() -> egui::Id {
-    egui::Id::new("navigator-zoom-drag")
+    egui::Id::unique("navigator-zoom-drag")
 }
 
 /// Zoom `view` so the document rectangle `doc_rect` (pixels) fills a canvas of `canvas` points,
@@ -2183,15 +2304,15 @@ fn navigator_zoom_to(view: &mut crate::state::View, doc_rect: Rect, doc: [u32; 2
 }
 
 fn navigator_preview_id() -> egui::Id {
-    egui::Id::new("navigator-preview-rect")
+    egui::Id::unique("navigator-preview-rect")
 }
 
 fn navigator_controls_id() -> egui::Id {
-    egui::Id::new("navigator-controls-height")
+    egui::Id::unique("navigator-controls-height")
 }
 
 fn navigator_controls_rect_id() -> egui::Id {
-    egui::Id::new("navigator-controls-rect")
+    egui::Id::unique("navigator-controls-rect")
 }
 
 /// Where the Navigator drew its document preview last frame.
@@ -2261,7 +2382,13 @@ mod navigator_wheel_tests {
     fn frame(app: &mut PhotocraftApp, ctx: &egui::Context, pointer: Pos2, wheel: f32) {
         let mut events = vec![Event::PointerMoved(pointer)];
         if wheel != 0.0 {
-            events.push(Event::MouseWheel { unit: MouseWheelUnit::Line, delta: vec2(0.0, wheel), phase: TouchPhase::Move, modifiers: Modifiers::NONE });
+            events.push(Event::MouseWheel {
+                source: egui::MouseWheelSource::Unknown,
+                unit: MouseWheelUnit::Line,
+                delta: vec2(0.0, wheel),
+                phase: TouchPhase::Move,
+                modifiers: Modifiers::NONE,
+            });
         }
         let mut out = ctx
             .run_ui(RawInput { screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(430.0, 460.0))), events, ..Default::default() }, |ui| navigator(app, ui));
@@ -2275,6 +2402,8 @@ mod navigator_wheel_tests {
         app.sync_views();
         app.ui.views[0].zoom = 1.0;
         app.ui.views[0].fit_pending = false;
+        // Animated Zoom off: a notch is one instant step, so one frame shows the whole ×1.1.
+        app.session.edit_prefs(|p| p.general.animated_zoom = false);
         let ctx = egui::Context::default();
         PhotocraftApp::setup_context(&ctx, crate::theme::ThemeKind::ALL[0]);
         crate::wheel_nav::configure(&ctx);
@@ -2503,7 +2632,7 @@ fn inactive_blend_rows(ui: &mut egui::Ui, pro: bool) {
             let (blend_width, show_opacity_label) = opacity_row_layout(ui.available_width(), body_text_width(ui, opacity_label), ui.spacing().item_spacing.x);
             let mut m = BlendMode::Normal;
             let options = blend_options(false, m);
-            widgets::dropdown_wheel_hovered(ui, "blend", &mut m, &options, blend_width);
+            widgets::dropdown_wheel_hovered(ui, "blend", tl!("Blend Mode"), &mut m, &options, blend_width);
             ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                 let mut o = 100.0;
                 widgets::popup_value_field(ui, opacity_label, &mut o, 0.0..=100.0, "%", LAYER_PCT_W);
@@ -2597,7 +2726,8 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 let opacity_label = if t.pro { tl!("Opacity:") } else { tl!("Opacity") };
                 let (blend_width, show_opacity_label) =
                     opacity_row_layout(ui.available_width(), body_text_width(ui, opacity_label), ui.spacing().item_spacing.x);
-                let (chosen, hovered) = widgets::dropdown_wheel_hovered(ui, "blend", &mut m, &blend_options(all_groups, l.blend), blend_width);
+                let (chosen, hovered) =
+                    widgets::dropdown_wheel_hovered(ui, "blend", tl!("Blend Mode"), &mut m, &blend_options(all_groups, l.blend), blend_width);
                 // One step per choice: a click, an arrow key or each wheel notch (#1747).
                 for m in &chosen {
                     let mut p = targets.clone();
@@ -2703,7 +2833,7 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 ctx.data_mut(|d| d.remove::<crate::smart_ui::FilterDrag>(crate::smart_ui::drag_key()));
             }
             let held = ctx.data(|d| {
-                d.get_temp::<u64>(egui::Id::new("layer-drag")).is_some()
+                d.get_temp::<u64>(egui::Id::unique("layer-drag")).is_some()
                     || d.get_temp::<FxDrag>(fx_drag_key()).is_some()
                     || d.get_temp::<crate::smart_ui::FilterDrag>(crate::smart_ui::drag_key()).is_some()
             });
@@ -2757,7 +2887,7 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 // A click on that empty space deselects every layer, as in Photoshop (#8100). It
                 // starts under the last layer's sub-rows, which take their own clicks.
                 let empty = Rect::from_min_max(pos2(below.left(), rows_bottom), below.max);
-                if empty.height() > 0.0 && ui.interact(empty, ui.id().with("layers-empty-space"), Sense::click()).clicked() && !selection.is_empty() {
+                if empty.height() > 0.0 && ui.interact(empty, ui.scope_id().with("layers-empty-space"), Sense::click()).clicked() && !selection.is_empty() {
                     actions.push(("select.deselectLayers".into(), json!({})));
                 }
             }
@@ -2791,7 +2921,7 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     }
     // A layer being dragged can also be dropped on the footer's Delete, New Layer and Group
     // buttons (#736); read the drag before it ends.
-    let footer_drag = ctx.data(|d| d.get_temp::<u64>(egui::Id::new("layer-drag"))).map(|id| {
+    let footer_drag = ctx.data(|d| d.get_temp::<u64>(egui::Id::unique("layer-drag"))).map(|id| {
         let in_selection = selection.iter().any(|s| s.0 == id);
         (id, in_selection)
     });
@@ -2810,7 +2940,7 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     }
     // End any layer drag after every row has had a chance to accept the drop.
     if ctx.input(|i| i.pointer.any_released()) {
-        ctx.data_mut(|d| d.remove::<u64>(egui::Id::new("layer-drag")));
+        ctx.data_mut(|d| d.remove::<u64>(egui::Id::unique("layer-drag")));
         ctx.data_mut(|d| d.remove::<FxDrag>(fx_drag_key()));
         ctx.data_mut(|d| d.remove::<MaskDrag>(mask_drag_key()));
         ctx.data_mut(|d| d.remove::<crate::smart_ui::FilterDrag>(crate::smart_ui::drag_key()));
@@ -2854,7 +2984,7 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         }
         // A click follows the selected thumbnail; name that action for screen readers even
         // though dropping a whole layer row onto the same button always deletes the layer.
-        trash.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!(label)));
+        trash.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(label)));
         let new_layer = icons::button(ui, "square-plus", 26.0, false, &crate::shortcuts::tip_label(app, "Create a new layer", "layer.new.layer"));
         if new_layer.clicked() {
             // A click makes the layer above the selection; ⌥-click asks first (the New Layer
@@ -2905,7 +3035,7 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             crate::i18n::fmt(tl!("Add a mask  (from the selection; {key} inverts)"), &[("key", &crate::shortcuts::pretty("Alt"))])
         };
         let mask_btn = ui.add_enabled_ui(mask_cmd.is_some(), |ui| icons::button(ui, "layer-mask", 26.0, false, &mask_tip)).inner;
-        mask_btn.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &mask_tip));
+        mask_btn.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &mask_tip));
         if mask_btn.clicked()
             && let Some(cmd) = mask_cmd
         {
@@ -2942,17 +3072,25 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             crate::type_tool::commit(app);
         }
         if id == "ui.maskTarget" {
+            app.end_filter_mask_view();
             app.ui.mask_target = p.as_bool().unwrap_or(false);
             app.ui.vector_mask_target = false;
+            app.ui.filter_mask_target = None;
             app.sync_mask_targets();
             continue;
         }
         if id == "ui.vectorMaskTarget" {
+            app.end_filter_mask_view();
             app.ui.vector_mask_target = p.as_bool().unwrap_or(false);
             app.ui.mask_target = false;
+            app.ui.filter_mask_target = None;
             app.sync_mask_targets();
             continue;
         }
+        if id == "ui.filterMaskTarget" {
+            app.select_filter_mask_target(p.as_u64());
+            continue;
+        }
         // Double-clicking a mask thumbnail opens its settings: show Properties.
         if id == "ui.properties" {
             app.ui.panels.properties = true;
@@ -2981,7 +3119,7 @@ fn layers(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
 /// returns the command on release.
 fn footer_drop(ui: &egui::Ui, button: &egui::Response, drag: Option<(u64, bool)>, command: &str) -> Option<(String, Value)> {
     // Named for screen readers (and tests) after the command a drop runs.
-    button.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, footer_label(command)));
+    button.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, footer_label(command)));
     let (layer, in_selection) = drag?;
     dropped_on(ui, button).then(|| (command.into(), if in_selection { json!({}) } else { json!({"layer": layer}) }))
 }
@@ -3029,7 +3167,7 @@ fn footer_menu_arrow(ui: &egui::Ui, rect: Rect) {
 fn footer_menu_button(ui: &mut egui::Ui, icon: &str, size: f32, tip: &str) -> egui::Response {
     let response = icons::button(ui, icon, size, false, tip);
     // Named for screen readers (and tests) after its tooltip.
-    response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tip));
+    response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tip));
     footer_menu_arrow(ui, response.rect);
     response
 }
@@ -3046,7 +3184,7 @@ fn fx_button(ui: &mut egui::Ui, size: f32, tip: &str) -> egui::Response {
     let g = ui.painter().layout_job(job);
     ui.painter().galley(r.center() - g.size() / 2.0, g, t.icon);
     footer_menu_arrow(ui, r);
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tip));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tip));
     resp.on_hover_text(tip)
 }
 
@@ -3070,7 +3208,7 @@ pub(crate) fn thumb_load_badge(m: egui::Modifiers) -> Option<crate::tool_feedbac
 fn thumb_load_cursor(ctx: &egui::Context, p: Pos2, m: egui::Modifiers) {
     ctx.set_cursor_icon(egui::CursorIcon::PointingHand);
     if let Some(badge) = thumb_load_badge(m) {
-        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("thumb-load-badge")));
+        let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("thumb-load-badge")));
         crate::tool_feedback::draw_badge(&painter, p, badge, false);
     }
 }
@@ -3099,7 +3237,7 @@ struct EyeSweep {
 
 /// Starts an eye-column sweep from `eye`, or applies a running one to the row `row` of `l`.
 fn eye_sweep(ctx: &egui::Context, l: &Layer, row: Rect, eye: &egui::Response, actions: &mut Vec<(String, Value)>) {
-    let id = egui::Id::new("layer-eye-sweep");
+    let id = egui::Id::unique("layer-eye-sweep");
     let set =
         |visible: bool, key: u64| ("layer.setProps".to_string(), json!({"layer": l.id.0, "visible": visible, "coalesce": format!("layer-eye-sweep:{key}")}));
     if eye.drag_started() {
@@ -3170,7 +3308,7 @@ fn layer_row(
         crate::layer_transfer::begin_from_panel(app, ctx, l.id);
     }
     // Rows are painted: name them for screen readers and UI tests.
-    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, selected, &l.name));
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected, &l.name));
     // A row scrolled out of view only keeps its place (#125): a layout's hundreds of rows would
     // otherwise lay out names, icons and thumbnails every frame. Group rows stay whole: their
     // disclosure triangle is a widget (accessibility, scroll-to).
@@ -3208,7 +3346,7 @@ fn layer_row(
     let mut x = rect.left() + 6.0;
     // The whole eye column takes drags too (so a drag starting on it never reorders the row): dragging down
     // the eyes gives every row swept over the visibility the first eye toggled to (#8467).
-    let eye_resp = ui.interact(eye_cell, ui.id().with(("eye", l.id.0)), Sense::click_and_drag());
+    let eye_resp = ui.interact(eye_cell, ui.scope_id().with(("eye", l.id.0)), Sense::click_and_drag());
     // A hidden layer's eye box is left empty (still clickable; the whole column takes the click, #8467).
     if l.visible {
         // Centre the drawing in the column while preserving the visibility hit area.
@@ -3258,7 +3396,10 @@ fn layer_row(
     // Photoshop frames the targeted thumbnail (pixels, mask or vector mask) of the active layer
     // with corner brackets.
     if row.primary && ts > 0.0 {
-        let target = if app.ui.vector_mask_target && vector_rect.is_some() {
+        let target = if app.ui.filter_mask_target == Some(l.id.0) && app.filter_mask_targeted() {
+            // The Smart Filters row's filter mask thumbnail carries the brackets.
+            None
+        } else if app.ui.vector_mask_target && vector_rect.is_some() {
             vector_rect
         } else if app.ui.mask_target {
             mask_rect.or(Some(thumb))
@@ -3275,14 +3416,14 @@ fn layer_row(
     // Dragging the fx badge drags all the layer's effects, not the layer (Photoshop). Like the eye,
     // it takes the drag from the row; clicks still reach the row.
     if let Some(&(_, badge)) = indicators.iter().find(|(k, _)| *k == crate::layer_row_ui::Indicator::Fx)
-        && ui.interact(badge, ui.id().with(("fx-badge", l.id.0)), Sense::drag()).drag_started()
+        && ui.interact(badge, ui.scope_id().with(("fx-badge", l.id.0)), Sense::drag()).drag_started()
     {
         start_fx_drag(ctx, l.id, None);
     }
     // Clicking the lock icon unlocks the layer, and makes the Background a normal one (Photoshop,
     // #4723). It takes the click from the row, so the row isn't selected.
     if let Some(&(_, lock)) = indicators.iter().find(|(k, _)| *k == crate::layer_row_ui::Indicator::Lock)
-        && ui.interact(lock, ui.id().with(("row-lock", l.id.0)), Sense::click()).clicked()
+        && ui.interact(lock, ui.scope_id().with(("row-lock", l.id.0)), Sense::click()).clicked()
     {
         actions.push(simple_lock_toggle(doc.is_background(l.id), l, &json!({"layer": l.id.0})));
     }
@@ -3354,9 +3495,10 @@ fn layer_row(
         let on_mask = mask_rect.zip(pos).is_some_and(|(r, p)| r.expand(2.0).contains(p));
         let on_vector = pos.and_then(|p| masks.hit(p)) == Some(crate::mask_thumbs_ui::MaskKind::Vector);
         // Clicking the layer thumbnail leaves mask view (#196).
-        let viewing = app.session.active().and_then(photocraft_engine::mask_view_cmds::current).is_some_and(|v| v.layer == l.id);
-        if on_thumb && viewing {
-            actions.push((photocraft_engine::mask_view_cmds::ID.into(), json!({"layer": l.id.0, "mode": "off"})));
+        let viewing = app.session.active().and_then(photocraft_engine::mask_view_cmds::current).filter(|v| v.layer == l.id);
+        if let Some(v) = viewing.filter(|_| on_thumb) {
+            let mask = if v.filter { "filter" } else { "layer" };
+            actions.push((photocraft_engine::mask_view_cmds::ID.into(), json!({"layer": l.id.0, "mode": "off", "mask": mask})));
         }
         let content_less = matches!(l.content, LayerContent::Adjustment(_) | LayerContent::Fill(_));
         if on_vector {
@@ -3425,7 +3567,7 @@ fn layer_row(
     }
     // The visibility icon has its own color menu, and the layer-mask thumbnail its mask menu
     // (#4575); elsewhere use the full layer menu.
-    let on_mask_id = ui.id().with(("mask-menu", l.id.0));
+    let on_mask_id = ui.scope_id().with(("mask-menu", l.id.0));
     if resp.secondary_clicked() {
         let on_mask = resp.interact_pointer_pos().and_then(|p| masks.hit(p)) == Some(crate::mask_thumbs_ui::MaskKind::Pixel);
         ctx.data_mut(|d| d.insert_temp(on_mask_id, on_mask));
@@ -3511,33 +3653,19 @@ fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         empty(ui, tl!("No document"));
         return;
     };
-    let doc = st.doc.clone();
     let entries = st.history.entries();
     let current = entries.len() - 1;
     let redo: Vec<String> = st.history.redo_labels().map(str::to_string).collect();
+    let doc_id = st.doc.id;
     let source = photocraft_engine::history_source_cmds::source(st);
     let selected_snap = selected_snapshot(ui.ctx(), st);
-    let spot = (doc.id, history_spot(st));
+    let spot = (doc_id, history_spot(st));
     let ctx = ui.ctx().clone();
     // A row dragged onto the trash (#5324); a drag that never saw its release must not outlive it.
     if !ctx.input(|i| i.pointer.primary_down() || i.pointer.any_released()) {
         ctx.data_mut(|d| d.remove::<HistoryDrag>(history_drag_key()));
     }
     let drag = ctx.data(|d| d.get_temp::<HistoryDrag>(history_drag_key()));
-    // Snapshot row (Photoshop shows the document's opening state with a thumbnail).
-    {
-        let (rect, _) = ui.allocate_exact_size(vec2(ui.available_width(), 38.0), Sense::hover());
-        let thumb = Rect::from_min_size(pos2(rect.left() + 28.0, rect.center().y - 14.0), vec2(28.0, 28.0));
-        let ctx = ui.ctx().clone();
-        if let Some(layer) = doc.layers.first() {
-            widgets::checker(ui.painter(), thumb, 4.0);
-            let (tex, _) = app.layer_thumb(&ctx, &doc, layer);
-            ui.painter().image(tex, thumb, Rect::from_min_max(egui::Pos2::ZERO, pos2(1.0, 1.0)), Color32::WHITE);
-        }
-        ui.painter().rect_stroke(thumb, 0.0, Stroke::new(1.0, t.separator), StrokeKind::Outside);
-        ui.painter().text(pos2(thumb.right() + 8.0, rect.center().y), Align2::LEFT_CENTER, &doc.name, egui::FontId::proportional(12.0), t.text);
-        ui.painter().line_segment([rect.left_bottom(), rect.right_bottom()], Stroke::new(1.0, t.separator));
-    }
     let mut snap_cmd = None;
     let mut target: Option<usize> = None;
     let mut set_source: Option<usize> = None;
@@ -3548,7 +3676,7 @@ fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     // Follow the current state when the history moves (a new step, Undo, a state row) or another
     // document comes up (`spot`), scrolling only if its row is hidden (#5909). Other changes (a
     // layer click, a channel eye) and a selected snapshot leave the list where the user put it.
-    let follow_id = egui::Id::new("history-follow");
+    let follow_id = egui::Id::unique("history-follow");
     let moved = ui.ctx().data_mut(|d| {
         let moved = d.get_temp::<(photocraft_doc::DocId, HistorySpot)>(follow_id).as_ref() != Some(&spot);
         d.insert_temp(follow_id, spot);
@@ -3566,7 +3694,7 @@ fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             // Past states can be dragged onto the trash; the oldest one can't be deleted.
             let sense = if is_redo || i == 0 { Sense::click() } else { Sense::click_and_drag() };
             let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 24.0), sense);
-            resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, selected, &e));
+            resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected, &e));
             if resp.drag_started() {
                 ui.ctx().data_mut(|d| d.insert_temp(history_drag_key(), HistoryDrag::State(i)));
             }
@@ -3597,14 +3725,14 @@ fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 if is_redo { t.text_faint } else { t.icon },
             );
             ui.painter().text(pos2(rect.left() + 58.0, rect.center().y), Align2::LEFT_CENTER, &e, egui::FontId::proportional(12.0), color);
-            if history_source_column(ui, rect, egui::Id::new(("history-source", i)), source == Some(HistorySource::State(i))) {
+            if history_source_column(ui, rect, egui::Id::unique(("history-source", i)), source == Some(HistorySource::State(i))) {
                 set_source = Some(i);
             }
             if resp.clicked() && i != current {
                 target = Some(i);
             } else if resp.clicked() && selected_snap.is_some() {
                 // The current state is already the document: clicking it only selects it.
-                ctx.data_mut(|d| d.remove::<SelectedSnapshot>(selected_snapshot_key(doc.id)));
+                ctx.data_mut(|d| d.remove::<SelectedSnapshot>(selected_snapshot_key(doc_id)));
             }
         }
         if follow && let Some(rect) = current_rect {
@@ -3628,6 +3756,7 @@ fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         crate::layer_transfer::ghost(&ctx, p, &label.unwrap_or_default());
     }
     let mut footer_cmd: Option<(&str, Value)> = None;
+    let mut snapshot_dialog = false;
     if t.pro {
         // With a snapshot selected the trash deletes it, as in Photoshop (#5324).
         let can_delete = selected_snap.is_some() || app.session.is_enabled("history.deleteState");
@@ -3650,8 +3779,13 @@ fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 });
             }
             let can_snap = app.session.is_enabled("history.newSnapshot");
+            // ⌥-click opens New Snapshot (name, From) instead, as in Photoshop.
             if ui.add_enabled_ui(can_snap, |ui| icons::button(ui, "scan", 26.0, false, tl!("Create new snapshot"))).inner.clicked() {
-                footer_cmd = Some(("history.newSnapshot", json!({})));
+                if ui.input(|i| i.modifiers.alt) {
+                    snapshot_dialog = true;
+                } else {
+                    footer_cmd = Some(("history.newSnapshot", json!({})));
+                }
             }
             if ui.add_enabled_ui(can_new, |ui| icons::button(ui, "file-plus", 26.0, false, tl!("Create new document from current state"))).inner.clicked() {
                 footer_cmd = Some(("history.newDocument", json!({})));
@@ -3663,6 +3797,9 @@ fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     }
     // An open Free Transform owns Undo (transform_tool::intercept): stepping the document's history under
     // its box would leave it transforming pixels that changed.
+    if snapshot_dialog {
+        crate::snapshot_dialog::open(app);
+    }
     // Selecting a snapshot changes the document, so it waits for an open transform like the rows.
     let snap_cmd = snap_cmd.filter(|(cmd, _)| *cmd != "history.selectSnapshot" || app.ui.transform.is_none());
     if let Some((cmd, p)) = footer_cmd.filter(|_| app.ui.transform.is_none()).or(snap_cmd) {
@@ -3696,7 +3833,7 @@ fn history(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
 fn history_source_column(ui: &mut egui::Ui, row: Rect, salt: egui::Id, is_source: bool) -> bool {
     let t = Tokens::get(ui.ctx());
     let cell = Rect::from_min_size(row.min, vec2(24.0, row.height()));
-    let resp = ui.interact(cell, ui.id().with(salt), Sense::click()).on_hover_text(tl!("Sets the source for the history brush"));
+    let resp = ui.interact(cell, ui.scope_id().with(salt), Sense::click()).on_hover_text(tl!("Sets the source for the history brush"));
     if is_source {
         icons::paint(ui, cell.shrink(4.0), icons::tool_icon(Tool::HistoryBrush), 12.0, t.icon);
     } else if resp.hovered() {
@@ -3713,7 +3850,7 @@ enum HistoryDrag {
 }
 
 fn history_drag_key() -> egui::Id {
-    egui::Id::new("history-drag")
+    egui::Id::unique("history-drag")
 }
 
 /// The snapshot the History panel shows selected (#5324), and where the history stood after its
@@ -3729,7 +3866,7 @@ fn history_spot(st: &photocraft_engine::DocState) -> HistorySpot {
 }
 
 fn selected_snapshot_key(doc: photocraft_doc::DocId) -> egui::Id {
-    egui::Id::new(("history-snapshot-selected", doc))
+    egui::Id::unique(("history-snapshot-selected", doc))
 }
 
 /// Select snapshot `id` at the history's current state, as a click on its row does.
@@ -3762,14 +3899,14 @@ fn snapshot_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, selected: Option<u6
     let source = photocraft_engine::history_source_cmds::source(st);
     let live: Vec<u64> = snaps.iter().map(|s| s.id).collect();
     // Per document: snapshot ids restart in each, and a tab switch must not carry the edit over.
-    let rename_id = egui::Id::new(("history-snapshot-rename", doc_id));
+    let rename_id = egui::Id::unique(("history-snapshot-rename", doc_id));
     let mut renaming: Option<(u64, String)> = ui.data(|d| d.get_temp(rename_id)).flatten();
     let mut cmd = None;
     let ctx = ui.ctx().clone();
     for snap in &snaps {
         let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 38.0), Sense::click_and_drag());
         let is_selected = selected == Some(snap.id);
-        resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, is_selected, &snap.name));
+        resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, is_selected, &snap.name));
         if resp.drag_started() {
             ctx.data_mut(|d| d.insert_temp(history_drag_key(), HistoryDrag::Snapshot(snap.id)));
         }
@@ -3786,7 +3923,7 @@ fn snapshot_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, selected: Option<u6
         match renaming.as_mut().filter(|(id, _)| *id == snap.id) {
             Some((_, text)) => {
                 let field = Rect::from_min_max(pos2(thumb.right() + 6.0, rect.center().y - 10.0), pos2(rect.right() - 6.0, rect.center().y + 10.0));
-                let r = ui.put(field, egui::TextEdit::singleline(text));
+                let r = ui.put(field, egui::TextEdit::singleline(text)).accessible_name(tl!("Name"));
                 if r.lost_focus() {
                     if !ui.input(|i| i.key_pressed(egui::Key::Escape)) {
                         cmd = Some(("history.renameSnapshot", json!({"snapshot": snap.id, "name": text.clone()})));
@@ -3807,7 +3944,7 @@ fn snapshot_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, selected: Option<u6
                 ui.painter().text(pos2(thumb.right() + 8.0, rect.center().y), Align2::LEFT_CENTER, &snap.name, egui::FontId::proportional(12.0), t.text);
             }
         }
-        if history_source_column(ui, rect, egui::Id::new(("history-snapshot-source", snap.id)), source == Some(HistorySource::Snapshot(snap.id))) {
+        if history_source_column(ui, rect, egui::Id::unique(("history-snapshot-source", snap.id)), source == Some(HistorySource::Snapshot(snap.id))) {
             cmd = Some(("history.setSource", json!({"snapshot": snap.id})));
         } else if resp.double_clicked() {
             renaming = Some((snap.id, snap.name.clone()));
@@ -3861,7 +3998,7 @@ pub fn properties_window(app: &mut PhotocraftApp, ctx: &egui::Context) {
         .inner_margin(egui::Margin::same(14));
     // A floating panel (Order::Middle like other panels, so menus, popups and dialogs stay above
     // it), anchored to the canvas corner and dragged by its title off the part being worked on.
-    let card_id = egui::Id::new("properties-card");
+    let card_id = egui::Id::unique("properties-card");
     let offset: egui::Vec2 = ctx.data(|m| m.get_temp(card_id)).unwrap_or_default();
     let mut drag = egui::Vec2::ZERO;
     let shown = egui::Area::new(card_id).order(egui::Order::Middle).fixed_pos(pos + offset).show(ctx, |ui| {
@@ -3885,11 +4022,11 @@ pub fn properties_window(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 ui.ctx().set_cursor_icon(egui::CursorIcon::Grab);
             }
             drag = grip.drag_delta();
-            let strip = crate::tab_strip::pill_tabs(ui, card_id.with("tabs"), bar, &tabs, &mut sel, false);
+            let context = crate::tab_strip::pill_tabs(ui, card_id.with("tabs"), bar, &tabs, &mut sel);
             if let Some(&picked) = indices.get(sel) {
                 app.ui.dock_tabs.properties = picked;
             }
-            match strip.context {
+            match context {
                 Some(crate::tab_strip::TabContextAction::Close(i)) => {
                     if let Some(&tab) = indices.get(i) {
                         crate::dock::close_tab(app, group, tab, false);
@@ -4096,8 +4233,8 @@ pub(crate) fn field_chips(app: &mut PhotocraftApp, ui: &mut egui::Ui, chips: Rec
         p.rect_stroke(fgr.expand(2.0), 2.0, frame, StrokeKind::Outside);
     }
     // The foreground is on top, so it takes the clicks where the two overlap.
-    let bg_resp = ui.interact(bgr, ui.id().with("field-bg"), Sense::click());
-    let fg_resp = ui.interact(fgr, ui.id().with("field-fg"), Sense::click());
+    let bg_resp = ui.interact(bgr, ui.scope_id().with("field-bg"), Sense::click());
+    let fg_resp = ui.interact(fgr, ui.scope_id().with("field-fg"), Sense::click());
     let picked = if fg_resp.clicked() { false } else { bg_resp.clicked() || bg_active };
     app.ui.color_panel.background = picked;
     if fg_resp.double_clicked() || bg_resp.double_clicked() {
@@ -4107,7 +4244,7 @@ pub(crate) fn field_chips(app: &mut PhotocraftApp, ui: &mut egui::Ui, chips: Rec
 
 /// Where the dock tells the Color field how tall its group body is.
 pub(crate) fn color_field_fill_id() -> egui::Id {
-    egui::Id::new("color-field-fill-height")
+    egui::Id::unique("color-field-fill-height")
 }
 
 /// The Color field stretches to its dock group's height instead of a fixed 120 pt, in every theme
@@ -4150,7 +4287,7 @@ pub(crate) fn field_hsva(mut hsva: egui::ecolor::Hsva, remembered: (f32, f32)) -
 pub(crate) fn color_field(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
     let bg_active = app.ui.color_panel.background;
-    let key = egui::Id::new(("color-field-hue", bg_active));
+    let key = egui::Id::unique(("color-field-hue", bg_active));
     let mut hsva = srgb_hsva(if bg_active { app.session.tools.background } else { app.session.tools.foreground });
     // What the field showed last: a grey carries no hue, black neither hue nor saturation (#3228).
     let remembered: (f32, f32) = ui.data(|d| d.get_temp(key)).unwrap_or((hsva.h, hsva.s));
@@ -4225,7 +4362,7 @@ pub(crate) fn color_field(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     ui.add_space(6.0);
     ui.horizontal(|ui| {
         let mut c = if bg_active { app.session.tools.background } else { app.session.tools.foreground };
-        if color_readout(ui, ui.id().with(("color-field", bg_active)), &mut c) {
+        if color_readout(ui, ui.scope_id().with(("color-field", bg_active)), &mut c) {
             if bg_active {
                 app.session.tools.background = c;
             } else {
@@ -4306,9 +4443,9 @@ pub(crate) fn color_readout(ui: &mut egui::Ui, id: egui::Id, color: &mut [f32; 4
         changed = hex_edit(ui, id.with("hex"), color);
         let [mut r, mut g, mut b] = srgb_bytes(*color).map(f32::from);
         let mut rgb = false;
-        for (label, v) in [("R", &mut r), ("G", &mut g), ("B", &mut b)] {
+        for (label, name, v) in [("R", tl!("Red"), &mut r), ("G", tl!("Green"), &mut g), ("B", tl!("Blue"), &mut b)] {
             ui.label(RichText::new(label).font(theme::mono(11.0)).color(t.text_faint));
-            rgb |= widgets::value_field(ui, v, 0.0..=255.0, "", 38.0).changed();
+            rgb |= widgets::value_field(ui, v, 0.0..=255.0, "", 38.0).accessible_name(name).changed();
         }
         if rgb {
             *color = [r / 255.0, g / 255.0, b / 255.0, 1.0];
@@ -4335,8 +4472,9 @@ fn hex_edit(ui: &mut egui::Ui, id: egui::Id, color: &mut [f32; 4]) -> bool {
     let mut child = ui.new_child(egui::UiBuilder::new().max_rect(field).layout(egui::Layout::left_to_right(egui::Align::Center)));
     // Room for a pasted "#rrggbb"; the parse trims it, and the field shows plain digits otherwise.
     // `Frame::NONE`: the themed surface above is this field's frame.
-    let resp =
-        child.add(egui::TextEdit::singleline(&mut text).id(id).char_limit(7).desired_width(field.width()).frame(egui::Frame::NONE).font(theme::mono(12.0)));
+    let resp = child
+        .add(egui::TextEdit::singleline(&mut text).id(id).char_limit(7).desired_width(field.width()).frame(egui::Frame::NONE).font(theme::mono(12.0)))
+        .accessible_name(tl!("Color"));
     if resp.has_focus() {
         ui.data_mut(|d| d.insert_temp(id, text.clone()));
     } else {
@@ -4364,6 +4502,15 @@ fn brush_tip(p: &egui::Painter, c: egui::Pos2, rad: f32, hardness: f32, color: C
     }
 }
 
+/// A painting tool's Mode dropdown over `modes` (`None` is Clear); the wheel over it steps the
+/// mode. Returns the mode picked this frame.
+fn tool_mode_dropdown(ui: &mut egui::Ui, id: &str, modes: &[Option<BlendMode>], current: Option<BlendMode>) -> Option<Option<BlendMode>> {
+    let opts: Vec<(Option<BlendMode>, &str)> = modes.iter().map(|m| (*m, m.map_or("Clear", BlendMode::label))).collect();
+    let mut mode = current;
+    let chosen = widgets::dropdown_wheel_hovered(ui, id, tl!("Mode"), &mut mode, &opts, 96.0).0;
+    chosen.last().copied()
+}
+
 /// The Brush's or Pencil's Mode dropdown: the blend modes, with Photoshop's painting-only Clear
 /// after Dissolve (#3439). Clear erases with the brush (`clear`); it shows while chosen, or while
 /// `~` is held (`held`). The wheel over it steps the mode, as over the Layers panel's (#2061).
@@ -4372,7 +4519,7 @@ fn paint_mode_dropdown(ui: &mut egui::Ui, id: &str, b: &mut photocraft_engine::B
     let at = opts.iter().position(|o| o.0 == Some(BlendMode::Dissolve)).map_or(opts.len(), |i| i + 1);
     opts.insert(at, (None, "Clear"));
     let mut mode = if *clear || held { None } else { Some(b.mode) };
-    if !widgets::dropdown_wheel_hovered(ui, id, &mut mode, &opts, 96.0).0.is_empty() {
+    if !widgets::dropdown_wheel_hovered(ui, id, tl!("Mode"), &mut mode, &opts, 96.0).0.is_empty() {
         *clear = mode.is_none();
         if let Some(m) = mode {
             b.mode = m;
@@ -4383,7 +4530,7 @@ fn paint_mode_dropdown(ui: &mut egui::Ui, id: &str, b: &mut photocraft_engine::B
 /// Options-bar Smoothing % (the brush's stroke smoothing; the live stroke and the commit use it).
 fn smoothing_field(ui: &mut egui::Ui, b: &mut photocraft_engine::BrushSettings, width: f32) {
     let mut sm = (b.smoothing.amount * 100.0).round();
-    if widgets::value_field(ui, &mut sm, 0.0..=100.0, "%", width).changed() {
+    if widgets::value_field_named(ui, tl!("Smoothing"), &mut sm, 0.0..=100.0, "%", width).changed() {
         b.smoothing.enabled = true;
         b.smoothing.amount = (sm / 100.0).clamp(0.0, 1.0);
     }
@@ -4408,7 +4555,7 @@ fn smoothing_options(ui: &mut egui::Ui, b: &mut photocraft_engine::BrushSettings
 fn mixer_load_swatch(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
     let (r, _) = ui.allocate_exact_size(vec2(40.0, 26.0), Sense::hover());
-    let resp = ui.interact(r, ui.id().with("mixer-brush-load"), Sense::click());
+    let resp = ui.interact(r, ui.scope_id().with("mixer-brush-load"), Sense::click());
     if resp.hovered() {
         ui.painter().rect_filled(r, t.radius_sm, t.hover);
     }
@@ -4425,7 +4572,7 @@ fn mixer_load_swatch(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     }
     p.rect_stroke(chip, 2.0, Stroke::new(1.0, t.field_border), StrokeKind::Outside);
     icons::paint(ui, Rect::from_center_size(pos2(r.right() - 9.0, r.center().y), vec2(10.0, 10.0)), "chevron-down", 9.0, t.text_faint);
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Current Brush Load")));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Current Brush Load")));
     let resp = resp.on_hover_text(tl!("Current Brush Load"));
     let mut run = None;
     egui::Popup::menu(&resp).show(|ui| {
@@ -4459,7 +4606,7 @@ fn brush_preset_chip(ui: &mut egui::Ui, b: &photocraft_engine::BrushSettings, st
     brush_tip(ui.painter(), c, 7.0, b.hardness, tip);
     ui.painter().text(pos2(c.x, r.bottom() - 5.0), Align2::CENTER_CENTER, format!("{}", b.size.round() as i64), egui::FontId::proportional(9.5), t.text_dim);
     icons::paint(ui, Rect::from_center_size(pos2(r.right() - 9.0, c.y), vec2(10.0, 10.0)), "chevron-down", 9.0, t.text_faint);
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Brush Preset picker")));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Brush Preset picker")));
     if resp.on_hover_text(tl!("Brush Preset picker")).clicked() {
         if state.brush_picker.is_some() {
             crate::brush_picker::close(state);
@@ -4501,7 +4648,7 @@ fn layer_drag_and_drop(
     actions: &mut Vec<(String, Value)>,
 ) {
     let t = Tokens::get(ctx);
-    let key = egui::Id::new("layer-drag");
+    let key = egui::Id::unique("layer-drag");
     // A drag from the mask thumbnail (`starts_mask_drag`) moves the mask, not the layer.
     let mask_drag = ctx.data(|d| d.get_temp::<MaskDrag>(mask_drag_key())).is_some_and(|(id, _)| id == l.id.0);
     if resp.drag_started() && !mask_drag {
@@ -4603,7 +4750,7 @@ fn layer_drop_zone(
     position: &'static str,
     actions: &mut Vec<(String, Value)>,
 ) {
-    let Some(dragged) = ctx.data(|d| d.get_temp::<u64>(egui::Id::new("layer-drag"))) else { return };
+    let Some(dragged) = ctx.data(|d| d.get_temp::<u64>(egui::Id::unique("layer-drag"))) else { return };
     let selected = app.session.active().map(|st| st.selected_layers()).unwrap_or_default();
     if target.0 == LayerId(dragged) && selected.len() > 1 && selected.contains(&target.0) {
         return;
@@ -4637,7 +4784,7 @@ type FxDrag = (u64, Option<usize>);
 type MaskDrag = (u64, MaskKind);
 
 fn mask_drag_key() -> egui::Id {
-    egui::Id::new("mask-drag")
+    egui::Id::unique("mask-drag")
 }
 
 /// Which mask's thumbnail (where it was drawn last frame) the row's drag starts on, if any.
@@ -4656,7 +4803,7 @@ fn starts_mask_drag(ctx: &egui::Context, l: &Layer, resp: &egui::Response) -> Op
 }
 
 fn fx_drag_key() -> egui::Id {
-    egui::Id::new("fx-drag")
+    egui::Id::unique("fx-drag")
 }
 
 /// Start dragging the effects of `layer`: one (`effect`) or all of them.
@@ -4741,7 +4888,7 @@ fn effect_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, l: &Layer, depth: usi
         }
         // The whole eye column of the row takes the click, so it never opens the Layer Style dialog.
         let eye_cell = Rect::from_min_max(pos2(rect.left() + 30.0, rect.top()), pos2((rect.left() + 58.0).min(rect.right()), rect.bottom()));
-        if ui.interact(eye_cell, ui.id().with(("fx-eye", l.id.0, i)), Sense::click()).clicked() {
+        if ui.interact(eye_cell, ui.scope_id().with(("fx-eye", l.id.0, i)), Sense::click()).clicked() {
             let mut params = json!({"layer": l.id.0, "visible": !on});
             if let (Some(index), Some(o)) = (i.checked_sub(1), params.as_object_mut()) {
                 o.insert("index".into(), json!(index));
@@ -4762,7 +4909,7 @@ fn effect_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, l: &Layer, depth: usi
             egui::FontId::proportional(11.5),
             if on { t.text_dim } else { t.text_faint },
         );
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, name.clone()));
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, name.clone()));
         if resp.double_clicked() {
             crate::layer_style::open_for_layer(app, l.id, kind);
         }
@@ -4864,14 +5011,14 @@ mod color_tests {
         let mut h = egui_kittest::Harness::builder().with_size(vec2(300.0, 300.0)).build_ui_state(
             |ui, app: &mut PhotocraftApp| {
                 let at = (ui.cursor().min, ui.available_width());
-                ui.data_mut(|d| d.insert_temp(egui::Id::new("test-origin"), at));
+                ui.data_mut(|d| d.insert_temp(egui::Id::unique("test-origin"), at));
                 color_field(app, ui);
             },
             app,
         );
         PhotocraftApp::setup_context(&h.ctx, crate::theme::ThemeKind::Studio);
         h.run_steps(2);
-        let (o, w) = h.ctx.data(|d| d.get_temp::<(Pos2, f32)>(egui::Id::new("test-origin"))).unwrap();
+        let (o, w) = h.ctx.data(|d| d.get_temp::<(Pos2, f32)>(egui::Id::unique("test-origin"))).unwrap();
         let field_w = w - 38.0 - 14.0 - 16.0;
         let press = |h: &mut egui_kittest::Harness<'static, PhotocraftApp>, at: Pos2, pressed: bool| {
             h.event(egui::Event::PointerMoved(at));
@@ -4906,14 +5053,14 @@ mod color_tests {
         let mut h = egui_kittest::Harness::builder().with_size(vec2(300.0, 300.0)).build_ui_state(
             |ui, app: &mut PhotocraftApp| {
                 let at = (ui.cursor().min, ui.available_width());
-                ui.data_mut(|d| d.insert_temp(egui::Id::new("test-origin"), at));
+                ui.data_mut(|d| d.insert_temp(egui::Id::unique("test-origin"), at));
                 color_field(app, ui);
             },
             app,
         );
         PhotocraftApp::setup_context(&h.ctx, crate::theme::ThemeKind::Studio);
         h.run_steps(2);
-        let (o, w) = h.ctx.data(|d| d.get_temp::<(Pos2, f32)>(egui::Id::new("test-origin"))).unwrap();
+        let (o, w) = h.ctx.data(|d| d.get_temp::<(Pos2, f32)>(egui::Id::unique("test-origin"))).unwrap();
         let field_w = w - 38.0 - 14.0 - 16.0;
         let field = o + vec2(38.0 + 8.0 + field_w * 0.5, 60.0);
         let strip = o + vec2(38.0 + 8.0 + field_w + 8.0 + 7.0, 40.0);
@@ -5414,7 +5561,7 @@ mod color_tests {
         assert_eq!(srgb_bytes(h.state().session.tools.foreground), [0, 0, 0], "both corners are black");
         // What the knob is drawn from on the very next frame: the field kept the saturation the
         // drag ended at (not the zero black reads back as), together with the hue.
-        let remembered: (f32, f32) = h.ctx.data(|d| d.get_temp(egui::Id::new(("color-field-hue", false)))).expect("the field remembers what it showed");
+        let remembered: (f32, f32) = h.ctx.data(|d| d.get_temp(egui::Id::unique(("color-field-hue", false)))).expect("the field remembers what it showed");
         assert!(remembered.1 > 0.9, "the saturation the corner was dragged to: {remembered:?}");
         let shown = field_hsva(egui::ecolor::Hsva::new(0.0, 0.0, 0.0, 1.0), remembered);
         assert!(shown.s > 0.9, "the knob stays at the right edge, not the left: {remembered:?}");
@@ -5541,7 +5688,7 @@ mod history_transform_tests {
         let steps = h.state().session.active().unwrap().history.entries().len();
         click(&mut h, b[1].0.center());
         let st = h.state().session.active().unwrap();
-        assert_eq!(st.snapshots.len(), 1, "the camera takes a snapshot");
+        assert_eq!(st.snapshots.len(), 2, "the camera takes a snapshot, after the first one");
         assert_eq!(st.history.entries().len(), steps, "which is not a history state");
         let docs = h.state().session.documents().len();
         click(&mut h, b[2].0.center());
@@ -5590,11 +5737,13 @@ mod history_transform_tests {
         app.run("history.newSnapshot", json!({})).unwrap();
         let mut h = Harness::builder().with_size(vec2(300.0, 400.0)).build_ui_state(|ui, app: &mut PhotocraftApp| history(app, ui), app);
         h.run_steps(2);
-        // The snapshot row's cell is the only 24×38 one (the opening row has no column).
-        let cells: Vec<Rect> = h
+        // Snapshot rows' cells are the 24×38 ones: the opening snapshot (0) first, then the new one.
+        let mut cells: Vec<Rect> = h
             .ctx
             .viewport(|v| v.prev_pass.widgets.layers().flat_map(|(_, w)| w.iter()).filter(|w| w.rect.size() == vec2(24.0, 38.0)).map(|w| w.rect).collect());
-        let cell = *cells.first().expect("a snapshot source cell");
+        cells.sort_by(|a, b| a.top().total_cmp(&b.top()));
+        assert_eq!(cells.len(), 2, "a source cell on each snapshot row");
+        let cell = cells[1];
         click(&mut h, cell.center());
         let st = h.state().session.active().unwrap();
         assert_eq!(photocraft_engine::history_source_cmds::source(st), Some(HistorySource::Snapshot(1)));
@@ -5615,8 +5764,9 @@ mod snapshot_row_tests {
         h.state().session.active().unwrap().doc.layers.last().unwrap().surface().unwrap().rgba(1, 1)
     }
 
+    /// The names of the snapshots taken after the first one (the document as opened).
     fn snapshot_names(h: &Harness<'static, PhotocraftApp>) -> Vec<String> {
-        h.state().session.active().unwrap().snapshots.iter().map(|s| s.name.clone()).collect()
+        h.state().session.active().unwrap().snapshots.iter().skip(1).map(|s| s.name.clone()).collect()
     }
 
     /// Snapshot rows (#2966) sit under the opening row: clicking one returns to it as a new
@@ -5738,7 +5888,7 @@ mod snapshot_row_tests {
         let p = trash(&h);
         click(&mut h, p);
         let st = h.state().session.active().unwrap();
-        assert!(st.snapshots.is_empty(), "the trash deleted the snapshot");
+        assert_eq!(st.snapshots.len(), 1, "the trash deleted the snapshot (the first snapshot stays)");
         assert_eq!(st.history.entries().len(), steps, "and left the states alone");
 
         // An edit after the click deselects the snapshot: the trash deletes the state.
@@ -5752,7 +5902,7 @@ mod snapshot_row_tests {
         let p = trash(&h);
         click(&mut h, p);
         let st = h.state().session.active().unwrap();
-        assert_eq!(st.snapshots.len(), 1, "the snapshot is kept");
+        assert_eq!(st.snapshots.len(), 2, "the snapshot is kept");
         assert_eq!(st.history.entries().len(), steps - 1, "the current state is deleted");
     }
 
@@ -5765,7 +5915,7 @@ mod snapshot_row_tests {
         let to = trash(&h);
         drag(&mut h, egui::pos2(row.x, row.y), to);
         let st = h.state().session.active().unwrap();
-        assert!(st.snapshots.is_empty(), "the dragged snapshot is deleted");
+        assert_eq!(st.snapshots.len(), 1, "the dragged snapshot is deleted (the first snapshot stays)");
         assert_eq!(st.history.entries().len(), steps, "no state is");
 
         // The second-to-last state: it and the state after it go, as with Delete.
@@ -5778,7 +5928,7 @@ mod snapshot_row_tests {
         drag(&mut h, egui::pos2(row.x, row.y), to);
         let st = h.state().session.active().unwrap();
         assert_eq!(st.history.entries().len(), 1, "the dragged state and the ones after it are deleted");
-        assert_eq!(st.snapshots.len(), 1, "the snapshot is kept");
+        assert_eq!(st.snapshots.len(), 2, "the snapshot is kept");
     }
 
     /// Snapshot rows scroll with the states: many snapshots in a short dock leave the footer and
@@ -5802,6 +5952,78 @@ mod snapshot_row_tests {
         assert!(buttons.iter().all(|b| view.contains_rect(*b)), "footer in view: {buttons:?} in {view:?}");
     }
 
+    /// The top row is the first snapshot, the document as opened: clicking it brings that back
+    /// (the Discord report on #2966: "History original file click does not work").
+    #[test]
+    fn the_top_row_returns_to_the_document_as_opened() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.run("file.new", json!({"width": 200, "height": 150})).unwrap();
+        let opened = app.session.active().unwrap().doc.layers[0].surface().unwrap().rgba(1, 1);
+        app.run("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        let name = app.session.active().unwrap().doc.name.clone();
+        let mut h = Harness::builder().with_size(vec2(300.0, 400.0)).build_ui_state(|ui, app: &mut PhotocraftApp| history(app, ui), app);
+        h.run_steps(3);
+        h.get_by_label(&name).click();
+        h.run_steps(2);
+        let st = h.state().session.active().unwrap();
+        assert_eq!(st.doc.layers[0].surface().unwrap().rgba(1, 1), opened);
+        assert_eq!(st.history.entries().last(), Some(&name));
+    }
+
+    /// ⌥-click on the camera opens New Snapshot (#2966): the name, selected so typing replaces
+    /// it, and From (Full Document, Merged Layers, Current Layer); OK takes the snapshot.
+    #[test]
+    fn alt_click_on_the_camera_opens_new_snapshot() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.run("file.new", json!({"width": 200, "height": 150})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        let mut h = Harness::builder().with_size(vec2(900.0, 700.0)).build_ui_state(
+            |ui, app: &mut PhotocraftApp| {
+                let ctx = ui.ctx().clone();
+                if !ctx.fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
+                    return;
+                }
+                history(app, ui);
+                crate::dialogs::show(app, &ctx);
+            },
+            app,
+        );
+        PhotocraftApp::setup_context(&h.ctx, crate::theme::ThemeKind::ProMedium);
+        h.state_mut().ui.theme = crate::theme::ThemeKind::ProMedium;
+        h.run_steps(4);
+        let mut buttons: Vec<Rect> = h
+            .ctx
+            .viewport(|v| v.prev_pass.widgets.layers().flat_map(|(_, w)| w.iter()).filter(|w| w.rect.size() == vec2(26.0, 26.0)).map(|w| w.rect).collect());
+        buttons.sort_by(|a, b| b.center().x.total_cmp(&a.center().x));
+        let camera = buttons[1].center();
+        let alt = egui::Modifiers::ALT;
+        h.event(egui::Event::ModifiersChanged(alt));
+        h.event(egui::Event::PointerMoved(camera));
+        h.run_steps(1);
+        for pressed in [true, false] {
+            h.event(egui::Event::PointerButton { pos: camera, button: egui::PointerButton::Primary, pressed, modifiers: alt });
+            h.run_steps(1);
+        }
+        h.event(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+        h.run_steps(3);
+        assert_eq!(h.state().session.active().unwrap().snapshots.len(), 1, "⌥-click opens the dialog instead");
+        assert!(h.state().ui.dialogs.last().is_some_and(|d| crate::snapshot_dialog::owns(&d.fields)));
+        h.get_by_role(egui::accesskit::Role::TextInput).type_text("Red layer only");
+        h.run_steps(1);
+        h.get_all_by_role(egui::accesskit::Role::ComboBox).find(|n| n.accesskit_node().value().as_deref() == Some("Full Document")).unwrap().click();
+        h.run_steps(3);
+        h.get_by_label("Current Layer").click();
+        h.run_steps(3);
+        h.get_by_label("OK").click();
+        h.run_steps(3);
+        let st = h.state().session.active().unwrap();
+        let snap = st.snapshots.last().unwrap();
+        assert_eq!(snap.name, "Red layer only");
+        assert_eq!(snap.doc.layers.len(), 1, "only the current layer");
+        assert!(h.state().ui.dialogs.is_empty());
+    }
+
     /// Renaming belongs to one document: snapshot ids restart in each, so switching tabs must not
     /// carry the edit over to the other document's snapshot with the same id.
     #[test]
@@ -5978,8 +6200,8 @@ mod tool_flyout_drag_tests {
         });
         buttons.sort_by(|a, b| a.top().total_cmp(&b.top()));
         let origin = buttons[slot_index].center();
-        let key = egui::Id::new(("tool-slot", slot_index));
-        let flyout_id = egui::Id::new("tool-flyout");
+        let key = egui::Id::unique(("tool-slot", slot_index));
+        let flyout_id = egui::Id::unique("tool-flyout");
         let initial = app.ui.tool;
         frame(&mut app, &ctx, 1.0, vec![egui::Event::PointerMoved(origin), primary(origin, true)]);
         assert!(ctx.data(|d| d.get_temp::<(egui::Id, Rect)>(flyout_id)).is_none());
@@ -6034,18 +6256,21 @@ mod type_flyout_tests {
         let pointer = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() };
         frame(&mut app, &ctx, 1.0, vec![egui::Event::PointerMoved(at), pointer(at, true)]);
         frame(&mut app, &ctx, 1.36, vec![]);
-        assert_eq!(ctx.data(|d| d.get_temp::<(egui::Id, Rect)>(egui::Id::new("tool-flyout"))).map(|(id, _)| id), Some(egui::Id::new(("tool-slot", index))));
+        assert_eq!(
+            ctx.data(|d| d.get_temp::<(egui::Id, Rect)>(egui::Id::unique("tool-flyout"))).map(|(id, _)| id),
+            Some(egui::Id::unique(("tool-slot", index)))
+        );
         frame(&mut app, &ctx, 1.4, vec![pointer(at, false)]);
         frame(&mut app, &ctx, 1.45, vec![]);
         // The held button's tool is selected, as Photoshop does (#4453).
         assert_eq!(app.ui.tool, Tool::Type);
-        let key = egui::Id::new(("tool-slot", index));
+        let key = egui::Id::unique(("tool-slot", index));
         let menu = ctx.memory(|m| m.area_rect(key.with("flyout"))).unwrap();
         let row = egui::pos2(menu.left() + 65.0, menu.top() + 39.0 + 8.0);
         frame(&mut app, &ctx, 2.0, vec![egui::Event::PointerMoved(row), pointer(row, true)]);
         frame(&mut app, &ctx, 2.05, vec![pointer(row, false)]);
         assert_eq!(app.ui.tool, Tool::VerticalType);
-        assert!(ctx.data(|d| d.get_temp::<(egui::Id, Rect)>(egui::Id::new("tool-flyout"))).is_none());
+        assert!(ctx.data(|d| d.get_temp::<(egui::Id, Rect)>(egui::Id::unique("tool-flyout"))).is_none());
     }
 
     /// #4444: click and hold on Change Screen Mode opens its list like the tool flyouts, without
@@ -6163,7 +6388,7 @@ mod type_flyout_tests {
             let texts = frame_texts(&mut app, &ctx, 3.0 + 0.1 * f64::from(k), vec![]);
             assert!(!texts.contains(&tip(Tool::Eyedropper)), "held {k}: {texts:?}");
         }
-        assert!(ctx.data(|d| d.get_temp::<(egui::Id, Rect)>(egui::Id::new("tool-flyout"))).is_some(), "the flyout is open");
+        assert!(ctx.data(|d| d.get_temp::<(egui::Id, Rect)>(egui::Id::unique("tool-flyout"))).is_some(), "the flyout is open");
         // Released, with the flyout still open: none for the held tool or another one.
         frame(&mut app, &ctx, 4.1, vec![pointer(eyedropper, false)]);
         for (start, at, tool) in [(4.5, eyedropper, Tool::Eyedropper), (6.0, brush, Tool::Brush)] {
@@ -6198,7 +6423,7 @@ mod type_flyout_tests {
         });
         buttons.sort_by(|a, b| a.top().total_cmp(&b.top()));
         let at = buttons[index].center();
-        let flyout = |ctx: &egui::Context| ctx.data(|d| d.get_temp::<(egui::Id, Rect)>(egui::Id::new("tool-flyout"))).is_some();
+        let flyout = |ctx: &egui::Context| ctx.data(|d| d.get_temp::<(egui::Id, Rect)>(egui::Id::unique("tool-flyout"))).is_some();
         let secondary = |pressed| egui::Event::PointerButton { pos: at, button: egui::PointerButton::Secondary, pressed, modifiers: Default::default() };
         let primary = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() };
         // A right-click on the button of an open flyout closes it (#4932), so open only a closed one.
@@ -6212,7 +6437,7 @@ mod type_flyout_tests {
         };
         // A press on the flyout itself keeps it open (the row picks on release).
         open(&mut app, 1.0);
-        let menu = ctx.memory(|m| m.area_rect(egui::Id::new(("tool-slot", index)).with("flyout"))).unwrap();
+        let menu = ctx.memory(|m| m.area_rect(egui::Id::unique(("tool-slot", index)).with("flyout"))).unwrap();
         frame(&mut app, &ctx, 1.5, vec![egui::Event::PointerMoved(menu.center()), primary(menu.center(), true)]);
         assert!(flyout(&ctx), "a press on the flyout keeps it");
         frame(&mut app, &ctx, 1.55, vec![primary(menu.center(), false)]);
@@ -6256,6 +6481,12 @@ mod type_flyout_tests {
         assert_eq!(j.first(), Some(&Tool::Remove));
     }
 
+    #[test]
+    fn art_history_is_in_the_y_flyout() {
+        let y = TOOL_SECTIONS.iter().flat_map(|section| section.iter()).find(|slot| slot.contains(&Tool::HistoryBrush)).expect("Y group");
+        assert_eq!(*y, [Tool::HistoryBrush, Tool::ArtHistoryBrush]);
+    }
+
     #[test]
     fn long_press_clone_stamp_selects_pattern_stamp() {
         let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
@@ -6281,10 +6512,13 @@ mod type_flyout_tests {
         let pointer = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() };
         frame(&mut app, &ctx, 1.0, vec![egui::Event::PointerMoved(at), pointer(at, true)]);
         frame(&mut app, &ctx, 1.36, vec![]);
-        assert_eq!(ctx.data(|d| d.get_temp::<(egui::Id, Rect)>(egui::Id::new("tool-flyout"))).map(|(id, _)| id), Some(egui::Id::new(("tool-slot", index))));
+        assert_eq!(
+            ctx.data(|d| d.get_temp::<(egui::Id, Rect)>(egui::Id::unique("tool-flyout"))).map(|(id, _)| id),
+            Some(egui::Id::unique(("tool-slot", index)))
+        );
         frame(&mut app, &ctx, 1.4, vec![pointer(at, false)]);
         frame(&mut app, &ctx, 1.45, vec![]);
-        let key = egui::Id::new(("tool-slot", index));
+        let key = egui::Id::unique(("tool-slot", index));
         let menu = ctx.memory(|m| m.area_rect(key.with("flyout"))).unwrap();
         let row = egui::pos2(menu.left() + 65.0, menu.top() + 39.0 + 8.0);
         frame(&mut app, &ctx, 2.0, vec![egui::Event::PointerMoved(row), pointer(row, true)]);
@@ -6320,7 +6554,7 @@ mod type_flyout_tests {
         frame(&mut app, &ctx, 1.36, vec![]);
         frame(&mut app, &ctx, 1.4, vec![pointer(at, false)]);
         frame(&mut app, &ctx, 1.45, vec![]);
-        let key = egui::Id::new(("tool-slot", index));
+        let key = egui::Id::unique(("tool-slot", index));
         let menu = ctx.memory(|m| m.area_rect(key.with("flyout"))).unwrap();
         // The last of the four 26-point rows.
         let row = egui::pos2(menu.left() + 65.0, menu.bottom() - 20.0);
@@ -6345,6 +6579,43 @@ mod type_flyout_tests {
         // The glyph stays inside the button with room for the flyout triangle's corner.
         assert!(toolbar_icon_size(30.0, true) <= 30.0 - 2.0 * 4.0);
     }
+
+    #[test]
+    fn long_press_y_button_selects_art_history() {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        let ctx = egui::Context::default();
+        PhotocraftApp::setup_context(&ctx, crate::theme::ThemeKind::ALL[0]);
+        frame(&mut app, &ctx, 0.0, vec![]);
+        frame(&mut app, &ctx, 0.1, vec![]);
+        let index = TOOL_SECTIONS.iter().flat_map(|section| section.iter()).position(|slot| slot.contains(&Tool::HistoryBrush)).unwrap();
+        let bx = if Tokens::get(&ctx).pro { 30.0 } else { 36.0 };
+        let mut buttons: Vec<Rect> = ctx.viewport(|v| {
+            v.prev_pass
+                .widgets
+                .layers()
+                .flat_map(|(_, w)| w.iter())
+                .filter(|w| w.rect.size() == egui::Vec2::splat(bx) && w.sense.senses_click())
+                .map(|w| w.rect)
+                .collect()
+        });
+        buttons.sort_by(|a, b| a.top().total_cmp(&b.top()));
+        let at = buttons[index].center();
+        let pointer = |pos, pressed| egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() };
+        frame(&mut app, &ctx, 1.0, vec![egui::Event::PointerMoved(at), pointer(at, true)]);
+        frame(&mut app, &ctx, 1.36, vec![]);
+        assert_eq!(
+            ctx.data(|d| d.get_temp::<(egui::Id, Rect)>(egui::Id::unique("tool-flyout"))).map(|(id, _)| id),
+            Some(egui::Id::unique(("tool-slot", index)))
+        );
+        frame(&mut app, &ctx, 1.4, vec![pointer(at, false)]);
+        frame(&mut app, &ctx, 1.45, vec![]);
+        let key = egui::Id::unique(("tool-slot", index));
+        let menu = ctx.memory(|m| m.area_rect(key.with("flyout"))).unwrap();
+        let row = egui::pos2(menu.left() + 65.0, menu.top() + 39.0 + 8.0);
+        frame(&mut app, &ctx, 2.0, vec![egui::Event::PointerMoved(row), pointer(row, true)]);
+        frame(&mut app, &ctx, 2.05, vec![pointer(row, false)]);
+        assert_eq!(app.ui.tool, Tool::ArtHistoryBrush);
+    }
 }
 
 #[cfg(test)]
@@ -6465,14 +6736,14 @@ mod toolbar_tests {
                     if ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
                         toolbar(app, ui);
                         let left = ui.available_rect_before_wrap().left();
-                        ui.data_mut(|d| d.insert_temp(egui::Id::new("toolbar-test-left"), left));
+                        ui.data_mut(|d| d.insert_temp(egui::Id::unique("toolbar-test-left"), left));
                     }
                 },
                 app,
             );
             PhotocraftApp::setup_context(&h.ctx, theme);
             h.run_steps(2);
-            let left = |h: &egui_kittest::Harness<'_, PhotocraftApp>| h.ctx.data(|d| d.get_temp::<f32>(egui::Id::new("toolbar-test-left"))).unwrap_or(0.0);
+            let left = |h: &egui_kittest::Harness<'_, PhotocraftApp>| h.ctx.data(|d| d.get_temp::<f32>(egui::Id::unique("toolbar-test-left"))).unwrap_or(0.0);
             let single = left(&h);
             assert!(!h.state().ui.panels.toolbar_double, "{theme:?}");
 
@@ -6509,6 +6780,38 @@ mod toolbar_tests {
         }
     }
 
+    // Regression test for #2241: Quick Mask and Screen Mode ignored the two-column toolbar and
+    // stayed stacked in one column; in two columns they sit side by side.
+    #[test]
+    fn quick_mask_and_screen_mode_follow_the_toolbar_columns() {
+        for theme in [crate::theme::ThemeKind::Pro, crate::theme::ThemeKind::Studio, crate::theme::ThemeKind::Classic] {
+            let app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+            let mut h = egui_kittest::Harness::builder().with_size(vec2(800.0, 1400.0)).build_ui_state(
+                |ui, app: &mut PhotocraftApp| {
+                    if ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
+                        toolbar(app, ui);
+                    }
+                },
+                app,
+            );
+            PhotocraftApp::setup_context(&h.ctx, theme);
+            h.run_steps(2);
+            let modes = |h: &egui_kittest::Harness<'_, PhotocraftApp>| {
+                (h.get_by_label("Edit in Quick Mask Mode  (Q)").rect(), h.get_by_label("Change Screen Mode  (F)").rect())
+            };
+            let (quick, screen) = modes(&h);
+            assert_eq!(quick.left(), screen.left(), "{theme:?}: one column stacks them");
+            assert!(screen.top() >= quick.bottom(), "{theme:?}: Screen Mode below Quick Mask: {quick:?} {screen:?}");
+
+            h.get_by_label("Toolbar").click();
+            h.run_steps(2);
+            assert!(h.state().ui.panels.toolbar_double, "{theme:?}");
+            let (quick, screen) = modes(&h);
+            assert_eq!(quick.top(), screen.top(), "{theme:?}: two columns put them on one row: {quick:?} {screen:?}");
+            assert!(screen.left() >= quick.right(), "{theme:?}: Screen Mode beside Quick Mask: {quick:?} {screen:?}");
+        }
+    }
+
     fn click(h: &mut egui_kittest::Harness<'_, PhotocraftApp>, p: egui::Pos2) {
         h.hover_at(p);
         h.run_steps(1);
@@ -6653,7 +6956,13 @@ mod embedding_tests {
     }
 
     fn drawn(h: &egui_kittest::Harness<'_, PhotocraftApp>, panel: &str) -> bool {
-        egui::containers::panel::PanelState::load(&h.ctx, egui::Id::new(panel)).is_some()
+        egui::containers::panel::PanelState::load(&h.ctx, panel_state_id(&h.ctx, panel)).is_some()
+    }
+
+    /// The rail is drawn inside the canvas panel, so its panel state is keyed under that panel's
+    /// scope: find it by a button only the rail has.
+    fn rail_drawn(h: &egui_kittest::Harness<'_, PhotocraftApp>) -> bool {
+        h.query_by_label("Color & Swatches").is_some()
     }
 
     /// An app that embeds the UI can hide the icon rail and the menu bar; both are on by default.
@@ -6663,14 +6972,14 @@ mod embedding_tests {
         assert!(panels.rail && panels.menu_bar);
 
         let h = whole_app(true, true);
-        assert!(drawn(&h, "rail") && drawn(&h, "title_bar"));
+        assert!(rail_drawn(&h) && drawn(&h, "title_bar"));
         assert!(h.query_by_label("File").is_some());
 
         let h = whole_app(false, false);
-        assert!(!drawn(&h, "rail"), "the icon rail is drawn");
+        assert!(!rail_drawn(&h), "the icon rail is drawn");
         assert!(!drawn(&h, "title_bar"), "the title bar is drawn");
         assert!(h.query_by_label("File").is_none(), "the menus are drawn");
-        assert!(drawn(&h, "dock"), "the dock itself stays");
+        assert!(crate::panel_docking::last_bodies(&h.ctx).iter().any(|(id, _)| id == "layers"), "the dock itself stays");
     }
 
     /// Settings saved before the flags existed load with both on.
@@ -6891,6 +7200,7 @@ mod compact_visual_regressions {
                 let mut harness = toolbar_harness(kind, scale);
                 harness.event(egui::Event::PointerMoved(pos2(25.0, 100.0)));
                 harness.event(egui::Event::MouseWheel {
+                    source: egui::MouseWheelSource::Unknown,
                     unit: egui::MouseWheelUnit::Point,
                     delta: vec2(0.0, -1500.0),
                     modifiers: egui::Modifiers::NONE,
@@ -6983,7 +7293,7 @@ mod compact_visual_regressions {
                     harness.render().unwrap().save(directory.join(format!("{stem}.png"))).unwrap();
                     let mut regions = serde_json::Map::new();
                     for id in ["options_bar", "toolbar"] {
-                        let r = egui::containers::panel::PanelState::load(&harness.ctx, egui::Id::new(id)).unwrap().outer_rect;
+                        let r = egui::containers::panel::PanelState::load(&harness.ctx, panel_state_id(&harness.ctx, id)).unwrap().outer_rect;
                         regions.insert(id.into(), json!([r.left(), r.top(), r.width(), r.height()]));
                     }
                     let metadata = json!({"screen": [width, height], "scale": scale, "regions": regions});
@@ -6992,6 +7302,7 @@ mod compact_visual_regressions {
                         harness.input_mut().events.extend([
                             egui::Event::PointerMoved(pos2(width * 0.5, 20.0)),
                             egui::Event::MouseWheel {
+                                source: egui::MouseWheelSource::Unknown,
                                 unit: egui::MouseWheelUnit::Point,
                                 delta: vec2(-1500.0, 0.0),
                                 modifiers: egui::Modifiers::NONE,
@@ -7191,6 +7502,7 @@ mod compact_visual_regressions {
                                 events: vec![
                                     egui::Event::PointerMoved(pos2(800.0, 20.0)),
                                     egui::Event::MouseWheel {
+                                        source: egui::MouseWheelSource::Unknown,
                                         unit: egui::MouseWheelUnit::Point,
                                         delta: vec2(-100.0, 0.0),
                                         modifiers: egui::Modifiers::NONE,
@@ -7335,6 +7647,7 @@ mod compact_visual_regressions {
                                     // to step through blend modes (#4512).
                                     egui::Event::PointerMoved(if Tokens::get(&ctx).pro { pos2(width * 0.5, 20.0) } else { pos2(width * 0.5, 2.0) }),
                                     egui::Event::MouseWheel {
+                                        source: egui::MouseWheelSource::Unknown,
                                         unit: egui::MouseWheelUnit::Point,
                                         delta: vec2(-1500.0, 0.0),
                                         modifiers: egui::Modifiers::NONE,
@@ -7585,3 +7898,84 @@ mod sampler_readout_tests {
         assert_eq!(sampler_readouts(&mut app).len(), 2, "so does a new sampler");
     }
 }
+
+#[cfg(test)]
+mod panel_state_migration_tests {
+    use super::{migrate_panel_state, panel_state_id};
+    use egui::containers::panel::PanelState;
+    use egui::{Context, Id, Rect, pos2, vec2};
+
+    fn state(width: f32) -> PanelState {
+        PanelState { outer_rect: Rect::from_min_size(pos2(0.0, 0.0), vec2(width, 600.0)) }
+    }
+
+    /// 0.36 saved `dock` under `Id::new("dock")`; 0.37 reads a parent-scoped key.
+    #[test]
+    fn the_parent_scoped_key_matches_the_panel_egui_shows() {
+        let ctx = Context::default();
+        let mut output = ctx.run_ui(Default::default(), |ui| {
+            egui::Panel::right("dock").exact_size(410.0).show(ui, |ui| ui.set_min_width(ui.available_width()));
+        });
+        output.textures_delta.clear();
+        let key = panel_state_id(&ctx, "dock");
+        assert_eq!(key, ctx.viewport_id().root_ui_id().with("dock"));
+        let panel = PanelState::load(&ctx, key).expect("the panel persisted under its parent-scoped id");
+        assert_eq!(panel.size().x, 410.0);
+        assert_ne!(key, Id::unique("dock"), "the old persisted key is a different id");
+    }
+
+    #[test]
+    fn old_panel_widths_move_to_the_new_key_once() {
+        let ctx = Context::default();
+        let old = Id::unique("dock");
+        ctx.data_mut(|d| d.insert_persisted(old, state(410.0)));
+        migrate_panel_state(&ctx);
+        let new = panel_state_id(&ctx, "dock");
+        assert_eq!(PanelState::load(&ctx, new).map(|p| p.size().x), Some(410.0));
+        assert_eq!(PanelState::load(&ctx, old).map(|p| p.size().x), Some(410.0), "0.36 rollback still reads it");
+
+        // An existing 0.37 value wins, in a partial migration or on a later run.
+        ctx.data_mut(|d| d.insert_persisted(new, state(290.0)));
+        ctx.data_mut(|d| d.insert_temp(Id::unique("photocraft-panel-state-migrated"), false));
+        migrate_panel_state(&ctx);
+        assert_eq!(PanelState::load(&ctx, new).map(|p| p.size().x), Some(290.0));
+        assert_eq!(PanelState::load(&ctx, old).map(|p| p.size().x), Some(410.0));
+    }
+
+    /// 0.37 resize → 0.36 rollback resize → upgrade must keep the newer 0.36 width, not the
+    /// stale 0.37 one (the old key stays the only one a 0.36 build writes).
+    #[test]
+    fn a_0_36_rollback_resize_after_0_37_is_picked_up() {
+        use super::remember_panel_state;
+        let ctx = Context::default();
+        let old = Id::unique("dock");
+        let new = panel_state_id(&ctx, "dock");
+        ctx.data_mut(|d| d.insert_persisted(old, state(410.0)));
+        migrate_panel_state(&ctx);
+        // This 0.37 session resized the dock; the pass-end stamp records it.
+        ctx.data_mut(|d| d.insert_persisted(new, state(290.0)));
+        remember_panel_state(&ctx);
+        // A 0.36 build then resized the same dock (it writes only the old key).
+        ctx.data_mut(|d| d.insert_persisted(old, state(330.0)));
+        ctx.data_mut(|d| d.insert_temp(Id::unique("photocraft-panel-state-migrated"), false));
+        migrate_panel_state(&ctx);
+        assert_eq!(PanelState::load(&ctx, new).map(|p| p.size().x), Some(330.0), "the newer 0.36 width wins");
+        assert_eq!(PanelState::load(&ctx, old).map(|p| p.size().x), Some(330.0), "and stays for a rollback");
+    }
+
+    /// A 0.37 resize after the migration is not overwritten by the unchanged old key.
+    #[test]
+    fn a_0_37_resize_after_the_migration_is_kept() {
+        use super::remember_panel_state;
+        let ctx = Context::default();
+        let old = Id::unique("dock");
+        let new = panel_state_id(&ctx, "dock");
+        ctx.data_mut(|d| d.insert_persisted(old, state(410.0)));
+        migrate_panel_state(&ctx);
+        ctx.data_mut(|d| d.insert_persisted(new, state(290.0)));
+        remember_panel_state(&ctx);
+        ctx.data_mut(|d| d.insert_temp(Id::unique("photocraft-panel-state-migrated"), false));
+        migrate_panel_state(&ctx);
+        assert_eq!(PanelState::load(&ctx, new).map(|p| p.size().x), Some(290.0));
+    }
+}
diff --git a/crates/ui-egui/src/paths_scroll_tests.rs b/crates/ui-egui/src/paths_scroll_tests.rs
index 924e6e6290..f29f1943ed 100644
--- a/crates/ui-egui/src/paths_scroll_tests.rs
+++ b/crates/ui-egui/src/paths_scroll_tests.rs
@@ -43,6 +43,7 @@ fn scrolling_the_paths_list_does_not_move_the_footer() {
             // Down to the end of the list and past it, then back up.
             let dir = if i < 30 { -1.0 } else { 1.0 };
             h.event(egui::Event::MouseWheel {
+                source: egui::MouseWheelSource::Unknown,
                 unit: egui::MouseWheelUnit::Line,
                 delta: vec2(0.0, dir),
                 phase: egui::TouchPhase::Move,
diff --git a/crates/ui-egui/src/pattern_fill_ui.rs b/crates/ui-egui/src/pattern_fill_ui.rs
index 574a221367..33c7b3da3a 100644
--- a/crates/ui-egui/src/pattern_fill_ui.rs
+++ b/crates/ui-egui/src/pattern_fill_ui.rs
@@ -179,7 +179,7 @@ pub(crate) fn body(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, V
     let mut scale = num(f, "scale", 100.0);
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(tl!("Scale:")).color(Tokens::get(ui.ctx()).text_dim));
-        if crate::widgets::value_field(ui, &mut scale, min as f32..=max as f32, "%", 70.0).changed() {
+        if crate::widgets::value_field(ui, &mut scale, min as f32..=max as f32, "%", 70.0).accessible_name(tl!("Scale:")).changed() {
             f.insert("scale".into(), json!(scale.clamp(min as f32, max as f32)));
         }
     });
diff --git a/crates/ui-egui/src/pixel_grid.rs b/crates/ui-egui/src/pixel_grid.rs
index 4ec68ccae4..e7a565ae2a 100644
--- a/crates/ui-egui/src/pixel_grid.rs
+++ b/crates/ui-egui/src/pixel_grid.rs
@@ -176,9 +176,10 @@ pub fn paint(app: &mut PhotocraftApp, painter: &Painter, xf: &ViewXform, idx: us
         cache.grid = Some(GridLines::build(&doc, revision, preview_key, cache_region(visible, doc.bounds())));
     }
     let Some(grid) = &cache.grid else { return };
+    let width = 1.0 / painter.ctx().pixels_per_point();
     for s in &grid.segs {
         let (a, b) = (xf.to_screen(s.from[0] as f32, s.from[1] as f32), xf.to_screen(s.to[0] as f32, s.to[1] as f32));
-        painter.line_segment([a, b], Stroke::new(1.0, s.color));
+        painter.line_segment([a, b], Stroke::new(width, s.color));
     }
 }
 
diff --git a/crates/ui-egui/src/prefs_ui.rs b/crates/ui-egui/src/prefs_ui.rs
index 563c0023fd..68ebf5bd97 100644
--- a/crates/ui-egui/src/prefs_ui.rs
+++ b/crates/ui-egui/src/prefs_ui.rs
@@ -521,7 +521,9 @@ pub fn tick(app: &mut PhotocraftApp, ctx: &egui::Context) {
     sync_tooltips(app, ctx);
     sync_animations(app, ctx);
     app.sync_recent();
-    if let Some(wait) = persist(app, ctx.input(|i| i.time)) {
+    // Monotonic, not `ctx.input(|i| i.time)`: logic also runs on hidden ticks, where egui's input
+    // time is that of the last UI pass.
+    if let Some(wait) = persist(app, crate::gpu_canvas::now_ms() / 1000.0) {
         ctx.request_repaint_after(std::time::Duration::try_from_secs_f64(wait).unwrap_or_default());
     }
     let style = canvas_style(app);
@@ -707,8 +709,8 @@ fn link_updates(app: &mut PhotocraftApp, ctx: &egui::Context) {
         Some(Err(e)) => app.ui.status = e.to_string(),
         None => {}
     }
-    let (last_key, focus_key) = (egui::Id::new("linkWatch.lastScan"), egui::Id::new("linkWatch.focused"));
-    let now = ctx.input(|i| i.time);
+    let (last_key, focus_key) = (egui::Id::unique("linkWatch.lastScan"), egui::Id::unique("linkWatch.focused"));
+    let now = crate::gpu_canvas::now_ms() / 1000.0;
     let focused = ctx.input(|i| i.focused);
     let was_focused: bool = ctx.data(|d| d.get_temp(focus_key)).unwrap_or(focused);
     ctx.data_mut(|d| d.insert_temp(focus_key, focused));
@@ -1320,7 +1322,7 @@ fn choice_label(v: &str) -> String {
         "exr" => "EXR".into(),
         "cm" => "Centimeters".into(),
         "mm" => "Millimeters".into(),
-        "75" | "80" | "85" | "90" | "95" | "100" | "125" | "150" | "175" | "200" | "250" | "300" => format!("{v}%"),
+        "75" | "80" | "85" | "90" | "95" | "100" | "105" | "110" | "115" | "120" | "125" | "150" | "175" | "200" | "250" | "300" => format!("{v}%"),
         "8" => "8 Bits/Channel".into(),
         "16" => "16 Bits/Channel".into(),
         "postScript" => "PostScript (72 points/inch)".into(),
@@ -1339,10 +1341,10 @@ fn choice_label(v: &str) -> String {
 /// An editable `#rrggbb` field beside a colour swatch (#668): typing a valid value sets the
 /// colour; while it's being typed a partial value is kept, and it shows the colour otherwise.
 fn hex_field(ui: &mut egui::Ui, key: &str, rgb: &mut [u8; 3]) {
-    let id = egui::Id::new(("pref-hex", key));
+    let id = egui::Id::unique(("pref-hex", key));
     let shown = format!("#{:02x}{:02x}{:02x}", rgb[0], rgb[1], rgb[2]);
     let mut text = ui.data(|d| d.get_temp::<String>(id)).unwrap_or_else(|| shown.clone());
-    let r = crate::widgets::text_field_ex(ui, id, &mut text, "", 72.0, true, Some(7));
+    let r = crate::widgets::text_field_ex(ui, id, &mut text, "", 72.0, true, Some(7)).accessible_name(tl!("Color"));
     if r.changed()
         && let Some(c) = prefs::parse_hex(&text)
     {
@@ -1390,7 +1392,7 @@ fn prefs_body(ui: &mut egui::Ui, f: &mut Map<String, Value>, system: Option<egui
     // The dialog follows the language being edited, so a change shows before OK.
     let lang = crate::i18n::Lang::from_pref(values.pointer("/interface/language").and_then(Value::as_str).unwrap_or("auto"));
     let mut search = f.get("__search").and_then(Value::as_str).unwrap_or("").to_string();
-    crate::widgets::text_field(ui, ui.id().with("prefs-search"), &mut search, tl!("Search settings…"), ui.available_width(), false);
+    crate::widgets::text_field(ui, ui.scope_id().with("prefs-search"), &mut search, tl!("Search settings…"), ui.available_width(), false);
     let found = preference_sections(&values, &search);
     if !found.iter().any(|(id, _)| *id == section)
         && let Some((first, _)) = found.first()
@@ -1504,7 +1506,7 @@ fn gpu_status_rows(ui: &mut egui::Ui, info: Option<&Value>, adapters: Option<&Va
             let options = prefs::choices("performance.gpuBackend").unwrap_or(&[]);
             let labels: Vec<String> = options.iter().map(|o| choice_label(o)).collect();
             let pairs: Vec<(String, &str)> = options.iter().map(|o| o.to_string()).zip(labels.iter().map(String::as_str)).collect();
-            crate::widgets::dropdown(ui, "graphics-backend", &mut current, &pairs, 220.0);
+            crate::widgets::dropdown(ui, "graphics-backend", tl!("GPU Backend"), &mut current, &pairs, 220.0);
             obj.insert("gpuBackend".into(), json!(current));
         });
         if !prefs::is_hidden("performance.gpuAdapter") {
@@ -1532,7 +1534,7 @@ fn graphics_adapter_row(ui: &mut egui::Ui, adapters: Option<&Value>, obj: &mut M
     pairs.extend(names.iter().cloned().zip(labels.iter().map(String::as_str)));
     ui.horizontal(|ui| {
         ui.label(tl!("GPU adapter"));
-        crate::widgets::dropdown_literal(ui, "graphics-adapter", &mut current, &pairs, 320.0);
+        crate::widgets::dropdown_literal(ui, "graphics-adapter", tl!("GPU adapter"), &mut current, &pairs, 320.0);
     });
     ui.label(RichText::new(tl!("Applies at next launch.")).color(Tokens::get(ui.ctx()).text_faint));
     obj.insert("gpuAdapter".into(), json!(current));
@@ -1546,7 +1548,7 @@ fn rendering_mode_row(ui: &mut egui::Ui, obj: &mut Map<String, Value>) {
         let pairs =
             vec![("auto".to_string(), tl!("Automatic (recommended)")), ("gpu".to_string(), tl!("GPU")), ("cpu".to_string(), tl!("CPU / Compatibility"))];
         let previous = current.clone();
-        crate::widgets::dropdown(ui, "rendering-mode", &mut current, &pairs, 240.0);
+        crate::widgets::dropdown(ui, "rendering-mode", tl!("Rendering Mode"), &mut current, &pairs, 240.0);
         if current != previous {
             obj.insert("renderingMode".into(), json!(current));
             obj.insert("useGpu".into(), json!(current != "cpu"));
@@ -1615,7 +1617,7 @@ fn theme_swatch(ui: &mut egui::Ui, kind: ThemeKind, id: &str, selected: &mut Str
         egui::Stroke::new(1.0, t.card_border)
     };
     painter.rect_stroke(rect.shrink(1.0), 3.0, stroke, egui::StrokeKind::Inside);
-    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::RadioButton, true, on, &label));
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::RadioButton, true, on, &label));
     if resp.on_hover_text(&label).clicked() {
         *selected = id.to_string();
     }
@@ -1632,9 +1634,9 @@ fn theme_swatch(ui: &mut egui::Ui, kind: ThemeKind, id: &str, selected: &mut Str
     // Interact and paint without allocating: a widget placed at `badge` would grow the row by the
     // 4 px the badge overhangs the swatch, re-centring the swatches after this one whenever the
     // pointer arrives, and oscillating when that moves the swatch out from under it.
-    let response = ui.interact(badge, ui.id().with((id, "favorite")), Sense::click()).on_hover_text(action);
+    let response = ui.interact(badge, ui.scope_id().with((id, "favorite")), Sense::click()).on_hover_text(action);
     crate::icons::paint(ui, badge, icon, 10.0, tint);
-    response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, format!("{action}: {label}")));
+    response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, format!("{action}: {label}")));
     if response.clicked() {
         if favorite {
             favorites.retain(|saved| *saved != theme);
@@ -1690,7 +1692,7 @@ fn appearance_rows(ui: &mut egui::Ui, obj: &mut Map<String, Value>, system: Opti
         ui.label(RichText::new(tl!("Appearance Mode")).color(t.text_dim));
         let choices: [(String, &str); 3] = [("auto".into(), tl!("Sync with system")), ("dark".into(), tl!("Dark")), ("light".into(), tl!("Light"))];
         let pairs: Vec<(String, &str)> = choices.iter().map(|(id, label)| (id.clone(), *label)).collect();
-        crate::widgets::dropdown(ui, "appearance-mode", &mut mode, &pairs, 220.0);
+        crate::widgets::dropdown(ui, "appearance-mode", tl!("Appearance Mode"), &mut mode, &pairs, 220.0);
         ui.end_row();
     }
     let light_active = mode == "light" || (mode == "auto" && system == Some(egui::Theme::Light));
@@ -1766,7 +1768,7 @@ const PICK_ID: &str = "prefs-pick-color";
 
 /// The colour swatch clicked this frame, if any: (preference path, label).
 fn ctx_take_pick(ui: &egui::Ui) -> Option<(String, String)> {
-    ui.ctx().data_mut(|d| d.remove_temp::<(String, String)>(egui::Id::new(PICK_ID)))
+    ui.ctx().data_mut(|d| d.remove_temp::<(String, String)>(egui::Id::unique(PICK_ID)))
 }
 
 /// Whether `section.key` gets a generic row for this search (`query`, lowercased; empty matches
@@ -1823,8 +1825,8 @@ fn memory_usage_row(ui: &mut egui::Ui, obj: &mut Map<String, Value>) {
         ui.label(RichText::new(tl!("Memory Usage")).strong());
         let mut mb = obj.get("memoryUsageMb").and_then(Value::as_u64).unwrap_or(8192);
         ui.horizontal(|ui| {
-            ui.label(tl!("Per-document RAM limit (MB)"));
-            if ui.add(egui::DragValue::new(&mut mb).range(256..=1_048_576).suffix(" MB")).changed() {
+            let limit_label = ui.label(tl!("Per-document RAM limit (MB)"));
+            if ui.add(egui::DragValue::new(&mut mb).range(256..=1_048_576).suffix(" MB")).labelled_by(limit_label.id).changed() {
                 obj.insert("memoryUsageMb".into(), json!(mb));
             }
         });
@@ -1840,6 +1842,17 @@ fn memory_usage_row(ui: &mut egui::Ui, obj: &mut Map<String, Value>) {
     ui.add_space(8.0);
 }
 
+/// Settings read only when the app starts, which say "Applies at next launch." under their row.
+fn read_at_launch(path: &str) -> bool {
+    match path {
+        // Only Windows and Linux draw their own title bar.
+        "interface.systemTitleBar" => cfg!(all(not(target_arch = "wasm32"), not(target_os = "macos"))),
+        // The desktop app decides on the control server before its window opens.
+        "integrations.allowAgentControl" | "integrations.controlPort" => cfg!(not(target_arch = "wasm32")),
+        _ => false,
+    }
+}
+
 /// One grid row per setting in `keys` (already filtered by `field_visible`).
 fn field_rows(ui: &mut egui::Ui, section: &str, obj: &mut Map<String, Value>, keys: Vec<String>, lang: crate::i18n::Lang) {
     let t = Tokens::get(ui.ctx());
@@ -1852,7 +1865,7 @@ fn field_rows(ui: &mut egui::Ui, section: &str, obj: &mut Map<String, Value>, ke
             Value::Bool(b) => {
                 ui.label("");
                 let mut b = *b;
-                if path == "interface.systemTitleBar" && cfg!(all(not(target_arch = "wasm32"), not(target_os = "macos"))) {
+                if read_at_launch(&path) {
                     ui.vertical(|ui| {
                         crate::widgets::checkbox(ui, &mut b, &label);
                         ui.label(RichText::new(tl!("Applies at next launch.")).color(t.text_dim));
@@ -1867,7 +1880,7 @@ fn field_rows(ui: &mut egui::Ui, section: &str, obj: &mut Map<String, Value>, ke
                 let mut pairs: Vec<(String, &str)> = vec![("auto".into(), tl!("Auto"))];
                 pairs.extend(crate::i18n::Lang::for_picker().into_iter().map(|l| (l.code().to_string(), l.name())));
                 let mut cur = s.clone();
-                crate::widgets::dropdown(ui, &format!("pref-{path}"), &mut cur, &pairs, 220.0);
+                crate::widgets::dropdown(ui, &format!("pref-{path}"), tl!(&label), &mut cur, &pairs, 220.0);
                 obj.insert(k, json!(cur));
             }
             Value::String(s) if prefs::choices(&path).is_some() => {
@@ -1876,7 +1889,7 @@ fn field_rows(ui: &mut egui::Ui, section: &str, obj: &mut Map<String, Value>, ke
                 let labels: Vec<String> = opts.iter().map(|o| choice_label(o)).collect();
                 let pairs: Vec<(String, &str)> = opts.iter().map(|o| o.to_string()).zip(labels.iter().map(String::as_str)).collect();
                 let mut cur = s.clone();
-                crate::widgets::dropdown(ui, &format!("pref-{path}"), &mut cur, &pairs, 220.0);
+                crate::widgets::dropdown(ui, &format!("pref-{path}"), tl!(&label), &mut cur, &pairs, 220.0);
                 obj.insert(k, json!(cur));
             }
             Value::String(s) if prefs::is_color(&path) => {
@@ -1886,7 +1899,7 @@ fn field_rows(ui: &mut egui::Ui, section: &str, obj: &mut Map<String, Value>, ke
                 ui.horizontal(|ui| {
                     // PhotoCraft's Color Picker, as everywhere else (#2144).
                     if crate::widgets::color_swatch_button(ui, egui::Color32::from_rgb(rgb[0], rgb[1], rgb[2]), &label).clicked() {
-                        ui.ctx().data_mut(|d| d.insert_temp(egui::Id::new(PICK_ID), (path.clone(), label.clone())));
+                        ui.ctx().data_mut(|d| d.insert_temp(egui::Id::unique(PICK_ID), (path.clone(), label.clone())));
                     }
                     hex_field(ui, &path, &mut rgb);
                 });
@@ -1896,19 +1909,26 @@ fn field_rows(ui: &mut egui::Ui, section: &str, obj: &mut Map<String, Value>, ke
             Value::String(s) => {
                 ui.label(RichText::new(tl!(&label)).color(t.text_dim));
                 let mut s = s.clone();
-                ui.add(egui::TextEdit::singleline(&mut s).desired_width(260.0));
+                ui.add(egui::TextEdit::singleline(&mut s).desired_width(260.0)).accessible_name(tl!(&label));
                 obj.insert(k, json!(s));
             }
             Value::Number(n) => {
-                ui.label(RichText::new(tl!(&label)).color(t.text_dim));
+                let value_label = ui.label(RichText::new(tl!(&label)).color(t.text_dim));
                 let (lo, hi) = prefs::range(&path).unwrap_or((-1e9, 1e9));
                 if n.is_u64() || n.is_i64() {
                     let mut x = n.as_i64().unwrap_or(0);
-                    ui.add(egui::DragValue::new(&mut x).range(lo as i64..=hi as i64).custom_parser(crate::widgets::parse_num));
+                    ui.add(egui::DragValue::new(&mut x).range(lo as i64..=hi as i64).custom_parser(crate::widgets::parse_num)).labelled_by(value_label.id);
                     obj.insert(k, json!(x));
+                    // A row of its own, so the label stays level with its field.
+                    if read_at_launch(&path) {
+                        ui.end_row();
+                        ui.label("");
+                        ui.label(RichText::new(tl!("Applies at next launch.")).color(t.text_dim));
+                    }
                 } else {
                     let mut x = n.as_f64().unwrap_or(0.0);
-                    ui.add(egui::DragValue::new(&mut x).range(lo..=hi).speed(0.1).max_decimals(3).custom_parser(crate::widgets::parse_num));
+                    ui.add(egui::DragValue::new(&mut x).range(lo..=hi).speed(0.1).max_decimals(3).custom_parser(crate::widgets::parse_num))
+                        .labelled_by(value_label.id);
                     obj.insert(k, json!(x));
                 }
             }
@@ -1926,8 +1946,8 @@ fn field_rows(ui: &mut egui::Ui, section: &str, obj: &mut Map<String, Value>, ke
                         ui.horizontal(|ui| {
                             let mut on = d.get("enabled").and_then(Value::as_bool).unwrap_or(false);
                             let mut path = d.get("path").and_then(Value::as_str).unwrap_or("").to_string();
-                            crate::widgets::checkbox(ui, &mut on, "");
-                            ui.add(egui::TextEdit::singleline(&mut path).desired_width(240.0));
+                            crate::widgets::checkbox(ui, &mut on, tl!("Enabled"));
+                            ui.add(egui::TextEdit::singleline(&mut path).desired_width(240.0)).accessible_name(tl!("Path"));
                             *d = json!({"enabled": on, "path": path});
                         });
                     }
@@ -2135,7 +2155,8 @@ fn shortcuts_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String
                     _ => shown_label,
                 };
                 let sel = selected == *id;
-                if ui.selectable_label(sel, RichText::new(format!("   {name}")).color(t.text_dim)).clicked() {
+                let name_row = ui.selectable_label(sel, RichText::new(format!("   {name}")).color(t.text_dim));
+                if name_row.clicked() {
                     selected = id.clone();
                 }
                 if tab == 0 {
@@ -2148,6 +2169,8 @@ fn shortcuts_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String
                     let r = ui.add(
                         egui::Button::new(RichText::new(tl!(&text)).size(12.0).color(if changed { t.accent_text } else { t.text })).min_size(vec2(120.0, 18.0)),
                     );
+                    // An unassigned shortcut shows no text: name it by the command it binds.
+                    let r = if text.is_empty() { r.labelled_by(name_row.id) } else { r };
                     if r.clicked() {
                         selected = id.clone();
                         capture = true;
@@ -2187,7 +2210,7 @@ fn shortcuts_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String
                     let mut col = colors.get(id).cloned().unwrap_or_else(|| "none".into());
                     let opts: Vec<(String, &str)> =
                         ["none", "red", "orange", "yellow", "green", "blue", "violet", "gray"].iter().map(|c| (c.to_string(), *c)).collect();
-                    crate::widgets::dropdown(ui, &format!("menu-color-{id}"), &mut col, &opts, 90.0);
+                    crate::widgets::dropdown(ui, &format!("menu-color-{id}"), tl!("Color"), &mut col, &opts, 90.0);
                     if col == "none" {
                         colors.remove(id);
                     } else {
@@ -2368,7 +2391,7 @@ fn set_row(
         ui.label(tl!("Set:"));
         let mut chosen = active.clone();
         let pairs: Vec<(String, &str)> = names.iter().map(|(n, l)| (n.clone(), l.as_str())).collect();
-        if crate::widgets::dropdown(ui, "shortcut-set", &mut chosen, &pairs, 220.0) && chosen != active {
+        if crate::widgets::dropdown(ui, "shortcut-set", tl!("Set:"), &mut chosen, &pairs, 220.0) && chosen != active {
             // As `useSet`: the set's bindings, keeping the actions' F-keys.
             sets.get(&chosen).cloned().unwrap_or_default().apply(overrides, alternates);
             active = chosen;
@@ -2502,7 +2525,7 @@ fn presets_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String,
     ui.horizontal(|ui| {
         ui.label(RichText::new(tl!("Preset Type")).color(t.text_dim));
         let opts = [("brushes".to_string(), tl!("Brushes")), ("customShapes".to_string(), tl!("Custom Shapes")), ("patterns".to_string(), tl!("Patterns"))];
-        crate::widgets::dropdown(ui, "preset-kind", &mut kind, &opts, 180.0);
+        crate::widgets::dropdown(ui, "preset-kind", tl!("Type"), &mut kind, &opts, 180.0);
     });
     let list = app
         .session
@@ -2525,7 +2548,7 @@ fn presets_body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String,
     });
     let mut new_name = f.get("newName").and_then(Value::as_str).unwrap_or("").to_string();
     ui.horizontal(|ui| {
-        ui.add(egui::TextEdit::singleline(&mut new_name).desired_width(200.0));
+        ui.add(egui::TextEdit::singleline(&mut new_name).desired_width(200.0)).accessible_name(tl!("Name"));
         if ui.add_enabled(selected < list.len() && !new_name.trim().is_empty(), egui::Button::new(tl!("Rename"))).clicked() {
             let _ = app.run("edit.presets.presetManager", json!({"action": "rename", "kind": kind, "index": selected, "newName": new_name}));
         }
@@ -2550,6 +2573,7 @@ fn presets_io_body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
         crate::widgets::dropdown(
             ui,
             "presets-io",
+            tl!("Action"),
             &mut action,
             &[("export".to_string(), tl!("Export Presets")), ("import".to_string(), tl!("Import Presets"))],
             180.0,
@@ -3225,8 +3249,8 @@ mod tests {
             app
         });
         h.run_steps(4);
-        let language = h.get_by_label("Language").rect();
-        let dark = h.get_by_label("Dark Theme").rect();
+        let language = h.query_all_by_label("Language").next().expect("the Language row").rect();
+        let dark = h.query_all_by_label("Dark Theme").next().expect("the dark theme row").rect();
         let ok = h.get_by_label("OK").rect();
         assert!(dark.bottom() < language.top(), "Presentation {language:?} follows the theme swatches {dark:?}");
         assert!(language.bottom() < ok.top() - 20.0, "Language {language:?} must show above the buttons {ok:?} without scrolling");
@@ -3575,7 +3599,21 @@ mod tests {
             step(vec2(2560.0, 1440.0), 1.75, 1.75);
             step(vec2(3840.0, 2160.0), 1.0, 1.0);
         }
-        for (pref, expected) in [("200", 2.0), ("125", 1.25), ("150", 1.5), ("100", 1.0), ("95", 0.95), ("90", 0.9), ("85", 0.85), ("80", 0.8), ("auto", 1.5)] {
+        for (pref, expected) in [
+            ("200", 2.0),
+            ("125", 1.25),
+            ("150", 1.5),
+            ("100", 1.0),
+            ("105", 1.05),
+            ("110", 1.1),
+            ("115", 1.15),
+            ("120", 1.2),
+            ("95", 0.95),
+            ("90", 0.9),
+            ("85", 0.85),
+            ("80", 0.8),
+            ("auto", 1.5),
+        ] {
             app.run("prefs.set", json!({"values": {"interface.uiScale": pref}})).unwrap();
             let mut input = egui::RawInput::default();
             input.viewports.get_mut(&egui::ViewportId::ROOT).unwrap().native_pixels_per_point = Some(1.5);
@@ -3585,6 +3623,31 @@ mod tests {
         }
     }
 
+    #[test]
+    fn intermediate_ui_scale_choices_can_be_applied_from_preferences() {
+        use egui_kittest::{Harness, kittest::Queryable};
+        let (mut app, store) = app_with_store();
+        app.run("prefs.set", json!({"path": "interface.uiScale", "value": "100"})).unwrap();
+        open_preferences(&mut app, "interface");
+        let mut h = Harness::builder().with_size(vec2(1400.0, 1100.0)).build_eframe(move |cc| {
+            PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+            app
+        });
+        h.run_steps(4);
+        let mut current = "100%";
+        for (label, value) in [("105%", "105"), ("110%", "110"), ("115%", "115"), ("120%", "120")] {
+            h.get_by_value(current).click();
+            h.run_steps(2);
+            h.get_by_label(label).click();
+            h.run_steps(2);
+            h.get_by_label("Apply").click();
+            h.run_steps(4);
+            assert_eq!(h.state().session.prefs().interface.ui_scale.name(), value);
+            assert_eq!(stored(&store)["interface"]["uiScale"], value);
+            current = label;
+        }
+    }
+
     #[test]
     fn ui_font_size_commands_follow_themes_and_dpi_and_reset_live() {
         let (mut app, _) = app_with_store();
@@ -4089,10 +4152,12 @@ mod tests {
         let values = prefs::Preferences::default().to_json();
         assert!(has_visible_fields(&values, "general"));
         assert!(has_visible_fields(&values, "fileHandling"));
-        // Every setting of these sections is still unimplemented.
-        for section in ["integrations", "scratchDisks"] {
-            assert!(!has_visible_fields(&values, section), "{section}");
-        }
+        // Every setting of this section is still unimplemented.
+        assert!(!has_visible_fields(&values, "scratchDisks"), "scratchDisks");
+        // Allow Agent Control and Control Port are read at launch (apps/photocraft main.rs).
+        assert!(has_visible_fields(&values, "integrations"));
+        assert!(!prefs::is_hidden("integrations.allowAgentControl"));
+        assert!(!prefs::is_hidden("integrations.controlPort"));
         // "Fill new type layers with placeholder text" and "Use Escape to Commit" are live; other Type rows stay hidden.
         assert!(has_visible_fields(&values, "type"));
         assert!(!prefs::is_hidden("type.fillNewTypeLayersWithPlaceholder"));
@@ -4106,11 +4171,12 @@ mod tests {
         assert!(!prefs::is_hidden("enhancedControls.zoomWithTrackpadPinch"));
         assert!(!prefs::is_hidden("enhancedControls.touchGestures"));
         assert!(prefs::is_hidden("enhancedControls.scrubbySliderAcceleration"));
-        // Camera Raw Defaults shows "Open in Camera Raw" and the demosaic method so far.
+        // Camera Raw Defaults are all live: the dialog's Open applies them (camera_raw_ui).
         assert!(has_visible_fields(&values, "rawDefaults"));
-        assert!(!prefs::is_hidden("rawDefaults.openInCameraRaw"));
-        assert!(!prefs::is_hidden("rawDefaults.demosaic"));
-        assert!(prefs::is_hidden("rawDefaults.applyAutoTone"));
+        for k in ["openInCameraRaw", "demosaic", "applyAutoTone", "colorSpace", "bitDepth", "resolution", "sharpenFor", "openAsSmartObject", "writeXmpSidecars"]
+        {
+            assert!(!prefs::is_hidden(&format!("rawDefaults.{k}")), "{k}");
+        }
         assert!(!prefs::is_hidden("general.autoShowHomeScreen"));
         assert!(!prefs::is_hidden("general.animatedZoom"));
         assert!(!prefs::is_hidden("general.zoomResizesWindows"));
@@ -4325,8 +4391,8 @@ mod tests {
             obj,
         );
         h.run_steps(4);
-        h.get_by_label("Rendering Mode");
-        h.get_by_label("Applies at next launch.");
+        assert!(h.query_all_by_label("Rendering Mode").next().is_some(), "the Rendering Mode setting");
+        assert!(h.query_all_by_label("Applies at next launch.").next().is_some(), "its next-launch notice");
         // A search that leaves Rendering Mode out leaves its notice out too.
         let obj = json!({"renderingMode": "auto", "historyStates": 50}).as_object().unwrap().clone();
         let mut h = Harness::new_ui_state(
@@ -4337,6 +4403,20 @@ mod tests {
         assert!(h.query_by_label("Applies at next launch.").is_none());
     }
 
+    /// #4097: Allow Agent Control and Control Port are read when the app starts, and say so.
+    #[test]
+    fn integrations_explain_next_launch() {
+        use egui_kittest::{Harness, kittest::Queryable};
+        let obj = json!({"allowAgentControl": true, "controlPort": 0}).as_object().unwrap().clone();
+        let mut h = Harness::new_ui_state(
+            |ui, obj: &mut Map<String, Value>| section_fields(ui, "integrations", obj, &[], crate::i18n::Lang::from_pref("en"), None, ""),
+            obj,
+        );
+        h.run_steps(4);
+        h.get_by_label("Allow agent control");
+        assert_eq!(h.query_all_by_label("Applies at next launch.").count(), 2, "one notice under each row");
+    }
+
     #[test]
     fn next_launch_notice_does_not_mark_unrelated_interface_preferences() {
         use egui_kittest::{Harness, kittest::Queryable};
diff --git a/crates/ui-egui/src/preset_panels.rs b/crates/ui-egui/src/preset_panels.rs
index 49533350af..1542c914dd 100644
--- a/crates/ui-egui/src/preset_panels.rs
+++ b/crates/ui-egui/src/preset_panels.rs
@@ -176,7 +176,7 @@ pub(crate) fn run(app: &mut PhotocraftApp, id: &str, p: Value) -> Option<Value>
 // ------------------------------------------------------------------ textures
 
 fn cached_texture(ctx: &egui::Context, key: impl std::hash::Hash + std::fmt::Debug, make: impl FnOnce() -> ColorImage) -> TextureHandle {
-    let id = egui::Id::new(("preset-tex", key));
+    let id = egui::Id::unique(("preset-tex", key));
     if let Some(t) = ctx.data(|d| d.get_temp::<TextureHandle>(id)) {
         return t;
     }
@@ -258,7 +258,7 @@ pub(crate) fn pattern_picker(app: &PhotocraftApp, ui: &mut egui::Ui, selected: &
     ui.painter().rect_stroke(r, 0.0, Stroke::new(1.0, t.field_border), egui::StrokeKind::Outside);
     let name = current.map_or(String::new(), |p| p.display_name().to_string());
     let resp = resp.on_hover_text(&name);
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Patterns")));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Patterns")));
     let mut picked = None;
     egui::Popup::menu(&resp).show(|ui| {
         picked = pattern_grid(app, ui, selected);
@@ -283,7 +283,7 @@ pub(crate) fn pattern_grid(app: &PhotocraftApp, ui: &mut egui::Ui, selected: &st
             let (w, c) = if p.id == selected { (2.0, t.accent) } else { (1.0, t.field_border) };
             ui.painter().rect_stroke(r, 0.0, Stroke::new(w, c), egui::StrokeKind::Outside);
             let cell = cell.on_hover_text(p.display_name());
-            cell.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), p.display_name()));
+            cell.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), p.display_name()));
             if cell.clicked() {
                 picked = Some(p.id.clone());
                 ui.close();
@@ -378,8 +378,8 @@ pub(crate) fn browser(
     if let Some((p, key, mut text)) = st.renaming.clone().filter(|r| r.0 == panel) {
         let mut done = None;
         ui.horizontal(|ui| {
-            ui.label(egui::RichText::new(tl!("Name:")).color(t.text_dim).size(11.5));
-            let r = ui.add(egui::TextEdit::singleline(&mut text).desired_width(ui.available_width() - 4.0));
+            let name_label = ui.label(egui::RichText::new(tl!("Name:")).color(t.text_dim).size(11.5));
+            let r = ui.add(egui::TextEdit::singleline(&mut text).desired_width(ui.available_width() - 4.0)).labelled_by(name_label.id);
             if !r.has_focus() && !r.lost_focus() {
                 r.request_focus();
             }
@@ -408,7 +408,7 @@ pub(crate) fn browser(
     let display = st.display_order(panel, &group_names);
     // The footer stays in view: the list gets the height left after it (as measured last frame)
     // and scrolls, rather than pushing the footer out of a short dock group (#4790).
-    let footer_id = egui::Id::new(("preset-footer", panel));
+    let footer_id = egui::Id::unique(("preset-footer", panel));
     let footer_h = ui.data(|d| d.get_temp::<f32>(footer_id)).unwrap_or(FOOTER_GUESS);
     let max_h = max_h.min((ui.available_height() - footer_h).max(0.0));
     egui::ScrollArea::vertical().id_salt(("preset-scroll", panel)).max_height(max_h).min_scrolled_height(max_h.min(64.0)).auto_shrink([false, true]).show(
@@ -472,8 +472,8 @@ pub(crate) fn browser(
                 for (ii, it) in g.items.iter().enumerate() {
                     let (cx, cy) = ((ii % cols) as f32, (ii / cols) as f32);
                     let r = Rect::from_min_size(area.min + vec2(pad + cx * (cell.x + gap), cy * (cell.y + gap)), cell);
-                    let resp = ui.interact(r, ui.id().with((panel, gi, ii)), Sense::click_and_drag());
-                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &it.name));
+                    let resp = ui.interact(r, ui.scope_id().with((panel, gi, ii)), Sense::click_and_drag());
+                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &it.name));
                     let is_sel = selected.as_deref() == Some(&it.key);
                     if list {
                         if is_sel {
@@ -511,7 +511,7 @@ pub(crate) fn browser(
                         && let Some(pp) = ui.ctx().pointer_interact_pos()
                     {
                         // A ghost of the swatch follows the pointer.
-                        let lp = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("preset-drag")));
+                        let lp = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("preset-drag")));
                         let gr = Rect::from_center_size(pp, vec2(28.0, 28.0));
                         lp.rect_filled(gr, 3.0, t.card.gamma_multiply(0.8));
                         lp.rect_stroke(gr, 3.0, Stroke::new(1.0, t.accent), egui::StrokeKind::Outside);
@@ -567,7 +567,7 @@ pub(crate) fn browser(
         }
     }
     let recorded: Vec<(String, Rect)> = headers.iter().map(|(_, r, n)| (n.clone(), *r)).collect();
-    ui.ctx().data_mut(|d| d.insert_temp(egui::Id::new(("preset-group-headers", panel)), recorded));
+    ui.ctx().data_mut(|d| d.insert_temp(egui::Id::unique(("preset-group-headers", panel)), recorded));
     if let Some((key, pos)) = dropped {
         if let Some((_, _, g)) = headers.iter().find(|(_, r, _)| r.contains(pos)) {
             ev.push(Ev::Move(key, g.clone()));
@@ -581,7 +581,9 @@ pub(crate) fn browser(
     ui.horizontal(|ui| {
         ui.spacing_mut().item_spacing.x = 2.0;
         let mut s = size;
-        ui.add_sized(vec2(90.0, 18.0), egui::Slider::new(&mut s, MIN_THUMB..=96.0).show_value(false)).on_hover_text(tl!("Thumbnail size (smallest: list)"));
+        ui.add_sized(vec2(90.0, 18.0), egui::Slider::new(&mut s, MIN_THUMB..=96.0).show_value(false))
+            .accessible_name(tl!("Thumbnail size (smallest: list)"))
+            .on_hover_text(tl!("Thumbnail size (smallest: list)"));
         if (s - size).abs() > 0.01 {
             st.sizes.insert(panel.to_string(), s);
         }
@@ -623,7 +625,7 @@ fn group_drop_before(headers: &[(usize, Rect, String)], from: usize, y: f32) ->
 
 /// Folder header rects drawn last frame (name → rect), in display order; for tests and automation.
 pub fn last_group_headers(ctx: &egui::Context, panel: &str) -> Vec<(String, Rect)> {
-    ctx.data(|d| d.get_temp(egui::Id::new(("preset-group-headers", panel)))).unwrap_or_default()
+    ctx.data(|d| d.get_temp(egui::Id::unique(("preset-group-headers", panel)))).unwrap_or_default()
 }
 
 /// Shared handling of the generic events through `<prefix>.edit` / `.new`.
@@ -792,7 +794,7 @@ fn float_window(
     let canvas = canvas_drop_rect(app);
     let mut close = false;
     egui::Window::new(title)
-        .id(egui::Id::new(("preset-window", key)))
+        .id(egui::Id::unique(("preset-window", key)))
         .title_bar(false)
         .resizable(false)
         .frame(frame)
@@ -1139,8 +1141,8 @@ pub fn tool_presets_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     // Rename field.
     if let Some((_, key, mut text)) = app.ui.presets_ui.renaming.clone().filter(|r| r.0 == "toolPresets") {
         ui.horizontal(|ui| {
-            ui.label(egui::RichText::new(tl!("Name:")).color(t.text_dim).size(11.5));
-            let r = ui.add(egui::TextEdit::singleline(&mut text).desired_width(ui.available_width() - 4.0));
+            let name_label = ui.label(egui::RichText::new(tl!("Name:")).color(t.text_dim).size(11.5));
+            let r = ui.add(egui::TextEdit::singleline(&mut text).desired_width(ui.available_width() - 4.0)).labelled_by(name_label.id);
             if !r.has_focus() && !r.lost_focus() {
                 r.request_focus();
             }
@@ -1254,7 +1256,8 @@ pub fn clone_source_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     ui.label(egui::RichText::new(src_line).color(t.text_dim).size(11.0));
     ui.add_space(4.0);
     let lbl = |ui: &mut egui::Ui, s: &str| {
-        ui.add_sized(vec2(18.0, 18.0), egui::Label::new(egui::RichText::new(s).color(t.text_dim).size(11.5)));
+        let label = ui.add_sized(vec2(18.0, 18.0), egui::Label::new(egui::RichText::new(s).color(t.text_dim).size(11.5)));
+        crate::widgets::scrub_option_label(ui, &label);
     };
     let off = slot.offset().unwrap_or([0.0, 0.0]);
     let (mut ox, mut oy) = (off[0] as f32, off[1] as f32);
@@ -1316,14 +1319,14 @@ pub fn clone_source_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     ui.horizontal(|ui| {
         ui.add_space(18.0);
         ui.label(egui::RichText::new(tl!("Opacity:")).color(t.text_dim).size(11.5));
-        crate::widgets::value_field(ui, &mut o.opacity, 0.0..=100.0, "%", 56.0);
+        crate::widgets::value_field(ui, &mut o.opacity, 0.0..=100.0, "%", 56.0).accessible_name(tl!("Opacity:"));
         let opts = [
             ("normal".to_string(), tl!("Normal")),
             ("darken".to_string(), tl!("Darken")),
             ("lighten".to_string(), tl!("Lighten")),
             ("difference".to_string(), tl!("Difference")),
         ];
-        crate::widgets::dropdown(ui, "clone-overlay-mode", &mut o.blend, &opts, 90.0);
+        crate::widgets::dropdown(ui, "clone-overlay-mode", tl!("Blend Mode"), &mut o.blend, &opts, 90.0);
     });
     ui.horizontal(|ui| {
         ui.add_space(18.0);
diff --git a/crates/ui-egui/src/press_menu.rs b/crates/ui-egui/src/press_menu.rs
index 639060903c..787f55add8 100644
--- a/crates/ui-egui/src/press_menu.rs
+++ b/crates/ui-egui/src/press_menu.rs
@@ -7,7 +7,7 @@
 use egui::{Popup, PopupCloseBehavior, Response, SetOpenCommand, Ui};
 
 fn gesture_id() -> egui::Id {
-    egui::Id::new("press-menu-gesture")
+    egui::Id::unique("press-menu-gesture")
 }
 
 /// The popup whose button's press started the current press-drag gesture, if any. Several press
diff --git a/crates/ui-egui/src/pressure_curve_ui.rs b/crates/ui-egui/src/pressure_curve_ui.rs
index 0c8c5b7c4d..527a26a390 100644
--- a/crates/ui-egui/src/pressure_curve_ui.rs
+++ b/crates/ui-egui/src/pressure_curve_ui.rs
@@ -48,7 +48,7 @@ fn round2(x: f32) -> f64 {
 /// The editor. Returns the new value when the curve changed.
 pub(crate) fn editor(ui: &mut egui::Ui, value: &Value) -> Option<Value> {
     let mut points = points_of(value);
-    let changed = edit_points(ui, egui::Id::new(RECT_KEY), &mut points);
+    let changed = edit_points(ui, egui::Id::unique(RECT_KEY), &mut points);
     changed.then(|| value_of(&points))
 }
 
@@ -167,7 +167,7 @@ mod tests {
 
     /// The screen position of curve point `p` (the editor's square starts at the panel's origin).
     fn at(h: &Harness<'static, Value>, p: [f32; 2]) -> Pos2 {
-        let r: egui::Rect = h.ctx.data(|d| d.get_temp(egui::Id::new(RECT_KEY))).expect("the editor ran");
+        let r: egui::Rect = h.ctx.data(|d| d.get_temp(egui::Id::unique(RECT_KEY))).expect("the editor ran");
         pos2(r.left() + p[0] * r.width(), r.bottom() - p[1] * r.height())
     }
 
diff --git a/crates/ui-egui/src/profile_prompt_tests.rs b/crates/ui-egui/src/profile_prompt_tests.rs
index 1aa56eaac7..c8b35cd107 100644
--- a/crates/ui-egui/src/profile_prompt_tests.rs
+++ b/crates/ui-egui/src/profile_prompt_tests.rs
@@ -96,7 +96,7 @@ fn an_older_prompt_raised_in_front_gives_way_to_the_live_one() {
         open_together(&mut h, 3);
         let ok = live_button(&h, "OK");
         let oldest = h.state().ui.dialogs[0].id;
-        h.ctx.memory_mut(|m| m.areas_mut().move_to_top(egui::LayerId::new(egui::Order::Foreground, egui::Id::new(("dialog", oldest)))));
+        h.ctx.memory_mut(|m| m.areas_mut().move_to_top(egui::LayerId::new(egui::Order::Foreground, egui::Id::unique(("dialog", oldest)))));
         h.run_steps(4);
         // All three are the same size in the same place: a click there must reach the live one.
         for left in [2, 1, 0] {
diff --git a/crates/ui-egui/src/props_layout.rs b/crates/ui-egui/src/props_layout.rs
index ea67b3714d..8e4089890c 100644
--- a/crates/ui-egui/src/props_layout.rs
+++ b/crates/ui-egui/src/props_layout.rs
@@ -70,14 +70,14 @@ pub fn header(ui: &mut egui::Ui, layer: &Layer) {
         ui.painter().galley(pos2(r.right() - kind_w - 2.0, r.center().y - kind_g.size().y / 2.0), kind_g, t.text_faint);
     }
     let name = layer.name.clone();
-    resp.widget_info(move || egui::WidgetInfo::labeled(egui::WidgetType::Label, true, format!("{name} — {kind}")));
+    resp.widget_info(move || egui::WidgetInfo::labeled(egui::Role::Label, true, format!("{name} — {kind}")));
 }
 
 /// A collapsible section: a separator, then a chevron + title row. Returns whether it's open.
 /// Every Properties section uses this, so headers look and behave alike.
 pub fn section(ui: &mut egui::Ui, id: &str, title: &str) -> bool {
     let t = Tokens::get(ui.ctx());
-    let key = egui::Id::new(("props-section", id));
+    let key = egui::Id::unique(("props-section", id));
     let mut open = ui.data(|d| d.get_temp::<bool>(key)).unwrap_or(true);
     ui.add_space(theme::ROW_GAP);
     widgets::hairline(ui);
@@ -98,7 +98,7 @@ pub fn section(ui: &mut egui::Ui, id: &str, title: &str) -> bool {
         ui.data_mut(|d| d.insert_temp(key, open));
     }
     let label = title.to_string();
-    resp.widget_info(move || egui::WidgetInfo::selected(egui::WidgetType::CollapsingHeader, true, open, &label));
+    resp.widget_info(move || egui::WidgetInfo::selected(egui::Role::DisclosureTriangle, true, open, &label));
     record(ui.ctx(), title, r);
     if open {
         ui.add_space(theme::ROW_GAP / 2.0);
@@ -109,13 +109,16 @@ pub fn section(ui: &mut egui::Ui, id: &str, title: &str) -> bool {
 /// Section headers drawn this pass, top to bottom (title, rect), for tests and `ui.inspect`.
 pub fn sections_drawn(ctx: &egui::Context) -> Vec<(String, Rect)> {
     let pass = ctx.cumulative_pass_nr();
-    ctx.data(|d| d.get_temp::<(u64, Vec<(String, Rect)>)>(egui::Id::new("props-sections"))).filter(|(p, _)| *p + 1 >= pass).map(|(_, v)| v).unwrap_or_default()
+    ctx.data(|d| d.get_temp::<(u64, Vec<(String, Rect)>)>(egui::Id::unique("props-sections")))
+        .filter(|(p, _)| *p + 1 >= pass)
+        .map(|(_, v)| v)
+        .unwrap_or_default()
 }
 
 fn record(ctx: &egui::Context, title: &str, r: Rect) {
     let pass = ctx.cumulative_pass_nr();
     ctx.data_mut(|d| {
-        let e = d.get_temp_mut_or_default::<(u64, Vec<(String, Rect)>)>(egui::Id::new("props-sections"));
+        let e = d.get_temp_mut_or_default::<(u64, Vec<(String, Rect)>)>(egui::Id::unique("props-sections"));
         if e.0 != pass {
             *e = (pass, Vec::new());
         }
@@ -176,7 +179,7 @@ pub fn quick_actions_ui(app: &PhotocraftApp, ui: &mut egui::Ui, content: &LayerC
             ui.spacing_mut().item_spacing.x = COL_GAP;
             for (label, id) in row {
                 let resp = widgets::secondary_button(ui, label, w);
-                resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, *label));
+                resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, *label));
                 if resp.clicked() {
                     out = Some(*id);
                 }
diff --git a/crates/ui-egui/src/puppet_ui.rs b/crates/ui-egui/src/puppet_ui.rs
index 831c8bad37..cb390f77ad 100644
--- a/crates/ui-egui/src/puppet_ui.rs
+++ b/crates/ui-egui/src/puppet_ui.rs
@@ -404,6 +404,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     crate::widgets::dropdown(
         ui,
         "puppet-mode",
+        tl!("Mode:"),
         &mut s.warp.mode,
         &[(PuppetMode::Rigid, tl!("Rigid")), (PuppetMode::Normal, tl!("Normal")), (PuppetMode::Distort, tl!("Distort"))],
         90.0,
@@ -414,6 +415,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     crate::widgets::dropdown(
         ui,
         "puppet-density",
+        tl!("Density:"),
         &mut s.warp.density,
         &[(PuppetDensity::Fewer, tl!("Fewer Points")), (PuppetDensity::Normal, tl!("Normal")), (PuppetDensity::More, tl!("More Points"))],
         110.0,
@@ -422,7 +424,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     ui.label(tl!("Expansion:"));
     let expansion = s.warp.expansion;
     let mut e = s.warp.expansion as f32;
-    if crate::widgets::value_field(ui, &mut e, -50.0..=100.0, "px", 56.0).changed() {
+    if crate::widgets::value_field(ui, &mut e, -50.0..=100.0, "px", 56.0).accessible_name(tl!("Expansion:")).changed() {
         s.warp.expansion = f64::from(e);
         remesh = true;
     }
@@ -441,14 +443,14 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         ui.label(tl!("Rotate:"));
         let mut fixed = s.warp.pins[i].rotate.is_some();
         let was = fixed;
-        crate::widgets::dropdown(ui, "puppet-rotate", &mut fixed, &[(false, tl!("Auto")), (true, tl!("Fixed"))], 70.0);
+        crate::widgets::dropdown(ui, "puppet-rotate", tl!("Rotation"), &mut fixed, &[(false, tl!("Auto")), (true, tl!("Fixed"))], 70.0);
         if fixed != was {
             s.warp.pins[i].rotate = fixed.then_some(0.0);
             rebind = true;
         }
         if let Some(r) = s.warp.pins[i].rotate {
             let mut a = r as f32;
-            if crate::widgets::value_field(ui, &mut a, -360.0..=360.0, "°", 52.0).changed() {
+            if crate::widgets::value_field(ui, &mut a, -360.0..=360.0, "°", 52.0).accessible_name(tl!("Rotation")).changed() {
                 s.warp.pins[i].rotate = Some(f64::from(a));
                 resolve = true;
             }
diff --git a/crates/ui-egui/src/retouch_ui.rs b/crates/ui-egui/src/retouch_ui.rs
index 5ed59869de..db8bde9240 100644
--- a/crates/ui-egui/src/retouch_ui.rs
+++ b/crates/ui-egui/src/retouch_ui.rs
@@ -1,7 +1,7 @@
-//! UI for the retouching tools (healing, patch, clone, history brush, blur/sharpen/smudge,
-//! dodge/burn/sponge, Mixer Brush, Color Replacement) and the smart selection tools (Quick
-//! Selection, Object Selection): gesture → engine command, options bars, and the clone-source
-//! marker.
+//! UI for the retouching tools (healing, patch, clone, history brush, art history brush,
+//! blur/sharpen/smudge, dodge/burn/sponge, Mixer Brush, Color Replacement) and the smart
+//! selection tools (Quick Selection, Object Selection): gesture → engine command, options bars,
+//! and the clone-source marker.
 
 use egui::{Color32, Stroke, vec2};
 use serde_json::{Value, json};
@@ -27,7 +27,9 @@ pub(crate) fn alt_flipped(tool: Tool, alt: bool) -> Tool {
 /// point is set yet.
 pub(crate) fn clone_params(app: &PhotocraftApp) -> Option<Value> {
     let o = &app.ui.tool_options;
-    let mut p = json!({"aligned": o.clone_aligned, "sampleLayer": o.clone_sample});
+    // The options bar's Mode is the tool's own brush's.
+    let mode = crate::blend_keys::brush_tool_mode(app.ui.tool, app.session.tools.brush.mode);
+    let mut p = json!({"aligned": o.clone_aligned, "sampleLayer": o.clone_sample, "mode": mode.label()});
     if app.ui.tool == Tool::CloneStamp {
         p["wrap"] = json!(app.ui.view.pattern_preview);
         p["opacity"] = json!(app.session.tools.brush.opacity * 100.0);
@@ -45,6 +47,12 @@ pub(crate) fn clone_params(app: &PhotocraftApp) -> Option<Value> {
     Some(p)
 }
 
+/// History Brush params for the live preview and the commit (without `points` and `target`): the
+/// options bar's Mode, which is the tool's own brush's.
+pub(crate) fn history_brush_params(app: &PhotocraftApp) -> Value {
+    json!({"mode": app.session.tools.brush.mode.label()})
+}
+
 /// The command and options-bar params (without `points` and `target`) of a sequential-dab tool:
 /// Blur, Sharpen, Smudge, Dodge, Burn, Sponge. Shared by the live preview and the commit.
 pub(crate) fn dab_params(app: &PhotocraftApp, tool: Tool) -> Option<(&'static str, Value)> {
@@ -90,6 +98,8 @@ pub(crate) fn pattern_stamp_params(app: &PhotocraftApp, points: &[[f64; 3]]) ->
         "scale": o.pattern_stamp_scale,
         "angle": o.pattern_stamp_angle,
         "seed": stroke_seed(points),
+        // The options bar's Mode is the tool's own brush's.
+        "mode": app.session.tools.brush.mode.label(),
     });
     if o.pattern_stamp_aligned
         && let Some(ph) = app.ui.pattern_stamp_phase
@@ -141,7 +151,15 @@ pub fn finish_stroke(app: &mut PhotocraftApp, tool: Tool, points: &[[f64; 3]], m
             };
             (if tool == Tool::Healing { "paint.healingBrush" } else { "paint.cloneStamp" }, p)
         }
-        Tool::HistoryBrush => ("paint.historyBrush", json!({})),
+        Tool::HistoryBrush => ("paint.historyBrush", history_brush_params(app)),
+        Tool::ArtHistoryBrush => (
+            "paint.artHistoryBrush",
+            json!({
+                "style": o.art_history_style,
+                "area": o.art_history_area,
+                "tolerance": o.art_history_tolerance,
+            }),
+        ),
         Tool::Blur | Tool::Sharpen | Tool::Smudge | Tool::Dodge | Tool::Burn | Tool::Sponge => match dab_params(app, tool) {
             Some(cp) => cp,
             None => return false,
@@ -464,7 +482,9 @@ pub fn draw_source_marker(app: &PhotocraftApp, painter: &egui::Painter, xf: &Vie
 
 fn opt(ui: &mut egui::Ui, text: &str) {
     let t = Tokens::get(ui.ctx());
-    ui.label(egui::RichText::new(tl!(&text)).color(t.text_dim).size(12.0));
+    let label = ui.label(egui::RichText::new(tl!(&text)).color(t.text_dim).size(12.0));
+    // The caption scrubs and names the field or dropdown drawn right after it.
+    crate::widgets::scrub_option_label(ui, &label);
 }
 
 fn pct(ui: &mut egui::Ui, label: &str, v: &mut f32) {
@@ -517,7 +537,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
             opt(ui, tl!("Patch:"));
             let kinds = [("normal".to_string(), tl!("Normal")), ("contentAware".to_string(), tl!("Content-Aware"))];
             let mut kind = if o.patch_content_aware { "contentAware" } else { "normal" }.to_string();
-            crate::widgets::dropdown(ui, "patch-kind", &mut kind, &kinds, 120.0);
+            crate::widgets::dropdown(ui, "patch-kind", tl!("Type"), &mut kind, &kinds, 120.0);
             o.patch_content_aware = kind == "contentAware";
             if o.patch_content_aware {
                 opt(ui, tl!("Structure:"));
@@ -539,7 +559,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
         Tool::ContentAwareMove => {
             opt(ui, tl!("Mode:"));
             let modes = [("move".to_string(), tl!("Move")), ("extend".to_string(), tl!("Extend"))];
-            crate::widgets::dropdown(ui, "cam-mode", &mut o.cam_mode, &modes, 90.0);
+            crate::widgets::dropdown(ui, "cam-mode", tl!("Mode"), &mut o.cam_mode, &modes, 90.0);
             opt(ui, tl!("Structure:"));
             crate::widgets::value_field(ui, &mut o.cam_structure, 1.0..=7.0, "", 40.0);
             opt(ui, tl!("Color:"));
@@ -551,12 +571,12 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
                 // The box on the dropped patch: ✓ computes the move, ⊘ drops it (as ↩ / Esc).
                 let tip = crate::i18n::fmt(tl!("Commit transform ({key})"), &[("key", &crate::shortcuts::pretty("Enter"))]);
                 let commit = crate::icons::button(ui, "check", 26.0, false, &tip);
-                commit.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, "Commit transform"));
+                commit.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, "Commit transform"));
                 if commit.clicked() {
                     crate::cam_transform::commit(app);
                 }
                 let cancel = crate::icons::button(ui, "ban", 26.0, false, tl!("Cancel transform (Esc)"));
-                cancel.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, "Cancel transform"));
+                cancel.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, "Cancel transform"));
                 if cancel.clicked() {
                     crate::cam_transform::cancel(app);
                 }
@@ -575,7 +595,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
                 ("currentAndBelow".to_string(), tl!("Current & Below")),
                 ("all".to_string(), tl!("All Layers")),
             ];
-            crate::widgets::dropdown(ui, "clone-sample", &mut o.clone_sample, &opts, 130.0);
+            crate::widgets::dropdown(ui, "clone-sample", tl!("Source"), &mut o.clone_sample, &opts, 130.0);
             if app.ui.clone_source.is_none() {
                 crate::widgets::vline(ui, 22.0);
                 opt(ui, &crate::i18n::fmt(tl!("{key}-click to set the source"), &[("key", &crate::shortcuts::pretty("Alt"))]));
@@ -584,14 +604,14 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
         Tool::Dodge | Tool::Burn => {
             opt(ui, tl!("Range:"));
             let opts = [("shadows".to_string(), tl!("Shadows")), ("midtones".to_string(), tl!("Midtones")), ("highlights".to_string(), tl!("Highlights"))];
-            crate::widgets::dropdown(ui, "tone-range", &mut o.tone_range, &opts, 100.0);
+            crate::widgets::dropdown(ui, "tone-range", tl!("Range"), &mut o.tone_range, &opts, 100.0);
             pct(ui, tl!("Exposure:"), &mut o.exposure);
             crate::widgets::checkbox(ui, &mut o.protect_tones, tl!("Protect Tones"));
         }
         Tool::Sponge => {
             opt(ui, tl!("Mode:"));
             let opts = [("desaturate".to_string(), tl!("Desaturate")), ("saturate".to_string(), tl!("Saturate"))];
-            crate::widgets::dropdown(ui, "sponge-mode", &mut o.sponge_mode, &opts, 110.0);
+            crate::widgets::dropdown(ui, "sponge-mode", tl!("Mode"), &mut o.sponge_mode, &opts, 110.0);
             crate::widgets::checkbox(ui, &mut o.vibrance, tl!("Vibrance"));
         }
         Tool::Blur | Tool::Sharpen | Tool::Smudge => {
@@ -615,7 +635,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
                 ("color".to_string(), tl!("Color")),
                 ("luminosity".to_string(), tl!("Luminosity")),
             ];
-            crate::widgets::dropdown(ui, "color-replacement-mode", &mut o.cr_mode, &modes, 100.0);
+            crate::widgets::dropdown(ui, "color-replacement-mode", tl!("Mode"), &mut o.cr_mode, &modes, 100.0);
             crate::widgets::vline(ui, 22.0);
             ui.spacing_mut().item_spacing.x = 2.0;
             for (k, icon, tip) in [
@@ -635,12 +655,32 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
                 ("contiguous".to_string(), tl!("Contiguous")),
                 ("findEdges".to_string(), tl!("Find Edges")),
             ];
-            crate::widgets::dropdown(ui, "color-replacement-limits", &mut o.cr_limits, &limits, 110.0);
+            crate::widgets::dropdown(ui, "color-replacement-limits", tl!("Limits:"), &mut o.cr_limits, &limits, 110.0);
             opt(ui, tl!("Tolerance:"));
             crate::widgets::value_field(ui, &mut o.cr_tolerance, 0.0..=100.0, "%", 62.0);
             crate::widgets::checkbox(ui, &mut o.cr_anti_alias, tl!("Anti-alias"));
         }
         Tool::HistoryBrush => opt(ui, tl!("Paints from the History panel's source state")),
+        Tool::ArtHistoryBrush => {
+            opt(ui, tl!("Style"));
+            let styles = [
+                ("tightShort".to_string(), tl!("Tight Short")),
+                ("tightMedium".to_string(), tl!("Tight Medium")),
+                ("tightLong".to_string(), tl!("Tight Long")),
+                ("looseMedium".to_string(), tl!("Loose Medium")),
+                ("looseLong".to_string(), tl!("Loose Long")),
+                ("dab".to_string(), tl!("Dab")),
+                ("tightCurl".to_string(), tl!("Tight Curl")),
+                ("looseCurl".to_string(), tl!("Loose Curl")),
+            ];
+            crate::widgets::dropdown(ui, "art-history-style", tl!("Style"), &mut o.art_history_style, &styles, 130.0);
+            opt(ui, tl!("Area"));
+            crate::widgets::value_field(ui, &mut o.art_history_area, 0.0..=100.0, "", 50.0);
+            opt(ui, tl!("Tolerance"));
+            crate::widgets::value_field(ui, &mut o.art_history_tolerance, 0.0..=100.0, "", 50.0);
+            crate::widgets::vline(ui, 22.0);
+            opt(ui, tl!("Stylized dabs from a history state"));
+        }
         Tool::QuickSelection => {
             crate::widgets::checkbox(ui, &mut o.sample_all.quick_selection, tl!("Sample All Layers"));
             crate::widgets::checkbox(ui, &mut o.enhance_edge, tl!("Enhance Edge"));
@@ -687,7 +727,7 @@ fn pattern_stamp_options(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         ui.label(egui::RichText::new(tl!("No patterns")).color(Tokens::get(ui.ctx()).text_faint));
         false
     } else {
-        crate::widgets::dropdown(ui, "pattern-stamp-pat", &mut pat, &opts_ref, 140.0)
+        crate::widgets::dropdown(ui, "pattern-stamp-pat", tl!("Pattern"), &mut pat, &opts_ref, 140.0)
     };
     opt(ui, tl!("Scale"));
     crate::widgets::value_field(ui, &mut o.pattern_stamp_scale, 1.0..=1000.0, "%", 58.0);
@@ -799,6 +839,67 @@ mod tests {
         assert_eq!(params["flow"], 50.0);
     }
 
+    /// A Healing Brush whose brush holds a mode outside its menu (Overlay, restored with the tool
+    /// active, so no tool switch sees it) heals in Normal; the Clone Stamp keeps Overlay.
+    #[test]
+    fn healing_brush_heals_in_normal_with_a_mode_outside_its_menu() {
+        for (tool, want) in [(Tool::Healing, "Normal"), (Tool::CloneStamp, "Overlay")] {
+            let mut app = app();
+            app.ui.tool = tool;
+            crate::paint_mouse::sync_tool_brush(&mut app);
+            app.session.tools.brush.mode = photocraft_color::BlendMode::Overlay;
+            app.ui.clone_source = Some([10.0, 10.0]);
+            drag(&mut app, tool);
+            let (_, params) = app.session.journal.last().unwrap();
+            assert_eq!(params["mode"], want, "{tool:?}");
+        }
+    }
+
+    /// The options bar's Mode (each tool's own brush's) reaches the stamps', the History Brush's
+    /// and the Healing Brush's strokes, live and committed.
+    #[test]
+    fn retouch_mode_reaches_the_command() {
+        for (tool, cmd, mode) in [
+            (Tool::CloneStamp, "paint.cloneStamp", "Multiply"),
+            (Tool::Healing, "paint.healingBrush", "Luminosity"),
+            (Tool::HistoryBrush, "paint.historyBrush", "Screen"),
+            (Tool::PatternStamp, "paint.patternStamp", "Overlay"),
+        ] {
+            let mut app = app();
+            app.ui.tool = tool;
+            crate::paint_mouse::sync_tool_brush(&mut app);
+            app.run("tools.setBrush", json!({"brush": {"mode": mode}})).unwrap();
+            app.ui.clone_source = Some([10.0, 10.0]);
+            drag(&mut app, tool);
+            let (id, params) = app.session.journal.last().unwrap();
+            assert_eq!((id.as_str(), params["mode"].as_str()), (cmd, Some(mode)), "{tool:?}");
+        }
+    }
+
+    /// The Paint Bucket's Mode reaches the fill: Multiply darkens, Clear erases.
+    #[test]
+    fn paint_bucket_mode_reaches_the_fill() {
+        let mut app = app();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.ui.tool = Tool::PaintBucket;
+        app.session.tools.foreground = [0.5, 0.5, 0.5, 1.0];
+        let click = |app: &mut PhotocraftApp| {
+            let m = egui::Modifiers::NONE;
+            tool_event(app, ToolEvent::Down { x: 20.0, y: 20.0, pressure: 1.0 }, m);
+            tool_event(app, ToolEvent::Up { x: 20.0, y: 20.0 }, m);
+        };
+        click(&mut app);
+        app.session.tools.foreground = [1.0, 0.0, 0.0, 1.0];
+        app.ui.tool_options.bucket_blend_mode = photocraft_color::BlendMode::Multiply;
+        click(&mut app);
+        let px = active(&app).surface().unwrap().rgba(20, 20);
+        assert!((px[0] - 0.5).abs() < 0.02 && px[1] < 0.02, "multiplied: {px:?}");
+        app.ui.tool_options.bucket_clear = true;
+        click(&mut app);
+        assert_eq!(app.session.journal.last().unwrap().1["mode"], "clear");
+        assert!(active(&app).surface().unwrap().rgba(20, 20)[3] < 0.01, "cleared");
+    }
+
     #[test]
     fn clone_without_a_source_names_the_platform_modifier() {
         // Option-click on the Mac, Alt-click elsewhere (#251).
@@ -1377,4 +1478,50 @@ mod tests {
         assert!(!app.ui.status_error, "{}", app.ui.status);
         assert!(app.ui.clone_source.is_none());
     }
+
+    #[test]
+    fn art_history_is_in_the_y_flyout() {
+        let y = [Tool::HistoryBrush, Tool::ArtHistoryBrush];
+        assert_eq!(y[0], Tool::HistoryBrush);
+        assert_eq!(y[1], Tool::ArtHistoryBrush);
+        assert!(y.iter().all(|t| t.key() == 'Y'));
+        assert!(Tool::ArtHistoryBrush.is_brushlike());
+    }
+
+    #[test]
+    fn art_history_options_bar_defaults() {
+        use crate::theme::ThemeKind;
+        use egui::vec2;
+        use egui_kittest::kittest::Queryable;
+        let mut app = app();
+        app.ui.tool = Tool::ArtHistoryBrush;
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1400.0, 60.0)).build_ui_state(
+            |ui, app: &mut PhotocraftApp| {
+                if !ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
+                    return;
+                }
+                crate::panels::options_bar(app, ui);
+            },
+            app,
+        );
+        PhotocraftApp::setup_context(&h.ctx, ThemeKind::Studio);
+        h.run_steps(4);
+        h.get_by_label("Style");
+        h.get_by_label("Area");
+        h.get_by_label("Tolerance");
+        assert_eq!(h.state().ui.tool_options.art_history_style, "tightMedium");
+        assert_eq!(h.state().ui.tool_options.art_history_area, 50.0);
+        assert_eq!(h.state().ui.tool_options.art_history_tolerance, 0.0);
+    }
+
+    #[test]
+    fn art_history_stroke_runs_the_command() {
+        let mut app = app();
+        app.run("paint.pencil", json!({"points": [[0, 30], [100, 30]], "size": 20, "color": "#3060c0"})).unwrap();
+        app.ui.tool = Tool::ArtHistoryBrush;
+        app.ui.tool_options.art_history_style = "tightMedium".into();
+        app.ui.tool_options.art_history_tolerance = 0.0;
+        drag(&mut app, Tool::ArtHistoryBrush);
+        assert_eq!(app.session.journal.last().map(|(id, _)| id.as_str()), Some("paint.artHistoryBrush"));
+    }
 }
diff --git a/crates/ui-egui/src/rotate_view.rs b/crates/ui-egui/src/rotate_view.rs
index 5137b9d312..ddfabb1261 100644
--- a/crates/ui-egui/src/rotate_view.rs
+++ b/crates/ui-egui/src/rotate_view.rs
@@ -30,11 +30,11 @@ struct RotateDrag {
 }
 
 fn id() -> egui::Id {
-    egui::Id::new("pc-rotate-view-drag")
+    egui::Id::unique("pc-rotate-view-drag")
 }
 
 fn compass_id() -> egui::Id {
-    egui::Id::new("pc-rotate-view-compass")
+    egui::Id::unique("pc-rotate-view-compass")
 }
 
 /// Wrap `a` degrees into (−180, 180]. Non-finite values become 0 so a hostile angle never
diff --git a/crates/ui-egui/src/rulers.rs b/crates/ui-egui/src/rulers.rs
index b304de83ca..ccec19c4cb 100644
--- a/crates/ui-egui/src/rulers.rs
+++ b/crates/ui-egui/src/rulers.rs
@@ -506,7 +506,7 @@ pub fn draw_rulers(app: &mut PhotocraftApp, ui: &mut egui::Ui, full: Rect, xf: &
     for (r, vertical, salt) in [(top, false, "ruler-top"), (left, true, "ruler-left"), (corner, false, "ruler-corner")] {
         // Guides drag out of the top/left rulers and the zero point out of the corner; all three
         // sense clicks so the right-click unit menu opens anywhere on the ruler.
-        let resp = ui.interact(r, ui.id().with(salt), Sense::click_and_drag());
+        let resp = ui.interact(r, ui.scope_id().with(salt), Sense::click_and_drag());
         if salt == "ruler-corner" {
             corner_origin(app, ui, &resp, &p, xf, origin, ticks);
         } else if resp.hovered() {
@@ -896,14 +896,16 @@ mod tests {
         h.run_steps(1);
         for y in [40.0, 60.0, 75.0] {
             h.event(egui::Event::PointerMoved(canvas_at(&h, 200.0, y)));
-            h.run_steps(1);
+            // egui 0.37 lays an Area's contents out a pass after it is shown; step to the settled
+            // frame with the pointer still at `y` (readout included) rather than the first pass.
+            h.run_steps(2);
             let pos = h.state().guide_drag.map(|d| d.pos);
             assert_eq!(pos, Some(f64::from(y)), "the drag follows the pointer");
             assert!(h.query_by_label(&format!("{y} px")).is_some(), "readout at {y} in the same frame");
         }
         let up = canvas_at(&h, 200.0, 75.0);
         h.event(egui::Event::PointerButton { pos: up, button: egui::PointerButton::Primary, pressed: false, modifiers: egui::Modifiers::NONE });
-        h.run_steps(1);
+        h.run_steps(2);
         assert!(h.state().guide_drag.is_none());
         assert!(h.query_by_label("Y:").is_none(), "no readout in the frame that drops the guide");
         assert!(h.state().session.active().unwrap().doc.guides.horizontal.contains(&75.0), "the guide lands at y = 75");
diff --git a/crates/ui-egui/src/screen_picker.rs b/crates/ui-egui/src/screen_picker.rs
index f0c12e96cf..59e36636e6 100644
--- a/crates/ui-egui/src/screen_picker.rs
+++ b/crates/ui-egui/src/screen_picker.rs
@@ -105,7 +105,7 @@ struct Runtime {
 }
 type Shared = Arc<Mutex<Runtime>>;
 fn runtime(ctx: &Context) -> Shared {
-    let id = Id::new("screen-color-picker-runtime");
+    let id = Id::unique("screen-color-picker-runtime");
     ctx.data_mut(|d| {
         if let Some(r) = d.get_temp::<Shared>(id) {
             return r;
@@ -127,7 +127,7 @@ pub fn take(ctx: &Context, id: Id) -> Option<[f32; 3]> {
 /// Same action for full dialogs and compact swatches. Cancellation returns no change.
 pub fn button(ui: &mut egui::Ui, id: Id) -> Option<[f32; 3]> {
     let r = runtime(ui.ctx());
-    let available = ui.ctx().data(|d| d.get_temp::<bool>(Id::new("screen-color-picker-available"))).unwrap_or(false);
+    let available = ui.ctx().data(|d| d.get_temp::<bool>(Id::unique("screen-color-picker-available"))).unwrap_or(false);
     let mut state = lock(&r);
     let result = if state.completed.as_ref().is_some_and(|(owner, _)| *owner == id) { state.completed.take().map(|(_, rgb)| rgb) } else { None };
     let busy = state.owner.is_some() || state.request.is_some();
@@ -142,7 +142,7 @@ fn target(app: &PhotocraftApp) -> Target {
 }
 /// Poll before shortcuts. A changed editing target invalidates a pending pick.
 pub fn tick(app: &mut PhotocraftApp, ctx: &Context) -> bool {
-    ctx.data_mut(|d| d.insert_temp(Id::new("screen-color-picker-available"), app.services.screen_pick.is_some()));
+    ctx.data_mut(|d| d.insert_temp(Id::unique("screen-color-picker-available"), app.services.screen_pick.is_some()));
     let r = runtime(ctx);
     let mut s = lock(&r);
     if s.completed.is_some() && s.target != Some(target(app)) {
@@ -308,7 +308,7 @@ pub fn show(ctx: &Context) {
             // Once per picker window (`show` runs every frame, so a local flag would resend it):
             // raise it, and take the keyboard so Esc reaches the picker: a window shown later
             // isn't always given focus by the OS, and the picker covers the screen (#4291).
-            let raised = Id::new(("screen-picker-raised", ui.ctx().viewport_id()));
+            let raised = Id::unique(("screen-picker-raised", ui.ctx().viewport_id()));
             if !ui.ctx().data_mut(|d| std::mem::replace(d.get_temp_mut_or_default::<bool>(raised), true)) {
                 ui.ctx().send_viewport_cmd(egui::ViewportCommand::WindowLevel(egui::WindowLevel::AlwaysOnTop));
                 ui.ctx().send_viewport_cmd(egui::ViewportCommand::Focus);
@@ -337,7 +337,7 @@ fn frame(ui: &mut egui::Ui, shared: &Shared, image: &ScreenImage, texture: &egui
     egui::CentralPanel::default().frame(egui::Frame::NONE).show(ui, |ui| {
         let rect = ui.max_rect();
         ui.painter().image(texture.id(), rect, Rect::from_min_max(Pos2::ZERO, egui::pos2(1.0, 1.0)), Color32::WHITE);
-        let response = ui.interact(rect, ui.id().with("screen-sample"), Sense::click_and_drag());
+        let response = ui.interact(rect, ui.scope_id().with("screen-sample"), Sense::click_and_drag());
         ui.ctx().set_cursor_icon(egui::CursorIcon::Crosshair);
         let released = response.clicked() || response.drag_stopped();
         let pixel = ui.ctx().pointer_latest_pos().and_then(|pos| Some((pos, image.at(rect, pos)?)));
@@ -537,7 +537,7 @@ mod tests {
         let stop = cancelled.clone();
         let mut receiver = Some(rx);
         app.services.screen_pick = Some(Box::new(move |_| Pending { receiver: receiver.take().unwrap(), cancelled: stop.clone() }));
-        let owner = Id::new("test-destination");
+        let owner = Id::unique("test-destination");
         lock(&runtime(ctx)).request = Some(owner);
         assert!(tick(app, ctx));
         (owner, tx, cancelled)
@@ -553,7 +553,7 @@ mod tests {
             let (_tx, rx) = std::sync::mpsc::channel();
             Pending { receiver: rx, cancelled: Arc::new(std::sync::atomic::AtomicBool::new(false)) }
         }));
-        let owner = Id::new("queued");
+        let owner = Id::unique("queued");
         lock(&runtime(&ctx)).request = Some(owner);
         cancel(&ctx);
         assert!(!tick(&mut app, &ctx));
@@ -590,7 +590,7 @@ mod tests {
         let (id, tx, _) = queued(&mut app, &ctx);
         tx.send(Ok(Capture::Color(Some([0.25, 0.5, 1.0])))).unwrap();
         assert!(!tick(&mut app, &ctx));
-        assert_eq!(take(&ctx, Id::new("different-widget")), None);
+        assert_eq!(take(&ctx, Id::unique("different-widget")), None);
         assert_eq!(take(&ctx, id), Some([0.25, 0.5, 1.0]));
         assert_eq!(take(&ctx, id), None);
     }
diff --git a/crates/ui-egui/src/screenshot.rs b/crates/ui-egui/src/screenshot.rs
new file mode 100644
index 0000000000..20ea2975b8
--- /dev/null
+++ b/crates/ui-egui/src/screenshot.rs
@@ -0,0 +1,648 @@
+//! The control channel's `ui.screenshot`: bounded, cancelable capture requests.
+//!
+//! egui 0.37 removed `Event::Screenshot`/`UserData`; `ViewportCommand::Screenshot` now carries a
+//! one-shot callback that may run on an arbitrary thread. The shared `craft_ui::capture` slot is
+//! the only correlation primitive: it stores at most one image, validates it against a per-image
+//! byte bound, wakes the owning viewport, and makes a late result after cancellation or drop
+//! inert. This module owns everything the slot deliberately leaves to the application:
+//!
+//! - request identity (token, output path, reply), deadlines and settling policy;
+//! - the 4-request / 128 MiB-per-image / 256 MiB-aggregate admission budget, counted over
+//!   outstanding (issued, completed-but-undrained and unissued) requests. A request that arrives
+//!   before the first UI pass has recorded the geometry waits (bounded by the same count and
+//!   deadline) instead of failing, so a launch-and-capture client behaves as it did on 0.15;
+//! - the document/activation identity captured at admission, which is never rebound (the
+//!   revision is recorded for attribution only);
+//! - the capture geometry epoch recorded at issuance, so an image is only saved for the layout it
+//!   was actually rendered from. Any size, scale, zoom, texture-side or minimized change advances
+//!   the epoch, and an epoch advance between issuance and collection is a retry even when the
+//!   values change back;
+//! - a monotonic clock (`web_time::Instant`) for settling, retries and timeouts. Never
+//!   `ctx.input(|i| i.time)` (stale in `run_logic`) and never the wall clock (NTP can jump).
+//!
+//! Nothing here writes a file or encodes a PNG: completed images are handed back to the UI thread,
+//! which owns the automation writer ([`crate::control::save_screenshot_rgba`]).
+//!
+//! Issuance and the geometry epoch are UI-phase work ([`Captures::issue`] is called from
+//! `App::ui`); draining, admission and hidden-paint requests are logic work. A hidden `run_logic`
+//! tick never counts as a settling frame and never issues a capture.
+//!
+//! Limitation: an invisible same-size surface recreation (a backend swap that reports the same
+//! size, scale and zoom) cannot be observed from egui's input and is not detected here.
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use craft_ui::capture::CaptureSlot;
+use egui::{ColorImage, Context, ScreenshotCallback, ViewportId};
+use web_time::Instant;
+
+use crate::control::ControlResponse;
+
+/// At most this many requests may be outstanding at once (issued, completed, waiting for
+/// geometry or waiting to be issued).
+pub const MAX_PENDING: usize = 4;
+/// Largest single image the slot may retain, and the largest a request may reserve.
+pub const MAX_IMAGE_BYTES: usize = 128 * 1024 * 1024;
+/// Aggregate reserved bytes over every outstanding request.
+pub const MAX_TOTAL_BYTES: usize = 256 * 1024 * 1024;
+/// A request expires after this long, including retries and settling.
+pub const DEADLINE: Duration = Duration::from_secs(8);
+/// UI passes a request waits before it is issued, on top of the animation delay.
+pub const SETTLE_PASSES: u32 = 3;
+/// Retries after the layout/geometry changed while a capture was in flight.
+pub const MAX_RETRIES: u8 = 2;
+/// The base delay that lets modal/popup open-close animations finish.
+const BASE_SETTLE_MS: f64 = 60.0;
+
+/// The document identity a screenshot belongs to. Never rebound after admission.
+///
+/// `generation` is the session's monotonic active-document generation. It changes whenever a
+/// different document becomes active, including a switch away and back inside one pass, so an
+/// image is never attributed to a document the pass did not stably show.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct DocumentId {
+    pub document: u64,
+    pub revision: u64,
+    pub generation: u64,
+}
+
+impl DocumentId {
+    /// Request identity is the document, not its revision: an edit while a capture is in flight
+    /// must not throw the image away. The revision is recorded for attribution only.
+    pub fn same_document(self, other: Self) -> bool {
+        self.document == other.document
+    }
+
+    /// The same document in the same activation: an intervening switch away and back fails it.
+    pub fn same_activation(self, other: Self) -> bool {
+        self.same_document(other) && self.generation == other.generation
+    }
+}
+
+/// The viewport geometry an image is expected to have.
+///
+/// Position is deliberately absent: moving a window does not change the captured surface. Size,
+/// scale, zoom, the texture-side limit and the minimized state do.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct CaptureGeometry {
+    pub viewport: ViewportId,
+    pub logical_size: egui::Vec2,
+    pub pixels_per_point: f32,
+    pub zoom_factor: f32,
+    pub max_texture_side: usize,
+    pub minimized: bool,
+    pub document: Option<DocumentId>,
+}
+
+impl CaptureGeometry {
+    /// Current input/host viewport geometry. A full pass refreshes all input before logic;
+    /// run_logic refreshes viewport metadata while retaining the previous UI screen rectangle.
+    pub fn current(ctx: &Context, document: Option<DocumentId>) -> Self {
+        let (viewport, logical_size, minimized, native_scale) = ctx.input(|i| {
+            let size = i.viewport().inner_rect.map_or_else(|| i.viewport_rect().size(), |r| r.size());
+            (i.raw.viewport_id, size, i.viewport().minimized.unwrap_or(false), i.viewport().native_pixels_per_point)
+        });
+        Self {
+            viewport,
+            logical_size,
+            pixels_per_point: native_scale
+                .filter(|scale| scale.is_finite() && *scale > 0.0)
+                .map_or_else(|| ctx.pixels_per_point(), |scale| scale * ctx.zoom_factor()),
+            zoom_factor: ctx.zoom_factor(),
+            max_texture_side: ctx.input(|i| i.max_texture_side),
+            minimized,
+            document,
+        }
+    }
+
+    /// The identity compared for stale-image rejection. Window movement and the document identity
+    /// are separate concerns (the latter is compared exactly and never retried).
+    fn epoch_key(&self) -> EpochKey {
+        EpochKey {
+            viewport: self.viewport,
+            width: self.logical_size.x,
+            height: self.logical_size.y,
+            ppp: self.pixels_per_point,
+            zoom: self.zoom_factor,
+            max_texture_side: self.max_texture_side,
+            minimized: self.minimized,
+        }
+    }
+
+    /// The expected image size in pixels, from the logical size and the point scale.
+    ///
+    /// `None` for a degenerate viewport; a request is rejected before issuance rather than
+    /// guessing. A window larger than `max_texture_side` may be fitted by the renderer (E2), so
+    /// the size itself is not rejected here; [`check_image`] accepts a uniform fit bounded by
+    /// that texture side.
+    pub fn expected_pixels(&self) -> Option<[usize; 2]> {
+        let valid = |v: f32| v.is_finite() && v > 0.0;
+        if !valid(self.logical_size.x) || !valid(self.logical_size.y) || !valid(self.pixels_per_point) || !valid(self.zoom_factor) {
+            return None;
+        }
+        let w = (self.logical_size.x * self.pixels_per_point).round();
+        let h = (self.logical_size.y * self.pixels_per_point).round();
+        if w < 1.0 || h < 1.0 || w > usize::MAX as f32 || h > usize::MAX as f32 {
+            return None;
+        }
+        Some([w as usize, h as usize])
+    }
+
+    /// The retained bytes this geometry reserves, from checked arithmetic.
+    pub fn expected_bytes(&self) -> Option<usize> {
+        let [w, h] = self.expected_pixels()?;
+        w.checked_mul(h)?.checked_mul(std::mem::size_of::<egui::Color32>())
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+struct EpochKey {
+    viewport: ViewportId,
+    width: f32,
+    height: f32,
+    ppp: f32,
+    zoom: f32,
+    max_texture_side: usize,
+    minimized: bool,
+}
+
+/// One request that arrived before a UI pass had recorded the window geometry. It is admitted on
+/// the first logic tick after that pass, within the same count/deadline budget.
+struct WaitingAdmit {
+    token: u64,
+    path: Option<String>,
+    reply: std::sync::mpsc::Sender<ControlResponse>,
+    document: Option<DocumentId>,
+    settle_ms: f64,
+    arrived: Instant,
+    deadline: Instant,
+}
+
+/// One outstanding request. The record is app-owned and holds the strong slot; the screenshot
+/// callback only holds a weak reference to the slot's state.
+pub struct PendingCapture {
+    token: u64,
+    path: Option<String>,
+    reply: Option<std::sync::mpsc::Sender<ControlResponse>>,
+    deadline: Instant,
+    ready_at: Instant,
+    settle_passes: u32,
+    geometry: CaptureGeometry,
+    /// Geometry epoch of `geometry`: at admission, and again whenever it is finalized after a
+    /// layout change. Issuance restarts settling when it differs from the current epoch.
+    epoch: u64,
+    /// Epoch of the UI pass the capture command was issued from. A later advance is a retry.
+    issued_epoch: Option<u64>,
+    reserved_bytes: usize,
+    document: Option<DocumentId>,
+    issued: bool,
+    slot: Option<CaptureSlot>,
+    retries: u8,
+}
+
+impl PendingCapture {
+    pub fn token(&self) -> u64 {
+        self.token
+    }
+
+    pub fn issued(&self) -> bool {
+        self.issued
+    }
+}
+
+impl core::fmt::Debug for PendingCapture {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        f.debug_struct("PendingCapture")
+            .field("token", &self.token)
+            .field("issued", &self.issued)
+            .field("retries", &self.retries)
+            .field("epoch", &self.epoch)
+            .field("issued_epoch", &self.issued_epoch)
+            .finish_non_exhaustive()
+    }
+}
+
+/// A request that is over: saved-and-replied by the caller, or failed with `result`.
+pub struct Finished {
+    pub token: u64,
+    pub path: Option<String>,
+    pub reply: Option<std::sync::mpsc::Sender<ControlResponse>>,
+    pub result: Result<Arc<ColorImage>, String>,
+}
+
+impl core::fmt::Debug for Finished {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        f.debug_struct("Finished").field("token", &self.token).field("path", &self.path).field("ok", &self.result.is_ok()).finish_non_exhaustive()
+    }
+}
+
+/// The screenshot request queue and its admission budget.
+#[derive(Default)]
+pub struct Captures {
+    records: Vec<PendingCapture>,
+    /// Arrived before the first UI pass recorded the geometry.
+    waiting: Vec<WaitingAdmit>,
+    geometry: Option<CaptureGeometry>,
+    epoch: u64,
+}
+
+impl Captures {
+    /// Every outstanding request, including ones still waiting for the first UI pass.
+    pub fn pending(&self) -> usize {
+        self.records.len().saturating_add(self.waiting.len())
+    }
+
+    pub fn reserved_bytes(&self) -> usize {
+        self.records.iter().map(|r| r.reserved_bytes).sum()
+    }
+
+    pub fn any_pending(&self) -> bool {
+        !self.records.is_empty() || !self.waiting.is_empty()
+    }
+
+    /// Requests still waiting to be issued; only these need `RequestPaintWhileHidden` from logic
+    /// (an issued capture's own `Screenshot` command forces its paint).
+    pub fn any_unissued(&self) -> bool {
+        !self.waiting.is_empty() || self.records.iter().any(|r| !r.issued)
+    }
+
+    pub fn last_geometry(&self) -> Option<CaptureGeometry> {
+        self.geometry
+    }
+
+    /// Observe host/input geometry before callback delivery or UI issuance. This may advance the
+    /// epoch in logic, but never counts a settling pass: only App::ui calls note_pass.
+    pub fn note_geometry(&mut self, geometry: CaptureGeometry) -> u64 {
+        let changed = self.geometry.is_none_or(|old| old.epoch_key() != geometry.epoch_key());
+        if changed {
+            self.epoch = self.epoch.wrapping_add(1);
+        }
+        self.geometry = Some(geometry);
+        self.epoch
+    }
+
+    /// Admit a request before it is issued. The queue must have been drained first, so completed
+    /// images have already released their budget. With no UI pass yet (a launch-and-capture
+    /// client) the request is parked within the same count and deadline budget.
+    pub fn admit(
+        &mut self,
+        token: u64,
+        path: Option<String>,
+        reply: std::sync::mpsc::Sender<ControlResponse>,
+        document: Option<DocumentId>,
+        settle_ms: f64,
+        now: Instant,
+    ) -> Result<(), (std::sync::mpsc::Sender<ControlResponse>, String)> {
+        let reject = |reply: std::sync::mpsc::Sender<ControlResponse>, e: String| Err((reply, e));
+        if self.records.iter().any(|r| r.token == token) || self.waiting.iter().any(|w| w.token == token) {
+            return reject(reply, format!("screenshot token {token} is already pending"));
+        }
+        if self.pending() >= MAX_PENDING {
+            return reject(reply, format!("too many screenshots pending (at most {MAX_PENDING})"));
+        }
+        if self.geometry.is_none() {
+            self.waiting.push(WaitingAdmit { token, path, reply, document, settle_ms, arrived: now, deadline: now + DEADLINE });
+            return Ok(());
+        }
+        self.admit_with_geometry(token, path, reply, document, settle_ms, now)
+    }
+
+    /// Admit requests parked before the first UI pass, once the geometry is known. Called from
+    /// logic before `drain` processes completions; expired parked requests get their error here.
+    pub fn admit_waiting(&mut self, now: Instant) {
+        if self.waiting.is_empty() {
+            return;
+        }
+        let parked = std::mem::take(&mut self.waiting);
+        let mut still_waiting = Vec::new();
+        for w in parked {
+            if now >= w.deadline {
+                let _ = w.reply.send(serde_json::json!({"ok": false, "error": timeout_error(w.token)}));
+                continue;
+            }
+            if self.geometry.is_none() {
+                still_waiting.push(w);
+                continue;
+            }
+            if let Err((reply, e)) = self.admit_with_geometry(w.token, w.path, w.reply, w.document, w.settle_ms, w.arrived) {
+                let _ = reply.send(serde_json::json!({"ok": false, "error": e}));
+            }
+        }
+        self.waiting = still_waiting;
+    }
+
+    fn admit_with_geometry(
+        &mut self,
+        token: u64,
+        path: Option<String>,
+        reply: std::sync::mpsc::Sender<ControlResponse>,
+        document: Option<DocumentId>,
+        settle_ms: f64,
+        now: Instant,
+    ) -> Result<(), (std::sync::mpsc::Sender<ControlResponse>, String)> {
+        // The reply is returned on every rejection so the caller can still answer exactly once.
+        let reject = |reply: std::sync::mpsc::Sender<ControlResponse>, e: String| Err((reply, e));
+        if self.records.iter().any(|r| r.token == token) {
+            return reject(reply, format!("screenshot token {token} is already pending"));
+        }
+        if self.records.len() >= MAX_PENDING {
+            return reject(reply, format!("too many screenshots pending (at most {MAX_PENDING})"));
+        }
+        let Some(geometry) = self.geometry else {
+            return reject(reply, "the window geometry is not known yet; try again after a frame has been drawn".into());
+        };
+        let expected = match image_budget(&geometry) {
+            Ok(bytes) => bytes,
+            Err(e) => return reject(reply, e),
+        };
+        if let Err(e) = aggregate_budget(self.reserved_bytes(), expected) {
+            return reject(reply, e);
+        }
+        // `Duration::from_secs_f64` panics on NaN/inf/negative: never trust a style value here.
+        let settle = if settle_ms.is_finite() { settle_ms.clamp(0.0, 2000.0) } else { BASE_SETTLE_MS };
+        self.records.push(PendingCapture {
+            token,
+            path,
+            reply: Some(reply),
+            deadline: now + DEADLINE,
+            ready_at: now + Duration::from_secs_f64(settle / 1000.0),
+            settle_passes: 0,
+            geometry,
+            epoch: self.epoch,
+            issued_epoch: None,
+            reserved_bytes: expected,
+            document,
+            issued: false,
+            slot: None,
+            retries: 0,
+        });
+        Ok(())
+    }
+
+    /// Count one UI pass towards settling (logic-only ticks never call this).
+    pub fn note_pass(&mut self) {
+        for r in &mut self.records {
+            r.settle_passes = r.settle_passes.saturating_add(1);
+        }
+    }
+
+    /// Issue every due request. Call from `App::ui`; `send` installs the callback with
+    /// `ViewportCommand::Screenshot`. A headless test can capture the callbacks instead.
+    pub fn issue(&mut self, ctx: &Context, now: Instant, document: Option<DocumentId>, mut send: impl FnMut(ScreenshotCallback)) -> Vec<Finished> {
+        let mut finished = Vec::new();
+        let Some(current) = self.geometry else { return finished };
+        // The pass's start and end must show the same active document: a switch inside the pass
+        // means neither the drawn frame nor the pass's document identity is trustworthy.
+        let pass_changed = !same_activation(current.document, document);
+        for i in 0..self.records.len() {
+            if self.records[i].issued {
+                continue;
+            }
+            let token = self.records[i].token;
+            if now >= self.records[i].deadline {
+                finished.push(finish(&mut self.records[i], Err(timeout_error(token))));
+                continue;
+            }
+            if !same_activation(document, self.records[i].document) || !same_activation(current.document, self.records[i].document) {
+                finished.push(finish(&mut self.records[i], Err(document_changed_error(token))));
+                continue;
+            }
+            if pass_changed {
+                continue;
+            }
+            // A minimized window has no surface to read back; fail with an actionable error
+            // instead of waiting for the 8 s timeout.
+            if current.minimized {
+                finished.push(finish(&mut self.records[i], Err(format!("screenshot {token} failed: the window is minimized"))));
+                continue;
+            }
+            if self.records[i].settle_passes < SETTLE_PASSES || now < self.records[i].ready_at {
+                continue;
+            }
+            // No pixels exist yet: finalize the geometry at issuance, re-checking the budget, and
+            // let the new layout settle for another pass.
+            if self.records[i].epoch != self.epoch || current.epoch_key() != self.records[i].geometry.epoch_key() {
+                let others: usize = self.records.iter().enumerate().filter(|(j, _)| *j != i).map(|(_, r)| r.reserved_bytes).sum();
+                let epoch = self.epoch;
+                match revalidate_reservation(&mut self.records[i], others, current, epoch) {
+                    Ok(()) => {}
+                    Err(e) => finished.push(finish(&mut self.records[i], Err(e))),
+                }
+                continue;
+            }
+            let (slot, callback) = CaptureSlot::new(ctx, current.viewport, MAX_IMAGE_BYTES);
+            let r = &mut self.records[i];
+            r.slot = Some(slot);
+            r.issued = true;
+            r.issued_epoch = Some(self.epoch);
+            send(callback);
+        }
+        self.records.retain(|r| !finished.iter().any(|f| f.token == r.token));
+        finished
+    }
+
+    /// Collect completed requests and enforce deadlines. Call from logic. The deadline is checked
+    /// before a completed image is saved, so a callback that arrives late is a timeout, not a
+    /// successful capture.
+    pub fn drain(&mut self, now: Instant, current: Option<CaptureGeometry>, document: Option<DocumentId>) -> Vec<Finished> {
+        // Requests that arrived before the first UI pass start here, once its geometry is known.
+        self.admit_waiting(now);
+        let mut finished = Vec::new();
+        for i in 0..self.records.len() {
+            let token = self.records[i].token;
+            if now >= self.records[i].deadline {
+                if let Some(slot) = self.records[i].slot.take() {
+                    slot.cancel();
+                }
+                finished.push(finish(&mut self.records[i], Err(timeout_error(token))));
+                continue;
+            }
+            if !same_activation(document, self.records[i].document) || !same_activation(current.and_then(|c| c.document), self.records[i].document) {
+                if let Some(slot) = self.records[i].slot.take() {
+                    slot.cancel();
+                }
+                finished.push(finish(&mut self.records[i], Err(document_changed_error(token))));
+                continue;
+            }
+            let Some(slot) = self.records[i].slot.take() else { continue };
+            let Some(result) = slot.take() else {
+                // Still in flight: keep the live request (and its strong slot) in the record.
+                self.records[i].slot = Some(slot);
+                continue;
+            };
+            let image = match result {
+                Ok(image) => image,
+                Err(e) => {
+                    slot.cancel();
+                    finished.push(finish(&mut self.records[i], Err(format!("screenshot {token} failed: {e}"))));
+                    continue;
+                }
+            };
+            let Some(current) = current else {
+                finished.push(finish(&mut self.records[i], Err(format!("screenshot {token} failed: the window geometry is unknown"))));
+                continue;
+            };
+            // An epoch advance means the surface changed after issuance, even if it later came
+            // back to the same values: the image may belong to the intermediate layout.
+            let epoch_advanced = self.records[i].issued_epoch.is_none_or(|issued| issued != self.epoch);
+            let pass_mixed = !same_activation(current.document, document);
+            if epoch_advanced || current.epoch_key() != self.records[i].geometry.epoch_key() || pass_mixed {
+                slot.cancel();
+                if self.records[i].retries >= MAX_RETRIES {
+                    finished.push(finish(&mut self.records[i], Err(format!("screenshot {token} failed: the layout changed while it was captured"))));
+                    continue;
+                }
+                self.records[i].retries = self.records[i].retries.saturating_add(1);
+                let others: usize = self.records.iter().enumerate().filter(|(j, _)| *j != i).map(|(_, r)| r.reserved_bytes).sum();
+                let epoch = self.epoch;
+                match revalidate_reservation(&mut self.records[i], others, current, epoch) {
+                    Ok(()) => {
+                        self.records[i].ready_at = now;
+                    }
+                    Err(e) => finished.push(finish(&mut self.records[i], Err(e))),
+                }
+                continue;
+            }
+            if let Err(e) = check_image(&image, &self.records[i].geometry) {
+                finished.push(finish(&mut self.records[i], Err(format!("screenshot {token} failed: {e}"))));
+                continue;
+            }
+            slot.cancel();
+            finished.push(finish(&mut self.records[i], Ok(image)));
+        }
+        self.records.retain(|r| !finished.iter().any(|f| f.token == r.token));
+        finished
+    }
+
+    /// Drop every outstanding request (application exit). No reply is invented for a request that
+    /// was already finished; `Finished` still carries the sender so the caller can report it.
+    pub fn cancel_all(&mut self, reason: &str) -> Vec<Finished> {
+        let mut finished = Vec::new();
+        for w in self.waiting.drain(..) {
+            finished.push(Finished { token: w.token, path: w.path, reply: Some(w.reply), result: Err(format!("screenshot {} cancelled: {reason}", w.token)) });
+        }
+        for mut r in self.records.drain(..) {
+            if let Some(slot) = r.slot.take() {
+                slot.cancel();
+            }
+            finished.push(Finished {
+                token: r.token,
+                path: r.path.take(),
+                reply: r.reply.take(),
+                result: Err(format!("screenshot {} cancelled: {reason}", r.token)),
+            });
+        }
+        finished
+    }
+}
+
+/// The retained bytes a geometry may reserve, or the reason it cannot be captured at all.
+fn image_budget(geometry: &CaptureGeometry) -> Result<usize, String> {
+    let Some(expected) = geometry.expected_bytes() else {
+        return Err(format!(
+            "the viewport is not capturable ({}×{} points at {} px/pt, texture side {})",
+            geometry.logical_size.x, geometry.logical_size.y, geometry.pixels_per_point, geometry.max_texture_side
+        ));
+    };
+    if expected > MAX_IMAGE_BYTES {
+        return Err(format!("a {} MiB screenshot is over the {} MiB per-image limit", expected / (1 << 20), MAX_IMAGE_BYTES / (1 << 20)));
+    }
+    Ok(expected)
+}
+
+/// Check one new reservation against the aggregate budget, excluding the request itself.
+fn aggregate_budget(others: usize, expected: usize) -> Result<(), String> {
+    let total = others.saturating_add(expected);
+    if total > MAX_TOTAL_BYTES {
+        return Err(format!("screenshot budget exhausted: {total} bytes reserved of a {MAX_TOTAL_BYTES}-byte aggregate limit"));
+    }
+    Ok(())
+}
+
+/// Finalize a request at a new geometry: recheck per-image and aggregate limits (excluding its
+/// old reservation), then take the new reservation and restart settling.
+fn revalidate_reservation(r: &mut PendingCapture, others: usize, geometry: CaptureGeometry, epoch: u64) -> Result<(), String> {
+    let expected = image_budget(&geometry)?;
+    aggregate_budget(others, expected)?;
+    r.reserved_bytes = expected;
+    r.geometry = geometry;
+    r.epoch = epoch;
+    r.issued_epoch = None;
+    r.issued = false;
+    r.settle_passes = 0;
+    Ok(())
+}
+
+fn finish(r: &mut PendingCapture, result: Result<Arc<ColorImage>, String>) -> Finished {
+    if let Some(slot) = r.slot.take() {
+        slot.cancel();
+    }
+    Finished { token: r.token, path: r.path.take(), reply: r.reply.take(), result }
+}
+
+/// The returned image must be the issued viewport (within a pixel) or a uniform renderer fit
+/// bounded by `max_texture_side` (E2). An arbitrarily smaller same-aspect image is not accepted:
+/// it could be a stale or downscaled surface, not the frame that was asked for. A different
+/// aspect ratio is a resize/recreation and must not be labelled with the old geometry.
+fn check_image(image: &ColorImage, geometry: &CaptureGeometry) -> Result<(), String> {
+    let Some([w, h]) = geometry.expected_pixels() else {
+        return Err("the captured geometry has no valid pixel size".into());
+    };
+    let [iw, ih] = image.size;
+    if iw == 0 || ih == 0 {
+        return Err("the image has a zero side".into());
+    }
+    if iw > w.saturating_add(1) || ih > h.saturating_add(1) {
+        return Err(format!("the image is {iw}×{ih}, larger than the issued viewport {w}×{h}"));
+    }
+    let close = |a: usize, b: usize| a.abs_diff(b) <= 1;
+    if close(iw, w) && close(ih, h) {
+        return Ok(());
+    }
+    let side = geometry.max_texture_side.max(1);
+    let fit = (side as f64 / w.max(h) as f64).min(1.0);
+    let fw = (w as f64 * fit).round() as usize;
+    let fh = (h as f64 * fit).round() as usize;
+    if fw >= 1 && fh >= 1 && close(iw, fw) && close(ih, fh) {
+        return Ok(());
+    }
+    let expected_aspect = w as f32 / h as f32;
+    let actual_aspect = iw as f32 / ih as f32;
+    if !actual_aspect.is_finite() || (actual_aspect - expected_aspect).abs() > expected_aspect * 0.02 {
+        return Err(format!("the image is {iw}×{ih}, not the issued {w}×{h} aspect ratio"));
+    }
+    Err(format!("the image is {iw}×{ih}, neither the issued {w}×{h} viewport nor its {fw}×{fh} texture-side fit"))
+}
+
+/// Whether two optional document identities are the same document in the same activation.
+fn same_activation(a: Option<DocumentId>, b: Option<DocumentId>) -> bool {
+    match (a, b) {
+        (Some(a), Some(b)) => a.same_activation(b),
+        (None, None) => true,
+        _ => false,
+    }
+}
+
+fn timeout_error(token: u64) -> String {
+    format!("screenshot {token} timed out: no frame was presented within {} s", DEADLINE.as_secs())
+}
+
+fn document_changed_error(token: u64) -> String {
+    format!("screenshot {token} failed: the document changed while the capture was queued")
+}
+
+/// The settle delay for a style's animation time, in milliseconds (egui's open/close fades).
+pub fn settle_ms(animation_time: f32) -> f64 {
+    f64::from(animation_time) * 2000.0 + BASE_SETTLE_MS
+}
+
+/// A monotonic clock for capture lifecycles.
+pub fn now() -> Instant {
+    Instant::now()
+}
+
+/// The `Screenshot` command that carries `callback` to the renderer.
+pub fn send_command(ctx: &Context, callback: ScreenshotCallback) {
+    ctx.send_viewport_cmd(egui::ViewportCommand::Screenshot(callback));
+}
diff --git a/crates/ui-egui/src/screenshot_tests.rs b/crates/ui-egui/src/screenshot_tests.rs
new file mode 100644
index 0000000000..4d23b0607b
--- /dev/null
+++ b/crates/ui-egui/src/screenshot_tests.rs
@@ -0,0 +1,622 @@
+//! Lifecycle tests for `ui.screenshot` admission, issuance, settling and completion.
+
+use super::screenshot::{CaptureGeometry, Captures, DEADLINE, DocumentId, Finished, MAX_IMAGE_BYTES, MAX_PENDING, MAX_TOTAL_BYTES, SETTLE_PASSES};
+use egui::{Color32, ColorImage, Context, ViewportId, vec2};
+use std::sync::Arc;
+use std::time::Duration;
+use web_time::Instant;
+
+fn geometry(w: f32, h: f32, doc: Option<DocumentId>) -> CaptureGeometry {
+    CaptureGeometry {
+        viewport: ViewportId::ROOT,
+        logical_size: vec2(w, h),
+        pixels_per_point: 1.0,
+        zoom_factor: 1.0,
+        max_texture_side: 8192,
+        minimized: false,
+        document: doc,
+    }
+}
+
+fn doc(id: u64, revision: u64) -> Option<DocumentId> {
+    doc_at(id, revision, 0)
+}
+
+fn doc_at(id: u64, revision: u64, generation: u64) -> Option<DocumentId> {
+    Some(DocumentId { document: id, revision, generation })
+}
+
+fn queue(caps: &mut Captures, token: u64, document: Option<DocumentId>, now: Instant) -> std::sync::mpsc::Receiver<serde_json::Value> {
+    let (tx, rx) = std::sync::mpsc::channel();
+    caps.admit(token, None, tx, document, 0.0, now).expect("admitted");
+    rx
+}
+
+/// Run the UI-pass settling the queue needs, returning the callbacks installed by issuance.
+fn settle_and_issue(caps: &mut Captures, ctx: &Context, now: Instant, document: Option<DocumentId>) -> (Vec<Finished>, Vec<egui::ScreenshotCallback>) {
+    for _ in 0..SETTLE_PASSES {
+        caps.note_pass();
+    }
+    let mut callbacks = Vec::new();
+    let finished = caps.issue(ctx, now, document, |cb| callbacks.push(cb));
+    (finished, callbacks)
+}
+
+fn image(geometry: &CaptureGeometry) -> Arc<ColorImage> {
+    let [w, h] = geometry.expected_pixels().expect("pixels");
+    Arc::new(ColorImage::filled([w, h], Color32::BLACK))
+}
+
+#[test]
+fn a_launch_and_capture_request_waits_for_the_first_ui_pass() {
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    // 0.15 queued the request; a client that connects before the first frame must not fail.
+    let rx = queue(&mut caps, 1, None, now);
+    assert_eq!(caps.pending(), 1, "parked, not rejected");
+    assert_eq!(caps.reserved_bytes(), 0, "no geometry means no reservation yet");
+    assert!(caps.any_unissued(), "logic asks for a hidden paint");
+    assert!(rx.try_recv().is_err(), "no reply before the geometry is known");
+
+    // The first UI pass records the geometry; the next logic drain admits the request under the
+    // same token, count and deadline.
+    let g = geometry(800.0, 600.0, None);
+    caps.note_geometry(g);
+    assert!(caps.drain(now, Some(g), None).is_empty());
+    assert_eq!(caps.pending(), 1);
+    assert_eq!(caps.reserved_bytes(), 800 * 600 * 4, "admitted with a reservation");
+    let (tx, _rx) = std::sync::mpsc::channel();
+    let (_, error) = caps.admit(1, None, tx, None, 0.0, now).expect_err("the token is pending");
+    assert!(error.contains("already pending"), "{error}");
+
+    let (_, callbacks) = settle_and_issue(&mut caps, &Context::default(), now, None);
+    assert_eq!(callbacks.len(), 1, "then it is issued normally");
+}
+
+#[test]
+fn a_request_parked_for_geometry_still_times_out() {
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let rx = queue(&mut caps, 3, None, now);
+    let finished = caps.drain(now + DEADLINE, None, None);
+    assert!(finished.is_empty(), "the parked request answers itself");
+    let reply = rx.recv().expect("the control request gets exactly one answer");
+    assert_eq!(reply["ok"], false);
+    assert!(reply["error"].as_str().is_some_and(|e| e.contains("timed out")), "{reply}");
+    assert_eq!(caps.pending(), 0);
+}
+
+#[test]
+fn admission_enforces_the_count_and_byte_budgets() {
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    // 2000×2000 at 4 bytes = 16 MiB: 16 requests would exceed 256 MiB, but only 4 are allowed.
+    caps.note_geometry(geometry(2000.0, 2000.0, None));
+    for token in 0..MAX_PENDING as u64 {
+        queue(&mut caps, token, None, now);
+    }
+    let (tx, _rx) = std::sync::mpsc::channel();
+    let (_, error) = caps.admit(99, None, tx, None, 0.0, now).expect_err("the queue is full");
+    assert!(error.contains("too many"), "{error}");
+    caps.cancel_all("test");
+
+    // A single image over 128 MiB is rejected before issuance.
+    caps.note_geometry(geometry(8000.0, 5000.0, None));
+    let (tx, _rx) = std::sync::mpsc::channel();
+    let (_, error) = caps.admit(100, None, tx, None, 0.0, now).expect_err("over the per-image limit");
+    assert!(error.contains("per-image"), "{error}");
+    const { assert!(MAX_IMAGE_BYTES < MAX_TOTAL_BYTES) };
+
+    // Exact aggregate boundary: 4 × 64 MiB is exactly the 256 MiB limit and is admitted.
+    caps.note_geometry(geometry(4096.0, 4096.0, None)); // 64 MiB
+    for token in 200..204u64 {
+        queue(&mut caps, token, None, now);
+    }
+    assert_eq!(caps.reserved_bytes(), MAX_TOTAL_BYTES);
+    let (tx, _rx) = std::sync::mpsc::channel();
+    assert!(caps.admit(205, None, tx, None, 0.0, now).is_err());
+}
+
+#[test]
+fn a_geometry_growth_between_admission_and_issuance_is_revalidated() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    caps.note_geometry(geometry(800.0, 600.0, doc(1, 1)));
+    let _rx = queue(&mut caps, 61, doc(1, 1), now);
+    // The window is enlarged before the settled request is issued: 8000×5000 is over the
+    // per-image limit, so the old 2 MiB reservation must not let it through.
+    let large = geometry(8000.0, 5000.0, doc(1, 1));
+    caps.note_geometry(large);
+    let (finished, callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    assert!(callbacks.is_empty(), "no image is captured under the stale reservation");
+    assert_eq!(finished.len(), 1);
+    let error = finished[0].result.as_ref().expect_err("over the per-image limit");
+    assert!(error.contains("per-image"), "{error}");
+    assert_eq!(caps.pending(), 0, "the rejected request releases its budget");
+    assert_eq!(caps.reserved_bytes(), 0);
+}
+
+#[test]
+fn an_aggregate_over_budget_after_growth_is_refused() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    caps.note_geometry(geometry(4096.0, 4096.0, None)); // 64 MiB each
+    for token in 70..73u64 {
+        queue(&mut caps, token, None, now);
+    }
+    // 5000×5000 = 100 MiB each: two fit 256 MiB together, three do not.
+    let grown = geometry(5000.0, 5000.0, None);
+    caps.note_geometry(grown);
+    let (finished, callbacks) = settle_and_issue(&mut caps, &ctx, now, None);
+    assert!(callbacks.is_empty(), "the grown layout settles before any capture");
+    assert!(!finished.is_empty(), "at least one request no longer fits the aggregate");
+    assert!(finished.iter().all(|f| f.result.is_err()));
+    assert!(caps.reserved_bytes() <= MAX_TOTAL_BYTES);
+    assert!(caps.pending() < 3 || caps.reserved_bytes() <= MAX_TOTAL_BYTES);
+}
+
+#[test]
+fn settling_counts_real_ui_passes_and_issues_once() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    caps.note_geometry(geometry(800.0, 600.0, doc(1, 1)));
+    // Admission alone does not issue.
+    assert!(queue(&mut caps, 7, doc(1, 1), now).try_recv().is_err());
+    let mut callbacks = Vec::new();
+    assert!(caps.issue(&ctx, now, doc(1, 1), |cb| callbacks.push(cb)).is_empty());
+    assert!(callbacks.is_empty(), "no UI pass has settled yet");
+    // Two passes are not enough; the third issues exactly one callback.
+    caps.note_pass();
+    caps.note_pass();
+    assert!(caps.issue(&ctx, now, doc(1, 1), |cb| callbacks.push(cb)).is_empty());
+    caps.note_pass();
+    assert!(caps.issue(&ctx, now, doc(1, 1), |cb| callbacks.push(cb)).is_empty());
+    assert_eq!(callbacks.len(), 1, "exactly one callback per request");
+    assert!(!caps.any_unissued(), "an issued capture requests no further hidden paint");
+    // Re-issuing on the next pass does not duplicate the request.
+    caps.note_pass();
+    assert!(caps.issue(&ctx, now, doc(1, 1), |cb| callbacks.push(cb)).is_empty());
+    assert_eq!(callbacks.len(), 1);
+}
+
+#[test]
+fn a_completed_image_is_saved_only_when_drained() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = geometry(800.0, 600.0, doc(1, 1));
+    caps.note_geometry(g);
+    let rx = queue(&mut caps, 1, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    let callback = callbacks.pop().expect("one callback");
+    callback.complete(image(&g));
+    // The callback stores the image; no reply is sent from the callback thread.
+    assert!(rx.try_recv().is_err());
+    let finished = caps.drain(now, Some(g), doc(1, 1));
+    assert_eq!(finished.len(), 1);
+    assert!(finished[0].result.is_ok());
+    assert!(finished[0].reply.is_some());
+    assert_eq!(caps.pending(), 0, "the budget is released after the drain");
+    assert!(caps.cancel_all("nothing left").is_empty(), "a drained request is not replied to twice");
+}
+
+#[test]
+fn a_callback_after_the_deadline_is_not_written() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = geometry(800.0, 600.0, doc(1, 1));
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 2, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    callbacks.pop().expect("one callback").complete(image(&g));
+    // The image is already stored, but the deadline is checked before it is accepted.
+    let late = now + DEADLINE + Duration::from_millis(1);
+    let finished = caps.drain(late, Some(g), doc(1, 1));
+    assert_eq!(finished.len(), 1);
+    let error = finished[0].result.as_ref().expect_err("a late image is a timeout");
+    assert!(error.contains("timed out"), "{error}");
+    assert!(finished[0].reply.is_some());
+    assert_eq!(caps.pending(), 0);
+}
+
+#[test]
+fn cancellation_makes_a_late_callback_inert_and_releases_the_budget() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = geometry(800.0, 600.0, doc(1, 1));
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 3, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    let callback = callbacks.pop().expect("one callback");
+    let finished = caps.cancel_all("test");
+    assert_eq!(finished.len(), 1);
+    assert!(finished[0].result.is_err());
+    assert_eq!(caps.pending(), 0);
+    assert_eq!(caps.reserved_bytes(), 0);
+    // The slot holds no strong reference from the callback: the late image is dropped.
+    callback.complete(image(&g));
+    assert!(caps.drain(now, Some(g), doc(1, 1)).is_empty());
+}
+
+#[test]
+fn an_out_of_order_completion_stays_with_its_own_token() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = geometry(800.0, 600.0, doc(1, 1));
+    caps.note_geometry(g);
+    let _a = queue(&mut caps, 11, doc(1, 1), now);
+    let _b = queue(&mut caps, 12, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    let cb11 = callbacks.remove(0);
+    let cb12 = callbacks.remove(0);
+    // Complete in reverse order; each slot stores its own image.
+    cb12.complete(Arc::new(ColorImage::filled([800, 600], Color32::RED)));
+    cb11.complete(Arc::new(ColorImage::filled([800, 600], Color32::BLUE)));
+    let mut finished = caps.drain(now, Some(g), doc(1, 1));
+    finished.sort_by_key(|f| f.token);
+    assert_eq!(finished.len(), 2);
+    assert_eq!(finished[0].token, 11);
+    assert_eq!(finished[1].token, 12);
+    assert_eq!(finished[0].result.as_ref().unwrap().pixels[0], Color32::BLUE);
+    assert_eq!(finished[1].result.as_ref().unwrap().pixels[0], Color32::RED);
+}
+
+#[test]
+fn a_document_change_is_cancelled_without_capturing_the_new_document() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = geometry(800.0, 600.0, doc(1, 1));
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 21, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    callbacks.pop().expect("one callback").complete(image(&g));
+    let finished = caps.drain(now, Some(g), doc(2, 1));
+    assert_eq!(finished.len(), 1);
+    let error = finished[0].result.as_ref().expect_err("the document changed");
+    assert!(error.contains("document changed"), "{error}");
+}
+
+#[test]
+fn a_mid_pass_document_switch_does_not_issue_a_capture() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = geometry(800.0, 600.0, doc(1, 1));
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 23, doc(1, 1), now);
+    for _ in 0..SETTLE_PASSES {
+        caps.note_pass();
+    }
+    // The pass started on document 1 but ends on document 2 (a tab click or a control open in
+    // `ui`): the frame being drawn is not the one the request was admitted for.
+    let mut callbacks = Vec::new();
+    let finished = caps.issue(&ctx, now, doc(2, 1), |cb| callbacks.push(cb));
+    assert!(callbacks.is_empty(), "no capture is issued for a mixed pass");
+    assert_eq!(finished.len(), 1, "the request fails instead of capturing the other document");
+    assert!(finished[0].result.is_err());
+    assert_eq!(caps.pending(), 0);
+}
+
+#[test]
+fn a_document_switch_away_and_back_fails_the_capture() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = geometry(800.0, 600.0, doc(1, 1));
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 22, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    callbacks.pop().expect("one callback").complete(image(&g));
+    // Same document id, but the activation generation advanced: the frame may have been drawn
+    // from another document in between, so the image is not attributed to this request.
+    let after = geometry(800.0, 600.0, doc_at(1, 1, 1));
+    let finished = caps.drain(now, Some(after), doc_at(1, 1, 1));
+    assert_eq!(finished.len(), 1);
+    let error = finished[0].result.as_ref().expect_err("the switch invalidates the capture");
+    assert!(error.contains("document changed"), "{error}");
+}
+
+#[test]
+fn an_edit_in_the_same_document_does_not_cancel_the_capture() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = geometry(800.0, 600.0, doc(1, 1));
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 25, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    callbacks.pop().expect("one callback").complete(image(&g));
+    // The document was edited while the image was in flight: same document, new revision.
+    let finished = caps.drain(now, Some(g), doc(1, 2));
+    assert_eq!(finished.len(), 1);
+    assert!(finished[0].result.is_ok(), "an edit is not a document change");
+}
+
+#[test]
+fn a_geometry_change_retries_then_fails_without_saving_stale_pixels() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = geometry(800.0, 600.0, doc(1, 1));
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 31, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    callbacks.pop().expect("one callback").complete(image(&g));
+    let resized = geometry(900.0, 700.0, doc(1, 1));
+    caps.note_geometry(resized);
+    let finished = caps.drain(now, Some(resized), doc(1, 1));
+    assert!(finished.is_empty(), "the first resize retries");
+    assert_eq!(caps.pending(), 1);
+    let mut retries = 0;
+    loop {
+        let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+        callbacks.pop().expect("a retry callback").complete(image(&resized));
+        // A second, third, … resize must eventually give up inside the deadline.
+        let moved = geometry(901.0 + retries as f32, 700.0, doc(1, 1));
+        caps.note_geometry(moved);
+        let finished = caps.drain(now, Some(moved), doc(1, 1));
+        if !finished.is_empty() {
+            let error = finished[0].result.as_ref().expect_err("stale pixels are not saved");
+            assert!(error.contains("layout changed"), "{error}");
+            break;
+        }
+        retries += 1;
+        assert!(retries < 10, "the retry budget is bounded");
+    }
+}
+
+#[test]
+fn a_resize_and_back_retries_instead_of_accepting_the_old_image() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = geometry(800.0, 600.0, doc(1, 1));
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 32, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    callbacks.pop().expect("one callback").complete(image(&g));
+    // The host resizes, then resizes back before the image is collected. The final values are
+    // identical, but the monotonic epoch advanced twice: the image may be from either layout.
+    caps.note_geometry(geometry(900.0, 700.0, doc(1, 1)));
+    caps.note_geometry(g);
+    let finished = caps.drain(now, Some(g), doc(1, 1));
+    assert!(finished.is_empty(), "the changed-and-restored layout retries");
+    assert_eq!(caps.pending(), 1);
+    // The retried capture is issued and accepted against the stable geometry.
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    callbacks.pop().expect("a retry callback").complete(image(&g));
+    let finished = caps.drain(now, Some(g), doc(1, 1));
+    assert_eq!(finished.len(), 1);
+    assert!(finished[0].result.is_ok());
+}
+
+#[test]
+fn an_image_whose_size_does_not_match_the_issued_geometry_is_rejected() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = geometry(800.0, 600.0, doc(1, 1));
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 41, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    // Not a uniform fit: a different aspect ratio than the issued 4:3 viewport.
+    callbacks.pop().expect("one callback").complete(Arc::new(ColorImage::filled([400, 200], Color32::BLACK)));
+    let finished = caps.drain(now, Some(g), doc(1, 1));
+    let error = finished[0].result.as_ref().expect_err("wrong-aspect image");
+    assert!(error.contains("400×200"), "{error}");
+    // A larger image than the issued viewport is never accepted either.
+    let ctx = Context::default();
+    let mut caps = Captures::default();
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 42, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    callbacks.pop().expect("one callback").complete(Arc::new(ColorImage::filled([1600, 1200], Color32::BLACK)));
+    let finished = caps.drain(now, Some(g), doc(1, 1));
+    let error = finished[0].result.as_ref().expect_err("larger image");
+    assert!(error.contains("larger than"), "{error}");
+}
+
+#[test]
+fn an_arbitrarily_small_same_aspect_image_is_rejected() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = geometry(800.0, 600.0, doc(1, 1));
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 44, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    callbacks.pop().expect("one callback").complete(Arc::new(ColorImage::filled([100, 75], Color32::BLACK)));
+    let finished = caps.drain(now, Some(g), doc(1, 1));
+    let error = finished[0].result.as_ref().expect_err("a downscaled surface is not the frame");
+    assert!(error.contains("100×75"), "{error}");
+    assert!(error.contains("texture-side fit"), "{error}");
+}
+
+#[test]
+fn a_uniformly_fitted_image_is_accepted() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    // A window larger than the adapter's texture side is fitted by the renderer (E2): the image
+    // is the exact texture-side fit, not an arbitrary downscale.
+    let g = CaptureGeometry { max_texture_side: 4096, ..geometry(6000.0, 3375.0, doc(1, 1)) };
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 43, doc(1, 1), now);
+    let (_, mut callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    callbacks.pop().expect("one callback").complete(Arc::new(ColorImage::filled([4096, 2304], Color32::BLACK)));
+    let finished = caps.drain(now, Some(g), doc(1, 1));
+    assert!(finished[0].result.is_ok(), "an E2-fitted image keeps the issued aspect");
+}
+
+#[test]
+fn a_minimized_window_is_refused_before_issuance() {
+    let ctx = Context::default();
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    let g = CaptureGeometry { minimized: true, ..geometry(800.0, 600.0, doc(1, 1)) };
+    caps.note_geometry(g);
+    let _rx = queue(&mut caps, 52, doc(1, 1), now);
+    let (finished, callbacks) = settle_and_issue(&mut caps, &ctx, now, doc(1, 1));
+    assert!(callbacks.is_empty());
+    assert_eq!(finished.len(), 1);
+    let error = finished[0].result.as_ref().expect_err("no surface while minimized");
+    assert!(error.contains("minimized"), "{error}");
+}
+
+#[test]
+fn a_never_issued_request_times_out() {
+    let now = Instant::now();
+    let mut caps = Captures::default();
+    caps.note_geometry(geometry(800.0, 600.0, doc(1, 1)));
+    let _rx = queue(&mut caps, 51, doc(1, 1), now);
+    let finished = caps.drain(now + DEADLINE, Some(geometry(800.0, 600.0, doc(1, 1))), doc(1, 1));
+    assert_eq!(finished.len(), 1);
+    assert!(finished[0].result.is_err());
+    assert_eq!(caps.pending(), 0);
+}
+
+/// Execute the same logic→UI order as eframe, with genuinely new host geometry before logic.
+fn actual_capture_frame(app: &mut crate::PhotocraftApp, ctx: &Context, size: egui::Vec2, scale: f32, minimized: bool) -> egui::FullOutput {
+    use eframe::App as _;
+    let rect = egui::Rect::from_min_size(egui::Pos2::ZERO, size);
+    let mut viewports = egui::ViewportIdMap::default();
+    viewports.insert(
+        ViewportId::ROOT,
+        egui::ViewportInfo { inner_rect: Some(rect), native_pixels_per_point: Some(scale), minimized: Some(minimized), ..Default::default() },
+    );
+    let mut input = egui::RawInput { screen_rect: Some(rect), viewports, focused: true, ..Default::default() };
+    app.raw_input_hook(ctx, &mut input);
+    let mut frame = eframe::Frame::_new_kittest();
+    let mut output = ctx.run_ui(input, |ui| {
+        app.logic(ui.ctx(), &mut frame);
+        app.ui(ui, &mut frame);
+    });
+    output.textures_delta.clear();
+    output
+}
+
+fn actual_callback(output: &egui::FullOutput) -> Option<egui::ScreenshotCallback> {
+    output.viewport_output.values().flat_map(|viewport| &viewport.commands).find_map(|command| match command {
+        egui::ViewportCommand::Screenshot(callback) => Some(callback.clone()),
+        _ => None,
+    })
+}
+
+#[test]
+fn completed_callback_revalidates_next_raw_input_before_actual_app_writes() {
+    use std::cell::RefCell;
+    use std::rc::Rc;
+    // Unchanged success, resize, DPI change, and minimized are separate real app instances.
+    for (size, scale, minimized) in
+        [(vec2(600.0, 400.0), 1.0, false), (vec2(640.0, 400.0), 1.0, false), (vec2(600.0, 400.0), 2.0, false), (vec2(600.0, 400.0), 1.0, true)]
+    {
+        let changed = size != vec2(600.0, 400.0) || scale != 1.0 || minimized;
+        let writes = Rc::new(RefCell::new(Vec::new()));
+        let encodes = Rc::new(RefCell::new(Vec::new()));
+        let (written, encoded) = (writes.clone(), encodes.clone());
+        let services = crate::Services {
+            automation_write: Some(Box::new(move |path, bytes| {
+                written.borrow_mut().push((path.to_owned(), bytes.to_vec()));
+                Ok(())
+            })),
+            encode_png: Some(Box::new(move |w, h, rgba| {
+                encoded.borrow_mut().push((w, h, rgba.get(..4).unwrap_or_default().to_vec()));
+                let image =
+                    photocraft_codecs::Image::from_u8(w, h, photocraft_codecs::ChannelLayout::Rgba, rgba.to_vec()).map_err(|error| error.to_string())?;
+                photocraft_codecs::encode(&image, photocraft_codecs::Format::Png, &photocraft_codecs::EncodeOptions::default())
+                    .map_err(|error| error.to_string())
+            })),
+            ..Default::default()
+        };
+        let mut app = crate::PhotocraftApp::new(photocraft_engine::Session::new(), services);
+        app.run("file.new", serde_json::json!({"width": 32, "height": 32})).unwrap();
+        let ctx = Context::default();
+        for _ in 0..4 {
+            actual_capture_frame(&mut app, &ctx, vec2(600.0, 400.0), 1.0, false);
+        }
+        let old = app.captures.last_geometry().expect("the old real UI geometry");
+        let document = app.document_identity();
+        let (tx, rx) = std::sync::mpsc::channel();
+        app.captures.admit(91, Some("fixture/current.png".into()), tx, document, 0.0, super::screenshot::now()).unwrap();
+        let mut callback = None;
+        for _ in 0..8 {
+            let output = actual_capture_frame(&mut app, &ctx, vec2(600.0, 400.0), 1.0, false);
+            if let Some(found) = actual_callback(&output) {
+                callback = Some(found);
+                break;
+            }
+        }
+        let old_image = Arc::new(ColorImage::filled(old.expected_pixels().unwrap(), Color32::RED));
+        let old_pixels = Arc::downgrade(&old_image);
+        callback.expect("actual app issued one screenshot callback").complete(old_image);
+        assert!(writes.borrow().is_empty() && encodes.borrow().is_empty(), "the real callback only stores pixels");
+        let output = actual_capture_frame(&mut app, &ctx, size, scale, minimized);
+        if changed {
+            assert!(writes.borrow().is_empty() && encodes.borrow().is_empty(), "no stale encode/write on the first changed input");
+            assert!(old_pixels.upgrade().is_none(), "old pixels are released on geometry rejection");
+            let current = app.captures.last_geometry().unwrap();
+            assert!(current.logical_size != old.logical_size || current.pixels_per_point != old.pixels_per_point || current.minimized != old.minimized);
+            if minimized {
+                // A minimized surface cannot be retried. It fails once, then an independent
+                // request after restoration proves that cancellation releases its budget.
+                let reply = rx.try_recv().expect("one minimized error");
+                assert_eq!(reply["ok"], false, "{reply}");
+                assert!(reply["error"].as_str().unwrap().contains("minimized"));
+                assert_eq!(app.captures.pending(), 0);
+                assert_eq!(app.captures.reserved_bytes(), 0);
+                assert!(actual_callback(&output).is_none());
+                actual_capture_frame(&mut app, &ctx, size, scale, false);
+                let (tx, restored_rx) = std::sync::mpsc::channel();
+                app.captures.admit(92, Some("fixture/restored.png".into()), tx, document, 0.0, super::screenshot::now()).unwrap();
+                for _ in 0..8 {
+                    let output = actual_capture_frame(&mut app, &ctx, size, scale, false);
+                    if let Some(callback) = actual_callback(&output) {
+                        callback.complete(Arc::new(ColorImage::filled(app.captures.last_geometry().unwrap().expected_pixels().unwrap(), Color32::BLUE)));
+                        break;
+                    }
+                }
+                actual_capture_frame(&mut app, &ctx, size, scale, false);
+                let reply = restored_rx.try_recv().expect("the restored window accepts a new request");
+                assert_eq!(reply["ok"], true, "{reply}");
+                assert_eq!(writes.borrow().len(), 1);
+                assert!(writes.borrow()[0].1.starts_with(b"\x89PNG\r\n\x1a\n"));
+                assert_eq!(encodes.borrow().len(), 1);
+                assert_eq!(encodes.borrow()[0].2, [0, 0, 255, 255]);
+                assert_eq!(app.captures.pending(), 0);
+                assert_eq!(app.captures.reserved_bytes(), 0);
+                assert!(rx.try_recv().is_err() && restored_rx.try_recv().is_err());
+                continue;
+            }
+            assert!(rx.try_recv().is_err(), "bounded retry has not delivered a stale success");
+            let mut retry = actual_callback(&output);
+            for _ in 0..8 {
+                if retry.is_some() {
+                    break;
+                }
+                retry = actual_callback(&actual_capture_frame(&mut app, &ctx, size, scale, minimized));
+            }
+            retry
+                .expect("the actual app reissues at bounded current geometry")
+                .complete(Arc::new(ColorImage::filled(current.expected_pixels().unwrap(), Color32::BLUE)));
+            actual_capture_frame(&mut app, &ctx, size, scale, minimized);
+            assert_eq!(encodes.borrow().first().map(|entry| entry.2.as_slice()), Some([0, 0, 255, 255].as_slice()), "only the new callback image is encoded");
+        }
+        let reply = rx.try_recv().expect("one response after the valid callback");
+        assert_eq!(reply["ok"], true, "{reply}");
+        assert_eq!(writes.borrow().len(), 1);
+        assert!(writes.borrow()[0].1.starts_with(b"\x89PNG\r\n\x1a\n"), "real PNG encoding and automation_write ran");
+        assert_eq!(encodes.borrow().len(), 1);
+        assert_eq!(app.captures.pending(), 0);
+        assert_eq!(app.captures.reserved_bytes(), 0);
+        actual_capture_frame(&mut app, &ctx, size, scale, minimized);
+        assert_eq!(writes.borrow().len(), 1, "no duplicate output");
+        assert!(rx.try_recv().is_err());
+    }
+}
diff --git a/crates/ui-egui/src/select_mask_view.rs b/crates/ui-egui/src/select_mask_view.rs
index 9f5440c4aa..a06c78e468 100644
--- a/crates/ui-egui/src/select_mask_view.rs
+++ b/crates/ui-egui/src/select_mask_view.rs
@@ -183,7 +183,7 @@ pub fn controls(ui: &mut egui::Ui, fields: &mut Map<String, Value>) {
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(tl!("View")).color(t.text_dim));
         let options: Vec<(Mode, &str)> = Mode::ALL.iter().map(|m| (*m, m.label())).collect();
-        crate::widgets::dropdown(ui, "select-mask-view", &mut current, &options, 170.0);
+        crate::widgets::dropdown(ui, "select-mask-view", tl!("View"), &mut current, &options, 170.0);
     });
     fields.insert("__view".into(), json!(current.id()));
     if current.default_opacity().is_some() {
@@ -214,7 +214,7 @@ fn brush_controls(ui: &mut egui::Ui, fields: &mut Map<String, Value>) {
         ui.horizontal(|ui| {
             ui.label(egui::RichText::new(tl!("Mode")).color(t.text_dim));
             let options = [(false, tl!("Expand Detection Area")), (true, tl!("Restore Original Edge"))];
-            crate::widgets::dropdown(ui, "select-mask-brush-mode", &mut subtract, &options, 170.0);
+            crate::widgets::dropdown(ui, "select-mask-brush-mode", tl!("Mode"), &mut subtract, &options, 170.0);
         });
         fields.insert("__brushMode".into(), json!(if subtract { "subtract" } else { "add" }));
         let mut size = brush_size(fields);
diff --git a/crates/ui-egui/src/shape_dialog.rs b/crates/ui-egui/src/shape_dialog.rs
index ca68e87015..9a8e075d6d 100644
--- a/crates/ui-egui/src/shape_dialog.rs
+++ b/crates/ui-egui/src/shape_dialog.rs
@@ -179,7 +179,7 @@ pub fn body(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Value>)
             let to_unit = |px: f64| unit.from_px(px, dpi, extent, ppi) as f32;
             let mut v = to_unit(px);
             let places = unit.decimals() as u32;
-            let resp = crate::widgets::value_field_prec(ui, &mut v, to_unit(1.0)..=to_unit(MAX_PX), unit.suffix(), 110.0, places);
+            let resp = crate::widgets::value_field_prec(ui, &mut v, to_unit(1.0)..=to_unit(MAX_PX), unit.suffix(), 110.0, places).accessible_name(text);
             if resp.changed() {
                 let px = unit.to_px(f64::from(v), dpi, extent, ppi).clamp(1.0, MAX_PX);
                 f.insert(key.into(), json!((px * 1000.0).round() / 1000.0));
@@ -205,10 +205,14 @@ pub fn body(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Value>)
             ui.horizontal(|ui| {
                 label(ui, tl!("Radius:"));
                 ui.vertical(|ui| {
+                    // All four fields show "Radius:"; the accessible name says which corner
+                    // (radii are top-left, top-right, bottom-right, bottom-left).
+                    let corners = ["Top Left", "Top Right", "Bottom Right", "Bottom Left"];
                     for row in [[0usize, 1], [3, 2]] {
                         ui.horizontal(|ui| {
                             for i in row {
-                                if crate::widgets::value_field(ui, &mut radii[i], 0.0..=10000.0, "px", 72.0).changed() {
+                                let name = format!("{} {}", tl!(corners[i]), tl!("Radius:"));
+                                if crate::widgets::value_field(ui, &mut radii[i], 0.0..=10000.0, "px", 72.0).accessible_name(name).changed() {
                                     changed = Some(i);
                                 }
                             }
@@ -233,14 +237,14 @@ pub fn body(app: &PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Value>)
             ui.horizontal(|ui| {
                 label(ui, tl!("Sides:"));
                 let mut s = num(f, "sides").unwrap_or(5.0) as f32;
-                if crate::widgets::value_field(ui, &mut s, 3.0..=100.0, "", 72.0).changed() {
+                if crate::widgets::value_field(ui, &mut s, 3.0..=100.0, "", 72.0).accessible_name(tl!("Sides:")).changed() {
                     f.insert("sides".into(), json!(s.round().clamp(3.0, 100.0) as u32));
                 }
             });
             ui.horizontal(|ui| {
                 label(ui, tl!("Star Ratio:"));
                 let mut r = num(f, "starRatio").unwrap_or(100.0) as f32;
-                if crate::widgets::value_field(ui, &mut r, 1.0..=100.0, "%", 72.0).changed() {
+                if crate::widgets::value_field(ui, &mut r, 1.0..=100.0, "%", 72.0).accessible_name(tl!("Star Ratio:")).changed() {
                     f.insert("starRatio".into(), json!(f64::from(r.clamp(1.0, 100.0))));
                 }
             });
diff --git a/crates/ui-egui/src/shape_gradient_ui.rs b/crates/ui-egui/src/shape_gradient_ui.rs
new file mode 100644
index 0000000000..e2fbfdb679
--- /dev/null
+++ b/crates/ui-egui/src/shape_gradient_ui.rs
@@ -0,0 +1,522 @@
+//! The shape Fill / Stroke swatches' Gradient tab, as Photoshop's popover: the recently used
+//! gradients and the preset library, a stops strip (click to add a stop, drag one to move it or
+//! off the strip to delete it, drag a midpoint), the selected stop's colour, opacity and
+//! location, and the gradient's style, angle, scale, reverse and Align with layer. Stop edits use
+//! the Gradient Editor's grammar ([`apply_stop`]); the tab returns the edited gradient and the
+//! swatch's caller applies it to the next shape or as one `shape.edit`.
+
+use egui::{Pos2, Rect, Sense, Stroke, StrokeKind, pos2, vec2};
+use photocraft_compose::gradient_fill as gf;
+use photocraft_doc::{Fill, GradientStyle};
+use photocraft_engine::gradient_fill_cmds::apply_stop;
+use photocraft_engine::presets::Group;
+use photocraft_engine::presets::gradients::GradientPreset;
+use serde_json::{Value, json};
+
+use crate::shape_paint_ui::{picker_color, picker_rgba, rgba_of, rgba32};
+use crate::theme::Tokens;
+
+/// Width of the tab's rows (the strip, the swatch grids).
+const WIDTH: f32 = 228.0;
+/// How many gradients the Recent row keeps.
+const RECENT: usize = 8;
+
+/// What a swatch's Gradient tab offers: the recently used gradients, the preset library, and the
+/// Gradient tool's current gradient (what a colour switches to), with the tool colours that
+/// resolve their Foreground / Background stops.
+pub(crate) struct GradientChoices<'a> {
+    pub presets: &'a [Group<GradientPreset>],
+    pub current: &'a GradientPreset,
+    /// Newest first ([`GradientChoices::remember`]).
+    pub recent: &'a mut Vec<Fill>,
+    pub fg: [f32; 4],
+    pub bg: [f32; 4],
+}
+
+impl GradientChoices<'_> {
+    /// Photoshop's shape gradient default: the current gradient, linear at 90°, 100%.
+    pub(crate) fn default_fill(&self) -> Fill {
+        let mut fill = Fill::gradient(Vec::new(), 90.0, 1.0, GradientStyle::Linear, false);
+        take_preset(&mut fill, self.current, self.fg, self.bg);
+        fill
+    }
+
+    /// Puts `gradient`'s stops at the front of the Recent row; a gradient already there moves up.
+    pub(crate) fn remember(&mut self, gradient: &Fill) {
+        let Fill::Gradient { .. } = gradient else { return };
+        self.recent.retain(|f| !same_stops(f, gradient));
+        self.recent.insert(0, gradient.clone());
+        self.recent.truncate(RECENT);
+    }
+}
+
+/// Whether two gradients have the same colour stops, opacity stops and midpoints.
+fn same_stops(a: &Fill, b: &Fill) -> bool {
+    match (a, b) {
+        (Fill::Gradient { stops: s1, opacity_stops: o1, midpoints: m1, .. }, Fill::Gradient { stops: s2, opacity_stops: o2, midpoints: m2, .. }) => {
+            s1 == s2 && o1 == o2 && m1 == m2
+        }
+        _ => false,
+    }
+}
+
+/// `fill` takes `preset`'s colour and opacity stops (live colours resolved now), as a Gradient
+/// Fill layer made from it holds them; its old midpoints belonged to the old stops.
+pub(crate) fn take_preset(fill: &mut Fill, preset: &GradientPreset, fg: [f32; 4], bg: [f32; 4]) {
+    if let Fill::Gradient { stops, opacity_stops, midpoints, .. } = fill {
+        (*stops, *opacity_stops) = preset.fill_stops(fg, bg);
+        midpoints.clear();
+    }
+}
+
+/// `fill` takes `from`'s colour stops, opacity stops and midpoints (a Recent pick).
+fn take_stops(fill: &mut Fill, from: &Fill) {
+    if let (Fill::Gradient { stops, opacity_stops, midpoints, .. }, Fill::Gradient { stops: s, opacity_stops: o, midpoints: m, .. }) = (fill, from) {
+        (*stops, *opacity_stops, *midpoints) = (s.clone(), o.clone(), m.clone());
+    }
+}
+
+/// The Gradient tab of the swatch `id`. Returns the edited gradient.
+pub(crate) fn gradient_tab(ui: &mut egui::Ui, fill: &Fill, choices: &GradientChoices, id: egui::Id) -> Option<Fill> {
+    let Fill::Gradient { angle, scale, style, reverse, align, .. } = fill else { return None };
+    let t = Tokens::get(ui.ctx());
+    let mut out: Option<Fill> = None;
+    let mut picked = false;
+    egui::ScrollArea::vertical().id_salt(id.with("gradient-presets")).max_height(120.0).show(ui, |ui| {
+        ui.set_width(WIDTH);
+        let group_label = |ui: &mut egui::Ui, s: &str| ui.label(egui::RichText::new(s).color(t.text_dim).size(11.0));
+        if !choices.recent.is_empty() {
+            group_label(ui, tl!("Recent"));
+            ui.horizontal_wrapped(|ui| {
+                ui.spacing_mut().item_spacing = vec2(3.0, 3.0);
+                for (i, recent) in choices.recent.iter().enumerate() {
+                    let (r, resp) = ui.allocate_exact_size(vec2(32.0, 18.0), Sense::click());
+                    paint_fill_ramp(ui, r, recent, resp.hovered());
+                    let name = format!("{} {}", tl!("Recent"), i + 1);
+                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &name));
+                    if resp.clicked() {
+                        take_stops(edited(&mut out, fill), recent);
+                        picked = true;
+                    }
+                }
+            });
+        }
+        for group in choices.presets {
+            // Group and preset names are the library's data, shown as they are.
+            group_label(ui, &group.name);
+            ui.horizontal_wrapped(|ui| {
+                ui.spacing_mut().item_spacing = vec2(3.0, 3.0);
+                for preset in &group.items {
+                    let (r, resp) = ui.allocate_exact_size(vec2(32.0, 18.0), Sense::click());
+                    crate::preset_panels::paint_gradient(ui, r, &preset.resolve(choices.fg, choices.bg));
+                    let border = if resp.hovered() { t.text_dim } else { t.field_border };
+                    ui.painter().rect_stroke(r, 0.0, Stroke::new(1.0, border), StrokeKind::Outside);
+                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &preset.name));
+                    if resp.on_hover_text(&preset.name).clicked() {
+                        take_preset(edited(&mut out, fill), preset, choices.fg, choices.bg);
+                        picked = true;
+                    }
+                }
+            });
+        }
+    });
+    if picked {
+        // New stops: start from the first colour stop, its colour row showing.
+        ui.data_mut(|d| d.insert_temp(selection_key(id), Marker::Color(0)));
+    }
+    ui.add_space(6.0);
+    if let Some(f) = stops_strip(ui, out.as_ref().unwrap_or(fill), id, choices.fg, choices.bg) {
+        out = Some(f);
+    }
+    if let Some(f) = stop_fields(ui, out.as_ref().unwrap_or(fill), id, choices.fg, choices.bg) {
+        out = Some(f);
+    }
+    ui.add_space(4.0);
+    ui.horizontal(|ui| {
+        ui.spacing_mut().item_spacing.x = 2.0;
+        for (s, icon, tip) in [
+            (GradientStyle::Linear, "gradient", tl!("Linear Gradient")),
+            (GradientStyle::Radial, "circle", tl!("Radial Gradient")),
+            (GradientStyle::Angle, "rotate-cw", tl!("Angle Gradient")),
+            (GradientStyle::Reflected, "arrow-left-right", tl!("Reflected Gradient")),
+            (GradientStyle::Diamond, "diamond", tl!("Diamond Gradient")),
+        ] {
+            if crate::icons::button(ui, icon, 22.0, *style == s, tip).clicked()
+                && *style != s
+                && let Fill::Gradient { style, .. } = edited(&mut out, fill)
+            {
+                *style = s;
+            }
+        }
+    });
+    let label = |ui: &mut egui::Ui, s: &str| ui.label(egui::RichText::new(s).color(t.text_dim).size(12.0));
+    ui.horizontal(|ui| {
+        label(ui, tl!("Angle"));
+        let mut a = *angle;
+        if crate::widgets::value_field(ui, &mut a, -180.0..=180.0, "°", 52.0).changed()
+            && let Fill::Gradient { angle, .. } = edited(&mut out, fill)
+        {
+            *angle = a;
+        }
+        label(ui, tl!("Scale"));
+        let mut sc = *scale * 100.0;
+        if crate::widgets::value_field(ui, &mut sc, 10.0..=150.0, "%", 52.0).changed()
+            && let Fill::Gradient { scale, .. } = edited(&mut out, fill)
+        {
+            *scale = sc / 100.0;
+        }
+    });
+    ui.horizontal(|ui| {
+        let mut rev = *reverse;
+        if crate::widgets::checkbox(ui, &mut rev, tl!("Reverse")).changed()
+            && let Fill::Gradient { reverse, .. } = edited(&mut out, fill)
+        {
+            *reverse = rev;
+        }
+        let mut al = *align;
+        if crate::widgets::checkbox(ui, &mut al, tl!("Align with layer")).changed()
+            && let Fill::Gradient { align, .. } = edited(&mut out, fill)
+        {
+            *align = al;
+        }
+    });
+    out
+}
+
+/// The gradient being edited this frame: `fill` until a control changes it.
+fn edited<'a>(out: &'a mut Option<Fill>, fill: &Fill) -> &'a mut Fill {
+    out.get_or_insert_with(|| fill.clone())
+}
+
+/// A gradient's ramp in `r` (un-reversed, as the stops strip shows it), outlined.
+fn paint_fill_ramp(ui: &egui::Ui, r: Rect, fill: &Fill, hovered: bool) {
+    let t = Tokens::get(ui.ctx());
+    if let Some(ramp) = gf::Ramp::new(&unreversed(fill)) {
+        crate::gradient_ui::paint_ramp(ui.painter(), r, |u| ramp.sample(u));
+    }
+    let border = if hovered { t.text_dim } else { t.field_border };
+    ui.painter().rect_stroke(r, 0.0, Stroke::new(1.0, border), StrokeKind::Outside);
+}
+
+fn unreversed(fill: &Fill) -> Fill {
+    let mut f = fill.clone();
+    if let Fill::Gradient { reverse, .. } = &mut f {
+        *reverse = false;
+    }
+    f
+}
+
+/// A marker of the stops strip.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Marker {
+    Color(usize),
+    Opacity(usize),
+    /// The midpoint of the segment after colour stop `i`.
+    Mid(usize),
+}
+
+/// A drag in progress: the marker and the gradient as it was when the drag began. Each frame
+/// re-applies the move to that gradient, so a stop dragged past another stays the one dragged.
+#[derive(Clone)]
+struct Drag {
+    marker: Marker,
+    start: Fill,
+}
+
+/// Colour stops, opacity stops and midpoints.
+type Stops = (Vec<(f32, photocraft_doc::Color)>, Vec<(f32, f32)>, Vec<f32>);
+
+/// The colour stops (sorted), opacity stops (sorted; two opaque ones when the gradient has none,
+/// as [`apply_stop`] counts them) and midpoints of `fill`.
+fn sorted_stops(fill: &Fill) -> Stops {
+    let Fill::Gradient { stops, opacity_stops, midpoints, .. } = fill else { return (Vec::new(), Vec::new(), Vec::new()) };
+    let mut cs = stops.clone();
+    cs.sort_by(|a, b| a.0.total_cmp(&b.0));
+    let mut os = if opacity_stops.is_empty() { vec![(0.0, 1.0), (1.0, 1.0)] } else { opacity_stops.clone() };
+    os.sort_by(|a, b| a.0.total_cmp(&b.0));
+    (cs, os, midpoints.clone())
+}
+
+/// Where a stop moved to `location` lands once the stops are sorted again: the selection follows it.
+fn index_after_move(locations: &[f32], moved: usize, location: f32) -> usize {
+    locations.iter().enumerate().filter(|(i, l)| *i != moved && (**l < location || (**l == location && *i < moved))).count()
+}
+
+fn apply(fill: &Fill, edit: &Value, fg: [f32; 4], bg: [f32; 4]) -> Option<Fill> {
+    apply_stop(fill, edit, fg, bg).ok()
+}
+
+/// Where swatch `id` keeps its selected marker.
+fn selection_key(id: egui::Id) -> egui::Id {
+    id.with("stops-selected")
+}
+
+/// Where swatch `id` keeps whether the selected colour stop's inline picker is open.
+fn picker_key(id: egui::Id) -> egui::Id {
+    id.with("stop-picker-open")
+}
+
+/// The selected marker, when it still names a stop of `fill`; else the first colour stop. The
+/// marker is an index, so a preset with fewer stops, a deleted stop or another shape would
+/// otherwise leave it pointing past the stops (and the stop's fields would vanish).
+fn selection(ui: &egui::Ui, id: egui::Id, fill: &Fill) -> Marker {
+    let (cs, os, _) = sorted_stops(fill);
+    let valid = |m: &Marker| match *m {
+        Marker::Color(i) => i < cs.len(),
+        Marker::Opacity(i) => i < os.len(),
+        Marker::Mid(i) => i.saturating_add(1) < cs.len(),
+    };
+    ui.data(|d| d.get_temp::<Marker>(selection_key(id))).filter(valid).unwrap_or(Marker::Color(0))
+}
+
+/// The stops strip: the ramp with opacity stops above and colour stops below (Photoshop's).
+fn stops_strip(ui: &mut egui::Ui, fill: &Fill, id: egui::Id, fg: [f32; 4], bg: [f32; 4]) -> Option<Fill> {
+    let t = Tokens::get(ui.ctx());
+    let (outer, resp) = ui.allocate_exact_size(vec2(WIDTH, 58.0), Sense::click_and_drag());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tl!("Gradient stops")));
+    let top = outer.top() + 16.0;
+    let bar = Rect::from_min_max(pos2(outer.left() + 8.0, top), pos2(outer.right() - 8.0, top + 24.0));
+    let x_of = |loc: f32| bar.left() + loc.clamp(0.0, 1.0) * bar.width();
+    let loc_of = |x: f32| ((x - bar.left()) / bar.width().max(1.0)).clamp(0.0, 1.0);
+    if let Some(ramp) = gf::Ramp::new(&unreversed(fill)) {
+        crate::gradient_ui::paint_ramp(ui.painter(), bar, |u| ramp.sample(u));
+    }
+    ui.painter().rect_stroke(bar, 0.0, Stroke::new(1.0, t.field_border), StrokeKind::Outside);
+    let (cs, os, mids) = sorted_stops(fill);
+    let (drag_key, selection_key) = (id.with("stops-drag"), selection_key(id));
+    let drag: Option<Drag> = ui.data(|d| d.get_temp(drag_key));
+    let selected: Option<Marker> = Some(drag.as_ref().map_or_else(|| selection(ui, id, fill), |d| d.marker));
+    let p = ui.painter();
+    let outline = |sel: bool| if sel { t.accent } else { t.text_dim };
+    for (i, (loc, c)) in cs.iter().enumerate() {
+        let x = x_of(*loc);
+        let sel = selected == Some(Marker::Color(i));
+        let body = Rect::from_center_size(pos2(x, bar.bottom() + 10.0), vec2(10.0, 10.0));
+        p.add(egui::Shape::convex_polygon(vec![pos2(x, bar.bottom() + 1.0), pos2(x + 5.0, body.top()), pos2(x - 5.0, body.top())], outline(sel), Stroke::NONE));
+        let [r, g, b, _] = rgba_of(c);
+        p.rect_filled(body, 1.0, rgba32([r, g, b, 1.0]));
+        p.rect_stroke(body, 1.0, Stroke::new(1.0, outline(sel)), StrokeKind::Outside);
+    }
+    let mid_x = |i: usize| -> Option<f32> {
+        let (a, b) = (cs.get(i)?.0, cs.get(i + 1)?.0);
+        (b - a > 1e-3).then(|| x_of(a + (b - a) * mids.get(i).copied().unwrap_or(0.5)))
+    };
+    for i in 0..cs.len().saturating_sub(1) {
+        if let Some(x) = mid_x(i) {
+            let sel = selected == Some(Marker::Mid(i));
+            crate::gradient_ui::diamond(p, pos2(x, bar.bottom() + 6.0), 3.0, if sel { t.accent } else { t.text_faint }, t.text_faint);
+        }
+    }
+    for (i, (loc, a)) in os.iter().enumerate() {
+        let x = x_of(*loc);
+        let sel = selected == Some(Marker::Opacity(i));
+        let body = Rect::from_center_size(pos2(x, bar.top() - 10.0), vec2(10.0, 10.0));
+        p.add(egui::Shape::convex_polygon(
+            vec![pos2(x, bar.top() - 1.0), pos2(x + 5.0, body.bottom()), pos2(x - 5.0, body.bottom())],
+            outline(sel),
+            Stroke::NONE,
+        ));
+        p.rect_filled(body, 1.0, egui::Color32::from_gray((a.clamp(0.0, 1.0) * 255.0) as u8));
+        p.rect_stroke(body, 1.0, Stroke::new(1.0, outline(sel)), StrokeKind::Outside);
+    }
+    let hit = |pos: Pos2| -> Option<Marker> {
+        if pos.y > bar.bottom() {
+            if pos.y >= bar.bottom() + 3.0
+                && let Some(i) = cs.iter().position(|(l, _)| (x_of(*l) - pos.x).abs() <= 6.0)
+            {
+                return Some(Marker::Color(i));
+            }
+            return (0..cs.len().saturating_sub(1)).find(|i| mid_x(*i).is_some_and(|x| (x - pos.x).abs() <= 4.0)).map(Marker::Mid);
+        }
+        if pos.y < bar.top() {
+            return os.iter().position(|(l, _)| (x_of(*l) - pos.x).abs() <= 6.0).map(Marker::Opacity);
+        }
+        None
+    };
+    let mut out = None;
+    if resp.drag_started()
+        && let Some(pos) = ui.input(|i| i.pointer.press_origin())
+        && let Some(marker) = hit(pos)
+    {
+        ui.data_mut(|d| {
+            d.insert_temp(drag_key, Drag { marker, start: fill.clone() });
+            d.insert_temp(selection_key, marker);
+        });
+    }
+    if let Some(drag) = ui.data(|d| d.get_temp::<Drag>(drag_key)) {
+        let (start_cs, start_os, _) = sorted_stops(&drag.start);
+        let pos = resp.interact_pointer_pos();
+        if let Some(pos) = pos {
+            // Dragged well off the strip, a stop is deleted (while at least two remain), as in Photoshop.
+            let off = pos.y > bar.bottom() + 28.0 || pos.y < bar.top() - 26.0;
+            let loc = loc_of(pos.x);
+            let edit = match drag.marker {
+                Marker::Color(i) if off && start_cs.len() > 2 => json!({"action": "delete", "index": i}),
+                Marker::Color(i) => json!({"action": "move", "index": i, "location": loc}),
+                Marker::Opacity(i) if off && start_os.len() > 2 => json!({"action": "delete", "kind": "opacity", "index": i}),
+                Marker::Opacity(i) => json!({"action": "move", "kind": "opacity", "index": i, "location": loc}),
+                Marker::Mid(i) => {
+                    let (a, b) = (start_cs.get(i).map_or(0.0, |s| s.0), start_cs.get(i + 1).map_or(1.0, |s| s.0));
+                    json!({"action": "midpoint", "index": i, "location": ((loc - a) / (b - a).max(1e-4)).clamp(0.05, 0.95)})
+                }
+            };
+            out = apply(&drag.start, &edit, fg, bg);
+            if resp.drag_stopped() {
+                let moved = edit.get("location").and_then(Value::as_f64).map(|l| l as f32);
+                let selection = match (drag.marker, edit.get("action").and_then(Value::as_str), moved) {
+                    (Marker::Color(i), Some("move"), Some(l)) => Some(Marker::Color(index_after_move(&start_cs.iter().map(|s| s.0).collect::<Vec<_>>(), i, l))),
+                    (Marker::Opacity(i), Some("move"), Some(l)) => {
+                        Some(Marker::Opacity(index_after_move(&start_os.iter().map(|s| s.0).collect::<Vec<_>>(), i, l)))
+                    }
+                    (Marker::Mid(i), ..) => Some(Marker::Mid(i)),
+                    _ => None,
+                };
+                ui.data_mut(|d| match selection {
+                    Some(m) => {
+                        d.insert_temp(selection_key, m);
+                    }
+                    None => d.remove::<Marker>(selection_key),
+                });
+            }
+        }
+        if resp.drag_stopped() || pos.is_none() {
+            ui.data_mut(|d| d.remove::<Drag>(drag_key));
+        }
+        return out;
+    }
+    // Double-clicking a colour stop opens its colour, as Photoshop's opens the Color Picker. egui
+    // counts a click within 0.6 s of the one before last as a triple click (a preset picked just
+    // before), which is a double click on the stop all the same.
+    if (resp.double_clicked() || resp.triple_clicked())
+        && let Some(pos) = resp.interact_pointer_pos()
+        && let Some(marker @ Marker::Color(_)) = hit(pos)
+    {
+        ui.data_mut(|d| {
+            d.insert_temp(selection_key, marker);
+            d.insert_temp(picker_key(id), true);
+        });
+        return None;
+    }
+    if resp.clicked()
+        && let Some(pos) = resp.interact_pointer_pos()
+    {
+        if let Some(marker) = hit(pos) {
+            ui.data_mut(|d| d.insert_temp(selection_key, marker));
+            return None;
+        }
+        // A click on the ramp adds a stop there: an opacity stop above its middle, a colour stop below.
+        let loc = loc_of(pos.x);
+        let opacity = pos.y < bar.center().y;
+        let (edit, marker) = if opacity {
+            (json!({"action": "add", "kind": "opacity", "location": loc}), Marker::Opacity(os.iter().filter(|s| s.0 <= loc).count()))
+        } else {
+            (json!({"action": "add", "location": loc}), Marker::Color(cs.iter().filter(|s| s.0 <= loc).count()))
+        };
+        out = apply(fill, &edit, fg, bg);
+        if out.is_some() {
+            ui.data_mut(|d| d.insert_temp(selection_key, marker));
+        }
+    }
+    out
+}
+
+/// The selected stop's fields under the strip: a colour stop's colour (an inline picker opened
+/// from its swatch), an opacity stop's opacity, a midpoint's position; Location and Delete.
+fn stop_fields(ui: &mut egui::Ui, fill: &Fill, id: egui::Id, fg: [f32; 4], bg: [f32; 4]) -> Option<Fill> {
+    let t = Tokens::get(ui.ctx());
+    let selection_key = selection_key(id);
+    let selected = selection(ui, id, fill);
+    let (cs, os, mids) = sorted_stops(fill);
+    let label = |ui: &mut egui::Ui, s: &str| ui.label(egui::RichText::new(s).color(t.text_dim).size(12.0));
+    let mut edit: Option<Value> = None;
+    let mut reselect: Option<Marker> = None;
+    let (locations, index): (Vec<f32>, usize) = match selected {
+        Marker::Color(i) => (cs.iter().map(|s| s.0).collect(), i),
+        Marker::Opacity(i) => (os.iter().map(|s| s.0).collect(), i),
+        Marker::Mid(i) => (Vec::new(), i),
+    };
+    let picker_key = picker_key(id);
+    let mut picker_open = ui.data(|d| d.get_temp::<bool>(picker_key)).unwrap_or(false);
+    ui.horizontal(|ui| match selected {
+        Marker::Color(i) => {
+            let Some((_, c)) = cs.get(i) else { return };
+            label(ui, tl!("Color"));
+            let (r, resp) = ui.allocate_exact_size(vec2(40.0, 20.0), Sense::click());
+            let [cr, cg, cb, _] = rgba_of(c);
+            ui.painter().rect_filled(r.shrink(1.0), t.radius_sm, rgba32([cr, cg, cb, 1.0]));
+            ui.painter().rect_stroke(r, t.radius_sm, Stroke::new(1.0, if picker_open { t.accent } else { t.field_border }), StrokeKind::Inside);
+            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ColorWell, true, tl!("Color")));
+            if resp.on_hover_text(tl!("Color")).clicked() {
+                picker_open = !picker_open;
+            }
+        }
+        Marker::Opacity(i) => {
+            let Some((_, a)) = os.get(i) else { return };
+            label(ui, tl!("Opacity"));
+            let mut v = a * 100.0;
+            if crate::widgets::value_field(ui, &mut v, 0.0..=100.0, "%", 52.0).changed() {
+                edit = Some(json!({"action": "opacity", "kind": "opacity", "index": i, "opacity": v}));
+            }
+        }
+        Marker::Mid(i) => {
+            if cs.get(i.saturating_add(1)).is_none() {
+                return;
+            }
+            label(ui, tl!("Location"));
+            let mut v = mids.get(i).copied().unwrap_or(0.5) * 100.0;
+            if crate::widgets::value_field(ui, &mut v, 5.0..=95.0, "%", 52.0).changed() {
+                edit = Some(json!({"action": "midpoint", "index": i, "location": v / 100.0}));
+            }
+        }
+    });
+    if let Some(loc) = locations.get(index).copied() {
+        let kind = if matches!(selected, Marker::Opacity(_)) { "opacity" } else { "color" };
+        ui.horizontal(|ui| {
+            label(ui, tl!("Location"));
+            let mut v = loc * 100.0;
+            if crate::widgets::value_field(ui, &mut v, 0.0..=100.0, "%", 52.0).changed() {
+                let to = v / 100.0;
+                edit = Some(json!({"action": "move", "kind": kind, "index": index, "location": to}));
+                reselect = Some(match selected {
+                    Marker::Opacity(_) => Marker::Opacity(index_after_move(&locations, index, to)),
+                    _ => Marker::Color(index_after_move(&locations, index, to)),
+                });
+            }
+            // A gradient keeps at least two stops of each kind.
+            if locations.len() > 2 && crate::widgets::secondary_button(ui, tl!("Delete"), 0.0).clicked() {
+                edit = Some(json!({"action": "delete", "kind": kind, "index": index}));
+                reselect = Some(match selected {
+                    Marker::Opacity(_) => Marker::Opacity(index.saturating_sub(1)),
+                    _ => Marker::Color(index.saturating_sub(1)),
+                });
+            }
+        });
+    }
+    if let (Marker::Color(i), true) = (selected, picker_open)
+        && let Some((_, c)) = cs.get(i)
+    {
+        // The stop's colour keeps its own alpha; transparency belongs to the opacity stops.
+        let rgba = rgba_of(c);
+        let cache = id.with(("stop-hsva", i));
+        let mut hsva = ui
+            .data(|d| d.get_temp::<([f32; 4], egui::ecolor::Hsva)>(cache))
+            .filter(|(previous, _)| *previous == rgba)
+            .map_or_else(|| picker_color(rgba), |(_, h)| h);
+        if egui::color_picker::color_picker_hsva_2d(ui, &mut hsva, egui::color_picker::Alpha::Opaque) {
+            let [r, g, b, _] = picker_rgba(hsva);
+            if [r, g, b].iter().zip(rgba).any(|(a, b)| (a - b).abs() > 0.000001) {
+                let color = [r, g, b, rgba[3]];
+                edit = Some(json!({"action": "color", "index": i, "color": color}));
+                ui.data_mut(|d| d.insert_temp(cache, (color, hsva)));
+            }
+        } else {
+            ui.data_mut(|d| d.insert_temp(cache, (rgba, hsva)));
+        }
+    }
+    ui.data_mut(|d| d.insert_temp(picker_key, picker_open));
+    let out = apply(fill, &edit?, fg, bg)?;
+    if let Some(m) = reselect {
+        ui.data_mut(|d| d.insert_temp(selection_key, m));
+    }
+    Some(out)
+}
diff --git a/crates/ui-egui/src/shape_options.rs b/crates/ui-egui/src/shape_options.rs
index ea93972567..8271388f25 100644
--- a/crates/ui-egui/src/shape_options.rs
+++ b/crates/ui-egui/src/shape_options.rs
@@ -4,7 +4,8 @@ use photocraft_doc::LayerContent;
 use serde_json::{Value, json};
 
 use crate::PhotocraftApp;
-use crate::shape_paint_ui::{PaintChange, swatch};
+use crate::shape_gradient_ui::GradientChoices;
+use crate::shape_paint_ui::{PaintChange, paint_param, swatch};
 use crate::state::Tool;
 use crate::theme::Tokens;
 use crate::vector_ui::{enabled_stroke_width, paint_gesture};
@@ -34,7 +35,9 @@ fn selected_shape(session: &photocraft_engine::Session) -> Option<SelectedShape>
 pub(crate) fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) {
     let t = Tokens::get(ui.ctx());
     let lbl = |ui: &mut egui::Ui, s: &str| {
-        ui.label(egui::RichText::new(s).color(t.text_dim).size(12.0));
+        let label = ui.label(egui::RichText::new(s).color(t.text_dim).size(12.0));
+        // The caption scrubs and names the control drawn right after it.
+        crate::widgets::scrub_option_label(ui, &label);
     };
     let o = &mut app.ui.tool_options;
     let target = selected_shape(&app.session);
@@ -42,30 +45,36 @@ pub(crate) fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool
     let (fg, bg) = (app.session.tools.foreground, app.session.tools.background);
     let (mut has_fill, fill, stroke) = match &target {
         Some(s) => (s.fill.is_some(), s.fill.clone(), s.stroke.clone()),
-        None => (o.shape_fill, o.shape_fill.then(|| solid(fg)), (o.stroke_width > 0.0).then(|| o.shape_stroke.stroke(o.stroke_width, solid(bg)))),
+        None => {
+            let fill = o.shape_fill_gradient.clone().unwrap_or_else(|| solid(fg));
+            let stroke = o.shape_stroke_gradient.clone().unwrap_or_else(|| solid(bg));
+            (o.shape_fill, o.shape_fill.then_some(fill), (o.stroke_width > 0.0).then(|| o.shape_stroke.stroke(o.stroke_width, stroke)))
+        }
     };
+    let mut gradients =
+        GradientChoices { presets: &app.session.presets.gradients, current: &app.session.presets.gradient, recent: &mut app.ui.recent_gradients, fg, bg };
     let mut width = stroke.as_ref().map_or(0.0, |s| s.width);
     let stroke_enabled = stroke.as_ref().is_some_and(|s| s.width > 0.0);
     let style = stroke.as_ref().map_or_else(|| o.shape_stroke.clone(), crate::shape_stroke_ui::StrokeOptions::from);
-    let gesture_key = ui.id().with("shape-options-paint-gesture");
+    let gesture_key = ui.scope_id().with("shape-options-paint-gesture");
     let gesture = paint_gesture(ui, gesture_key);
     let key = |k: &str| target.as_ref().map(|s| format!("shape-options-{:?}-{}-{k}:{}:{gesture}", s.doc, s.layer.0, gesture_key.value()));
     let mut edit: Option<Value> = None;
     lbl(ui, tl!("Fill:"));
-    if crate::widgets::checkbox(ui, &mut has_fill, "").changed() {
+    if crate::widgets::checkbox(ui, &mut has_fill, tl!("Fill")).changed() {
         o.shape_fill = has_fill;
-        edit = Some(json!({"fill": if has_fill { json!(fg) } else { Value::Null }}));
+        edit = Some(json!({"fill": if has_fill { o.shape_fill_gradient.as_ref().map_or_else(|| json!(fg), paint_param) } else { Value::Null }}));
     }
-    let fill_color = swatch(ui, fill.as_ref(), fg, tl!("Fill color"));
+    let fill_color = swatch(ui, fill.as_ref(), fg, tl!("Fill color"), &mut gradients);
     lbl(ui, tl!("Stroke:"));
-    let stroke_color = swatch(ui, stroke.as_ref().map(|s| &s.paint), bg, tl!("Stroke color"));
-    if crate::widgets::value_field(ui, &mut width, 0.0..=288.0, "px", 58.0).changed() {
+    let stroke_color = swatch(ui, stroke.as_ref().map(|s| &s.paint), bg, tl!("Stroke color"), &mut gradients);
+    if crate::widgets::value_field(ui, &mut width, 0.0..=288.0, "px", 58.0).accessible_name(tl!("Stroke:")).changed() {
         o.stroke_width = width;
         // A 0 px "change" (an arrow step clamped at the minimum) must not add a stroke.
         if stroke.is_some() || width > 0.0 {
             let mut p = json!({"width": width});
             if stroke.is_none() {
-                p["color"] = json!(bg);
+                p["color"] = o.shape_stroke_gradient.as_ref().map_or_else(|| json!(bg), paint_param);
             }
             edit = Some(json!({"stroke": p, "coalesce": key("stroke-w")}));
         }
@@ -79,7 +88,7 @@ pub(crate) fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool
             p["width"] = json!(3.0);
         }
         if stroke.is_none() {
-            p["color"] = json!(bg);
+            p["color"] = o.shape_stroke_gradient.as_ref().map_or_else(|| json!(bg), paint_param);
         }
         edit = Some(json!({"stroke": p, "coalesce": change.coalesce}));
         o.shape_stroke = change.options;
@@ -132,15 +141,17 @@ pub(crate) fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool
     }
     for (is_stroke, change) in [(false, fill_color), (true, stroke_color)] {
         let Some(change) = change else { continue };
-        if let Err(e) = set_tool_paint(app, is_stroke, change) {
+        if let Err(e) = set_tool_paint(app, is_stroke, change.clone()) {
             app.ui.status = e;
             app.ui.status_error = true;
         }
         edit = Some(match (is_stroke, change) {
             (false, PaintChange::None) => json!({"fill": null}),
             (false, PaintChange::Color(color)) => json!({"fill": color, "coalesce": key("fill")}),
+            (false, PaintChange::Gradient(g)) => json!({"fill": paint_param(&g), "coalesce": key("fill")}),
             (true, PaintChange::None) => json!({"stroke": null}),
             (true, PaintChange::Color(color)) => json!({"stroke": {"color": color, "width": enabled_stroke_width(width)}, "coalesce": key("stroke")}),
+            (true, PaintChange::Gradient(g)) => json!({"stroke": {"color": paint_param(&g), "width": enabled_stroke_width(width)}, "coalesce": key("stroke")}),
         });
     }
     if let (Some(mut p), Some(s)) = (edit, &target) {
@@ -160,6 +171,14 @@ pub(crate) fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool
 
 /// Tool-bar paint changes affect the next shape; Properties edits the selected shape instead.
 pub(crate) fn set_tool_paint(app: &mut PhotocraftApp, stroke: bool, change: PaintChange) -> Result<(), String> {
+    // A colour takes the place of a gradient; No Color keeps it for when the paint comes back.
+    let o = &mut app.ui.tool_options;
+    let gradient = if stroke { &mut o.shape_stroke_gradient } else { &mut o.shape_fill_gradient };
+    match &change {
+        PaintChange::Gradient(g) => *gradient = Some(g.clone()),
+        PaintChange::Color(_) => *gradient = None,
+        PaintChange::None => {}
+    }
     if let PaintChange::Color(color) = change {
         app.run("tools.setColors", if stroke { json!({"background": color}) } else { json!({"foreground": color}) })?;
     }
diff --git a/crates/ui-egui/src/shape_paint_ui.rs b/crates/ui-egui/src/shape_paint_ui.rs
index 77255d38dd..b256bcf661 100644
--- a/crates/ui-egui/src/shape_paint_ui.rs
+++ b/crates/ui-egui/src/shape_paint_ui.rs
@@ -2,36 +2,58 @@
 
 use egui::{Color32, Sense, Stroke, vec2};
 
+use serde_json::{Value, json};
+
+use crate::shape_gradient_ui::{self as shape_gradient, GradientChoices};
 use crate::theme::Tokens;
 
 pub(crate) fn color_of(f: &photocraft_doc::Fill) -> Option<[f32; 4]> {
     match f {
-        photocraft_doc::Fill::Solid(c) => {
-            let [r, g, b] = c.to_rgb();
-            Some([r, g, b, c.alpha])
-        }
+        photocraft_doc::Fill::Solid(c) => Some(rgba_of(c)),
         _ => None,
     }
 }
 
-#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) fn rgba_of(c: &photocraft_doc::Color) -> [f32; 4] {
+    let [r, g, b] = c.to_rgb();
+    [r, g, b, c.alpha]
+}
+
+/// A solid or gradient paint exactly as `shape.create` / `shape.edit` take it: float RGBA, the
+/// gradient's stops as stored colours (a CMYK or Lab stop keeps its model) and every gradient
+/// field, so a swatch edit (angle, style…) keeps the rest of the gradient. The swatches never
+/// hand it a pattern (they don't offer one).
+pub(crate) fn paint_param(f: &photocraft_doc::Fill) -> Value {
+    match f {
+        photocraft_doc::Fill::Gradient { stops, angle, scale, style, reverse, opacity_stops, midpoints, offset, dither, align } => json!({"gradient": {
+            "stops": stops.iter().map(|(t, c)| json!([t, c])).collect::<Vec<_>>(),
+            "angle": angle, "scale": scale * 100.0, "style": format!("{style:?}").to_ascii_lowercase(), "reverse": reverse,
+            "opacityStops": opacity_stops, "midpoints": midpoints, "offset": [offset.0, offset.1], "dither": dither, "align": align,
+        }}),
+        other => json!(color_of(other)),
+    }
+}
+
+#[derive(Clone, Debug, PartialEq)]
 pub(crate) enum PaintChange {
     Color([f32; 4]),
+    /// A `Fill::Gradient` (the swatch's Gradient tab).
+    Gradient(photocraft_doc::Fill),
     None,
 }
 
-fn rgba32(c: [f32; 4]) -> Color32 {
+pub(crate) fn rgba32(c: [f32; 4]) -> Color32 {
     let b = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as u8;
     Color32::from_rgba_unmultiplied(b(c[0]), b(c[1]), b(c[2]), b(c[3]))
 }
 
-fn picker_color(c: [f32; 4]) -> egui::ecolor::Hsva {
+pub(crate) fn picker_color(c: [f32; 4]) -> egui::ecolor::Hsva {
     let linear = egui::ecolor::linear_from_gamma;
     let display = c.map(|v| if v.is_finite() { v.clamp(0.0, 1.0) } else { 0.0 });
     egui::ecolor::Hsva::from_rgba_unmultiplied(linear(display[0]), linear(display[1]), linear(display[2]), display[3])
 }
 
-fn picker_rgba(hsva: egui::ecolor::Hsva) -> [f32; 4] {
+pub(crate) fn picker_rgba(hsva: egui::ecolor::Hsva) -> [f32; 4] {
     let [r, g, b, a] = hsva.to_rgba_unmultiplied();
     let gamma = egui::ecolor::gamma_from_linear;
     [gamma(r), gamma(g), gamma(b), a]
@@ -39,10 +61,16 @@ fn picker_rgba(hsva: egui::ecolor::Hsva) -> [f32; 4] {
 
 /// The shared compact picker keeps the float RGB paint and its alpha. Color32 is only display
 /// data: opening the picker must never quantize an existing high-depth colour or enable paint.
-pub(crate) fn swatch(ui: &mut egui::Ui, fill: Option<&photocraft_doc::Fill>, fallback: [f32; 4], tip: &str) -> Option<PaintChange> {
+pub(crate) fn swatch(
+    ui: &mut egui::Ui,
+    fill: Option<&photocraft_doc::Fill>,
+    fallback: [f32; 4],
+    tip: &str,
+    gradients: &mut GradientChoices,
+) -> Option<PaintChange> {
     let t = Tokens::get(ui.ctx());
     let (r, resp) = ui.allocate_exact_size(vec2(30.0, 22.0), Sense::click());
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::ColorButton, ui.is_enabled(), tip));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ColorWell, ui.is_enabled(), tip));
     let current = fill.and_then(color_of);
     crate::widgets::checker(ui.painter(), r.shrink(1.0), 4.0);
     match (current, fill) {
@@ -98,7 +126,9 @@ pub(crate) fn swatch(ui: &mut egui::Ui, fill: Option<&photocraft_doc::Fill>, fal
     if let Some(PaintChange::Color(color)) = out {
         hsva = picker_color(color);
     }
-    crate::widgets::swatch_popup(&resp).show(|ui| {
+    let gradient = fill.filter(|f| matches!(f, photocraft_doc::Fill::Gradient { .. }));
+    let popup_id = resp.id;
+    let shown = crate::widgets::swatch_popup(&resp).show(|ui| {
         ui.horizontal(|ui| {
             if ui.selectable_label(fill.is_none(), tl!("No Color")).clicked() && fill.is_some() {
                 out = Some(PaintChange::None);
@@ -106,8 +136,17 @@ pub(crate) fn swatch(ui: &mut egui::Ui, fill: Option<&photocraft_doc::Fill>, fal
             if ui.selectable_label(current.is_some(), tl!("Solid")).clicked() && current.is_none() {
                 out = Some(PaintChange::Color(original));
             }
+            if ui.selectable_label(gradient.is_some(), tl!("Gradient")).clicked() && gradient.is_none() {
+                out = Some(PaintChange::Gradient(gradients.default_fill()));
+            }
         });
         ui.separator();
+        if let Some(g) = gradient {
+            if let Some(edited) = shape_gradient::gradient_tab(ui, g, gradients, popup_id) {
+                out = Some(PaintChange::Gradient(edited));
+            }
+            return;
+        }
         let before = picker_rgba(hsva);
         if egui::color_picker::color_picker_hsva_2d(ui, &mut hsva, egui::color_picker::Alpha::OnlyBlend) {
             let color = picker_rgba(hsva);
@@ -152,6 +191,17 @@ pub(crate) fn swatch(ui: &mut egui::Ui, fill: Option<&photocraft_doc::Fill>, fal
             hsva = picker_color([rgb[0], rgb[1], rgb[2], original[3]]);
         }
     });
+    // The gradient a swatch's popup closes on joins the Gradient tab's Recent row.
+    let open_key = popup_id.with("open");
+    let was_open = ui.data(|d| d.get_temp::<bool>(open_key)).unwrap_or(false);
+    let open = shown.is_some();
+    if was_open
+        && !open
+        && let Some(g) = gradient
+    {
+        gradients.remember(g);
+    }
+    ui.data_mut(|d| d.insert_temp(open_key, open));
     let cached_color = match out {
         Some(PaintChange::Color(color)) => color,
         _ => original,
diff --git a/crates/ui-egui/src/shape_stroke_ui.rs b/crates/ui-egui/src/shape_stroke_ui.rs
index e568403c43..ea5b04d942 100644
--- a/crates/ui-egui/src/shape_stroke_ui.rs
+++ b/crates/ui-egui/src/shape_stroke_ui.rs
@@ -94,7 +94,7 @@ pub fn paint_shape_preview(painter: &egui::Painter, shape: &photocraft_doc::Shap
     if !clip.is_finite() || clip.is_negative() {
         return;
     }
-    let id = egui::Id::new("shape-drag-render");
+    let id = egui::Id::unique("shape-drag-render");
     let cached = painter.ctx().data(|d| d.get_temp::<DragCache>(id));
     let cache = cached.filter(|c| c.shape == *shape && c.clip == clip).or_else(|| {
         let scale = (2048.0 / clip.width().max(clip.height()).max(1.0)).min(1.0);
@@ -136,19 +136,19 @@ mod editor;
 pub use editor::{StrokeEditor, button};
 
 fn open_frame_id() -> egui::Id {
-    egui::Id::new("shape-stroke-open-frame")
+    egui::Id::unique("shape-stroke-open-frame")
 }
 
 pub(super) fn mark_rendered(ctx: &egui::Context, key: &str) {
     let pass = ctx.cumulative_pass_nr();
-    ctx.data_mut(|d| d.insert_temp(egui::Id::new(("shape-stroke-rendered", key)), pass));
+    ctx.data_mut(|d| d.insert_temp(egui::Id::unique(("shape-stroke-rendered", key)), pass));
 }
 
 /// A hidden options row or collapsed Appearance section no longer owns input.
 /// Called after all options bars and Properties windows have had a chance to draw.
 pub(crate) fn finish_frame(app: &mut crate::PhotocraftApp, ctx: &egui::Context) {
     let Some(e) = &app.ui.stroke_editor else { return };
-    let shown = ctx.data(|d| d.get_temp::<u64>(egui::Id::new(("shape-stroke-rendered", e.key.as_str()))));
+    let shown = ctx.data(|d| d.get_temp::<u64>(egui::Id::unique(("shape-stroke-rendered", e.key.as_str()))));
     if shown != Some(ctx.cumulative_pass_nr()) {
         editor::close_children(ctx, &e.key);
         app.ui.stroke_editor = None;
@@ -174,7 +174,7 @@ pub(crate) fn dismiss_from_canvas(app: &mut crate::PhotocraftApp, response: &egu
         ctx.request_repaint();
     }
     ctx.data_mut(|d| {
-        let state = d.get_temp_mut_or_default::<CanvasDismissal>(egui::Id::new("shape-stroke-canvas-dismissal"));
+        let state = d.get_temp_mut_or_default::<CanvasDismissal>(egui::Id::unique("shape-stroke-canvas-dismissal"));
         state.held |= dismiss;
         let consumed = state.held || state.consumed_frame == Some(frame);
         if consumed {
diff --git a/crates/ui-egui/src/shape_stroke_ui/editor.rs b/crates/ui-egui/src/shape_stroke_ui/editor.rs
index d10b90ab37..4d0e44678b 100644
--- a/crates/ui-egui/src/shape_stroke_ui/editor.rs
+++ b/crates/ui-egui/src/shape_stroke_ui/editor.rs
@@ -28,7 +28,7 @@ struct Children {
 }
 
 pub(super) fn close_children(ctx: &egui::Context, key: &str) {
-    let ids = ctx.data_mut(|d| d.remove_temp::<Vec<egui::Id>>(egui::Id::new(("stroke-children", key)))).unwrap_or_default();
+    let ids = ctx.data_mut(|d| d.remove_temp::<Vec<egui::Id>>(egui::Id::unique(("stroke-children", key)))).unwrap_or_default();
     for id in ids {
         egui::Popup::close_id(ctx, id);
     }
@@ -44,9 +44,9 @@ fn style_button(ui: &mut egui::Ui, options: &StrokeOptions, label: &str, selecte
     let (rect, response) = ui.allocate_exact_size(vec2(width.max(galley.size().x + 92.0), height), Sense::click());
     response.widget_info(|| {
         if opener {
-            egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), tl!("Stroke Options"))
+            egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tl!("Stroke Options"))
         } else {
-            egui::WidgetInfo::selected(egui::WidgetType::RadioButton, ui.is_enabled(), selected, tl!(label))
+            egui::WidgetInfo::selected(egui::Role::RadioButton, ui.is_enabled(), selected, tl!(label))
         }
     });
     let active = selected || response.has_focus();
@@ -248,7 +248,7 @@ pub fn button(
     };
     let escape = ui.input(|i| i.key_pressed(egui::Key::Escape));
     let outside = popup.is_some_and(|p| p.response.clicked_elsewhere()) && !children.clicked && !response.clicked();
-    ui.data_mut(|d| d.insert_temp(egui::Id::new(("stroke-children", key)), children.ids));
+    ui.data_mut(|d| d.insert_temp(egui::Id::unique(("stroke-children", key)), children.ids));
     if outside || escape && !children.shown {
         close_children(ui.ctx(), key);
         *editor = None;
@@ -278,7 +278,7 @@ fn choice<T: Copy + PartialEq>(ui: &mut egui::Ui, label: &str, value: &mut T, ch
             }
         });
     press.after(&response.response);
-    response.response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::ComboBox, ui.is_enabled(), tl!(label)));
+    response.response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ComboBox, ui.is_enabled(), tl!(label)));
     let id = egui::Popup::default_response_id(&response.response);
     children.ids.push(id);
     if response.inner.is_some() {
diff --git a/crates/ui-egui/src/shape_stroke_ui/tests.rs b/crates/ui-egui/src/shape_stroke_ui/tests.rs
index b8def0f4c2..dac6d995ec 100644
--- a/crates/ui-egui/src/shape_stroke_ui/tests.rs
+++ b/crates/ui-egui/src/shape_stroke_ui/tests.rs
@@ -615,7 +615,7 @@ fn hidden_controls_and_collapsed_appearance_release_popup_and_keyboard_ownership
         h.run_steps(3);
         assert!(egui::Popup::is_any_open(&h.ctx));
         if collapsed {
-            h.ctx.data_mut(|d| d.insert_temp(egui::Id::new(("props-section", "appearance")), false));
+            h.ctx.data_mut(|d| d.insert_temp(egui::Id::unique(("props-section", "appearance")), false));
         } else {
             h.state_mut().show_controls = false;
         }
diff --git a/crates/ui-egui/src/shortcut_dispatch.rs b/crates/ui-egui/src/shortcut_dispatch.rs
index e7d8b3c36d..ef250cf7a2 100644
--- a/crates/ui-egui/src/shortcut_dispatch.rs
+++ b/crates/ui-egui/src/shortcut_dispatch.rs
@@ -22,11 +22,11 @@ pub enum Outcome {
 }
 
 fn log_id() -> egui::Id {
-    egui::Id::new("pc-shortcut-log")
+    egui::Id::unique("pc-shortcut-log")
 }
 
 fn dry_run_id() -> egui::Id {
-    egui::Id::new("pc-shortcut-dry-run")
+    egui::Id::unique("pc-shortcut-dry-run")
 }
 
 /// Tests: resolve and check shortcuts without running them (File › Exit, Open, browser links…).
@@ -128,7 +128,7 @@ pub enum Focus {
 
 /// Where [`claim_delete_keys`] keeps the id of the widget that owns ⌫ / Delete while focused.
 fn delete_owner_id() -> egui::Id {
-    egui::Id::new("shortcut_dispatch::delete_owner")
+    egui::Id::unique("shortcut_dispatch::delete_owner")
 }
 
 /// Called by a widget that has keyboard focus and uses ⌫ / Delete itself (the Curves graph):
@@ -287,6 +287,12 @@ pub(crate) fn delete_key_command(app: &PhotocraftApp, id: String) -> String {
         return id;
     }
     let Some(st) = app.session.active() else { return id };
+    // A targeted filter mask (FILE-215-3) takes a selection's Delete as a layer mask does: the
+    // selection fills with the background colour there. With no selection Photoshop deletes the
+    // layer, as below.
+    if app.filter_mask_targeted() && st.doc.selection.is_some() {
+        return "edit.fillBackground".into();
+    }
     let composite = st.channel_view.target == photocraft_engine::channel_cmds::ChannelTarget::Composite && st.doc.quick_mask.is_none();
     let has_mask = st.active_layer.and_then(|l| st.doc.layer(l)).is_some_and(|l| l.mask.is_some());
     let colors_off = st.channel_view.visible_colors(photocraft_engine::channel_cmds::color_count(&st.doc)) == 0;
diff --git a/crates/ui-egui/src/shortcut_dispatch/tests.rs b/crates/ui-egui/src/shortcut_dispatch/tests.rs
index b602a5a2b0..c09ebb2b12 100644
--- a/crates/ui-egui/src/shortcut_dispatch/tests.rs
+++ b/crates/ui-egui/src/shortcut_dispatch/tests.rs
@@ -114,7 +114,7 @@ fn put_focus(h: &mut Harness<'_, PhotocraftApp>, place: Place) {
         }
         Place::OpacityField => {
             // The Layers panel's Opacity field: the DragValue in the right dock reading 100.
-            let layers = crate::dock::last_rects(&h.ctx).into_iter().find(|(g, _)| *g == crate::dock::Group::Layers).expect("Layers drawn").1;
+            let layers = crate::panel_docking::probe::group_rect(h.state(), &h.ctx, "layers").expect("Layers drawn");
             let at = h
                 .query_all_by_role(Role::SpinButton)
                 .map(|n| n.rect())
@@ -572,6 +572,41 @@ fn delete_with_the_mask_targeted_edits_the_mask_not_the_layer() {
     }
 }
 
+/// FILE-215-3: with a smart object's filter mask targeted, Delete with a selection fills the filter
+/// mask with the background colour there (not Edit › Clear on the smart object); with no
+/// selection Photoshop deletes the layer, as it does with the pixels targeted.
+#[test]
+fn delete_with_the_filter_mask_targeted_edits_the_filter_mask() {
+    let mut h = harness();
+    put_focus(&mut h, Place::Canvas);
+    let s = &mut h.state_mut().session;
+    s.execute("layer.smartObjects.convertToSmartObject", json!({})).unwrap();
+    s.execute("filter.blur.gaussianBlur", json!({"radius": 2})).unwrap();
+    let layer = s.active().unwrap().active_layer.unwrap();
+    let sel = s.active().unwrap().doc.selection.as_ref().expect("the harness keeps a selection").content_bounds();
+    let (x, y) = ((sel.x0 + sel.x1) / 2, (sel.y0 + sel.y1) / 2);
+    h.state_mut().select_filter_mask_target(Some(layer.0));
+    assert!(h.state().filter_mask_targeted());
+    h.run_steps(2);
+    let smart = |h: &Harness<'_, PhotocraftApp>| match h.state().session.active().unwrap().doc.layer(layer).map(|l| &l.content) {
+        Some(photocraft_doc::LayerContent::Smart(sm)) => Some(sm.clone()),
+        _ => None,
+    };
+    let filters = smart(&h).unwrap().smart_filters.len();
+    let bg = h.state().session.tools.background;
+    press(&mut h, "Delete");
+    assert_eq!(logged(&h), ["edit.fillBackground"]);
+    let sm = smart(&h).expect("the smart object stays");
+    assert_eq!(sm.filter_mask.as_ref().map(|m| m.value(x, y)), Some(bg[0]), "the filter mask takes the background colour");
+    assert_eq!(bg[0], 0.0, "a targeted mask's background colour is black");
+    assert_eq!(sm.smart_filters.len(), filters);
+    h.state_mut().session.execute("select.deselect", json!({})).unwrap();
+    h.run_steps(2);
+    press(&mut h, "Delete");
+    assert_eq!(logged(&h), ["layer.delete"]);
+    assert!(smart(&h).is_none(), "no selection deletes the layer, as in Photoshop");
+}
+
 /// Every selected layer goes, pixel layers too (Photoshop deletes, it doesn't clear the layer).
 #[test]
 fn delete_without_a_selection_deletes_every_selected_layer() {
diff --git a/crates/ui-egui/src/shortcut_set_tests.rs b/crates/ui-egui/src/shortcut_set_tests.rs
index 2158a4209c..113f8b7193 100644
--- a/crates/ui-egui/src/shortcut_set_tests.rs
+++ b/crates/ui-egui/src/shortcut_set_tests.rs
@@ -155,7 +155,13 @@ fn pick_set(h: &mut Harness<'_, PhotocraftApp>, label: &str) {
     h.run_steps(1);
     h.drop_at(at);
     h.run_steps(3);
-    let option = h.query_all_by_label(label).rfind(|n| n.accesskit_node().role() != egui::accesskit::Role::ComboBox);
+    // The list rows are buttons; the combo's own value and any plain text also carry the name.
+    // A shortcut key in the table below may be labelled "A" too, so take the row nearest the
+    // combo that just opened, not the last match in the whole dialog.
+    let option = h
+        .query_all_by_label(label)
+        .filter(|n| n.accesskit_node().role() == egui::accesskit::Role::Button)
+        .min_by(|a, b| a.rect().center().distance(at).total_cmp(&b.rect().center().distance(at)));
     option.expect("the set in the open list").click();
     h.run_steps(3);
 }
diff --git a/crates/ui-egui/src/shortcuts.rs b/crates/ui-egui/src/shortcuts.rs
index 023bbb4d79..258b833819 100644
--- a/crates/ui-egui/src/shortcuts.rs
+++ b/crates/ui-egui/src/shortcuts.rs
@@ -225,6 +225,10 @@ fn clipboard_press(e: &egui::Event, mods: Modifiers, is_windows: bool) -> Option
         egui::Event::Cut if is_windows && mods.shift && !mods.command => Some((Key::Delete, mods)),
         egui::Event::Cut => Some((Key::X, held)),
         egui::Event::Paste(_) => Some((Key::V, held)),
+        // egui 0.37 emits this when the clipboard holds an image and no text. Treat it as the
+        // paste shortcut; the command reads the OS clipboard once through the existing import
+        // path, never a second time from this event.
+        egui::Event::PasteImage(_) => Some((Key::V, held)),
         _ => None,
     }
 }
@@ -235,7 +239,7 @@ fn clipboard_press(e: &egui::Event, mods: Modifiers, is_windows: bool) -> Option
 /// empty selection behind, which must not take ⌘C from the document. Read once a frame, from the
 /// frame before.
 fn label_text_selected(ctx: &egui::Context) -> bool {
-    let id = egui::Id::new("pc-label-text-selected");
+    let id = egui::Id::unique("pc-label-text-selected");
     let any = ctx.plugin_opt::<egui::text_selection::LabelSelectionState>().is_some_and(|p| p.lock().has_selection());
     let (selects, pressed) = ctx.input(|i| {
         let p = &i.pointer;
@@ -323,11 +327,11 @@ pub fn clipboard_keys(ctx: &egui::Context, typing: bool, raw: &mut egui::RawInpu
         });
         return;
     }
-    let seen = egui::Id::new("pc-paste-key-seen");
+    let seen = egui::Id::unique("pc-paste-key-seen");
     // A V press without ⌘ that reached us (the Move tool's key): its release is not a paste.
-    let plain_v = egui::Id::new("pc-plain-v-down");
+    let plain_v = egui::Id::unique("pc-plain-v-down");
     // ⌘ was held since the last key press without it: a swallowed ⌘V can be under way.
-    let command_lately = egui::Id::new("pc-paste-command-lately");
+    let command_lately = egui::Id::unique("pc-paste-command-lately");
     // The modifiers held at each event: last frame's, updated as the events report changes.
     let mut mods = ctx.input(|i| i.modifiers);
     if mods.command {
@@ -408,9 +412,79 @@ pub fn clipboard_keys(ctx: &egui::Context, typing: bool, raw: &mut egui::RawInpu
     raw.events = out;
 }
 
+/// The keys held down in floating panels' own OS windows, from the presses and releases they
+/// forwarded ([`handle_forwarded`]).
+fn forwarded_down_id() -> egui::Id {
+    egui::Id::unique("pc-forwarded-keys-down")
+}
+
+#[cfg(test)]
+pub(crate) fn forwarded_keys_down(ctx: &egui::Context) -> Vec<Key> {
+    ctx.data(|d| d.get_temp::<std::collections::BTreeSet<Key>>(forwarded_down_id())).unwrap_or_default().into_iter().collect()
+}
+
+/// Keys that a floating panel's own OS window left over (craft-ui's
+/// `DockOutput::forwarded_events`, with the modifiers held in that window) run through
+/// [`handle`] in the frame they arrive, as if pressed in the main window: tool keys, undo and
+/// the clipboard work while a floating window has the keyboard. craft-ui forwards nothing while
+/// one of that window's widgets has keyboard focus. egui-winit sends ⌘C, ⌘X and ⌘V there as
+/// `Copy`, `Cut` and `Paste` too, so [`clipboard_keys`] turns them into presses first.
+pub(crate) fn handle_forwarded(app: &mut PhotocraftApp, ctx: &egui::Context, events: Vec<egui::Event>, modifiers: Modifiers) {
+    if events.is_empty() {
+        return;
+    }
+    ctx.data_mut(|d| {
+        let down = d.get_temp_mut_or_default::<std::collections::BTreeSet<Key>>(forwarded_down_id());
+        for e in &events {
+            if let egui::Event::Key { key, pressed, .. } = e {
+                if *pressed {
+                    down.insert(*key);
+                } else {
+                    down.remove(key);
+                }
+            }
+        }
+    });
+    // The main window runs no shortcuts while the screen color picker is open.
+    if crate::screen_picker::busy(ctx) {
+        return;
+    }
+    let typing = ctx.text_edit_focused() || app.ui.text_edit.is_some();
+    let (events_before, modifiers_before) = ctx.input_mut(|i| (std::mem::take(&mut i.events), std::mem::replace(&mut i.modifiers, modifiers)));
+    let mut raw = egui::RawInput { events, ..Default::default() };
+    clipboard_keys(ctx, typing, &mut raw);
+    ctx.input_mut(|i| i.events = raw.events);
+    handle(app, ctx);
+    ctx.input_mut(|i| {
+        i.events = events_before;
+        i.modifiers = modifiers_before;
+    });
+}
+
+/// Runs the shortcuts on this frame's input. Keys still held in a floating panel's own window
+/// count as held (`key_down`) while that window has the keyboard: a spring-loaded tool or Space
+/// for the Hand tool stays on while the pointer moves over the canvas. Its releases stop coming
+/// once the main window or no window of the app has the keyboard, or one of its widgets takes
+/// keyboard focus, so the keys count as released then.
 pub fn handle(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    let held = !ctx.input(|i| i.focused) && crate::panel_docking::other_window_keyboard(ctx) == Some(false);
+    if !held {
+        ctx.data_mut(|d| d.remove_temp::<std::collections::BTreeSet<Key>>(forwarded_down_id()));
+    }
+    let down = if held { ctx.data(|d| d.get_temp::<std::collections::BTreeSet<Key>>(forwarded_down_id())).unwrap_or_default() } else { Default::default() };
+    let added: Vec<Key> = ctx.input_mut(|i| down.into_iter().filter(|k| i.keys_down.insert(*k)).collect());
+    handle_keys(app, ctx);
+    if !added.is_empty() {
+        ctx.input_mut(|i| added.iter().for_each(|k| _ = i.keys_down.remove(k)));
+    }
+}
+
+fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
     // A held tool letter released: a temporary tool gives the previous one back (#2672).
     crate::spring_tools::tick(app, ctx);
+    if crate::canvas::cancel_mixer_on_context_change(app, ctx) {
+        return;
+    }
     // However the tool was picked (toolbar, flyout, shortcut, automation), its group's key brings
     // it back later (#2608).
     app.ui.remember_group_tool();
@@ -443,8 +517,9 @@ pub fn handle(app: &mut PhotocraftApp, ctx: &egui::Context) {
         return;
     }
     // So does the right-click menu of text being edited: Esc closes only it, and keys typed while
-    // it is open don't reach the text beneath.
-    if app.ui.canvas_tool_menu.as_ref().is_some_and(|m| m.text) {
+    // it is open don't reach the text beneath. The crop menu's likewise: Esc and ↵ don't cancel or
+    // commit the crop under it (#6561).
+    if app.ui.canvas_tool_menu.as_ref().is_some_and(|m| m.text || m.crop.is_some()) {
         return;
     }
     let symmetry_editing = app.ui.symmetry_transform.is_some();
@@ -469,6 +544,10 @@ pub fn handle(app: &mut PhotocraftApp, ctx: &egui::Context) {
             crate::liquify_ui::keys(app, ctx);
         }
     }
+    // The Filter Gallery's preview takes the zoom keys from the canvas behind it.
+    if app.distort.gallery.is_some() && !ctx.text_edit_focused() {
+        crate::gallery_ui::keys(app, ctx);
+    }
     // The Content-Aware Fill workspace likewise.
     if app.distort.caf.is_some() && !ctx.text_edit_focused() {
         crate::caf_ui::keys(app, ctx);
@@ -717,7 +796,7 @@ pub fn handle(app: &mut PhotocraftApp, ctx: &egui::Context) {
         || app.save_options_open()
         || app.distort.gallery.is_some()
         || ctx.any_popup_open()
-        || ctx.data(|d| d.get_temp::<(egui::Id, egui::Rect)>(egui::Id::new("tool-flyout")).is_some());
+        || ctx.data(|d| d.get_temp::<(egui::Id, egui::Rect)>(egui::Id::unique("tool-flyout")).is_some());
     // Both full screen modes (with and without the menu bar) return to Standard, as in Photoshop
     // (#4116), through the menu command so the window and the Screen Mode check follow.
     if !esc_taken && app.ui.view.screen_mode != "standard" && pressed(Key::Escape) {
@@ -734,6 +813,9 @@ pub fn handle(app: &mut PhotocraftApp, ctx: &egui::Context) {
         }
         return;
     }
+    // ⇧+ / ⇧− step the blend mode and ⇧⌥ letters pick one (`blend_keys`). Before the tool
+    // letters: `consume_key` ignores extra ⇧ and ⌥, so ⇧⌥M would otherwise pick a tool.
+    crate::blend_keys::handle(app, ctx);
     // Tool keys; pressing the key of the current group cycles within it. With Preferences ›
     // Tools › Use Shift Key for Tool Switch, only ⇧+key cycles and the plain key keeps the
     // group's current tool. From another group, the key picks the group's last-used tool.
@@ -771,8 +853,6 @@ pub fn handle(app: &mut PhotocraftApp, ctx: &egui::Context) {
     }
     // 1–0 set opacity, ⇧1–0 flow or fill (`opacity_keys`).
     crate::opacity_keys::handle(app, ctx);
-    // ⇧+ / ⇧− step the blend mode (`blend_keys`).
-    crate::blend_keys::handle(app, ctx);
 }
 
 #[cfg(test)]
@@ -1182,6 +1262,10 @@ mod tests {
         assert_eq!(clipboard_press(&egui::Event::Cut, shift, false), Some((Key::X, Modifiers::COMMAND)));
         // Shift+Insert pastes on Windows.
         assert_eq!(clipboard_press(&egui::Event::Paste("x".into()), shift, true), Some((Key::V, Modifiers::COMMAND)));
+        // egui 0.37's image-only clipboard paste is the same ⌘V press; the command reads the
+        // clipboard itself, once, through the existing import path.
+        let image = std::sync::Arc::new(egui::ColorImage::filled([1, 1], egui::Color32::BLACK));
+        assert_eq!(clipboard_press(&egui::Event::PasteImage(image), shift, true), Some((Key::V, Modifiers::COMMAND)));
         // Through the raw-input hook on this platform; a text field keeps its Cut.
         let ctx = egui::Context::default();
         let cut = || egui::RawInput { events: vec![egui::Event::ModifiersChanged(shift), egui::Event::Cut], ..Default::default() };
diff --git a/crates/ui-egui/src/single_line_drag.rs b/crates/ui-egui/src/single_line_drag.rs
index 21e98f621e..a96acacba4 100644
--- a/crates/ui-egui/src/single_line_drag.rs
+++ b/crates/ui-egui/src/single_line_drag.rs
@@ -118,7 +118,7 @@ mod tests {
     /// [`TEXT`].
     fn drag(field: Field, from: impl Fn(Rect, f32) -> Pos2, to: impl Fn(Rect, f32) -> Pos2) -> (usize, usize) {
         let ctx = ctx();
-        let id = Id::new("single-line-drag-test");
+        let id = Id::unique("single-line-drag-test");
         let rect = frame(&ctx, field, id, vec![]);
         frame(&ctx, field, id, vec![]);
         let text_w = text_width(&ctx);
diff --git a/crates/ui-egui/src/sizing.rs b/crates/ui-egui/src/sizing.rs
index bf8adf549f..cdeacbbbee 100644
--- a/crates/ui-egui/src/sizing.rs
+++ b/crates/ui-egui/src/sizing.rs
@@ -189,7 +189,9 @@ fn dim_field(ui: &mut egui::Ui, f: &mut Map<String, Value>, key: &str, orig_key:
     // Each unit keeps its own precision: whole pixels, 3 places for inches, 2 for cm/mm/picas (#2434).
     // A typed unit (`2in` while in pixels) converts at the dialog's resolution.
     let units = crate::widgets::FieldUnits { unit: crate::widgets::unit_of_key(&unit), dpi: res, ppi };
-    let changed = crate::widgets::value_field_units(ui, &mut v, range, 90.0, crate::widgets::unit_decimals(&unit), units).changed();
+    let changed = crate::widgets::value_field_units(ui, &mut v, range, 90.0, crate::widgets::unit_decimals(&unit), units)
+        .accessible_name(if key == "width" { tl!("Width") } else { tl!("Height") })
+        .changed();
     if changed {
         let px = from_unit(v as f64, &unit, orig, res, ppi);
         f.insert(key.into(), json!(if unit == "px" { px.round() } else { px }));
@@ -201,7 +203,7 @@ fn dim_field(ui: &mut egui::Ui, f: &mut Map<String, Value>, key: &str, orig_key:
 fn unit_dropdown(ui: &mut egui::Ui, f: &mut Map<String, Value>, id: &str) {
     let mut unit = f.get("__unit").and_then(Value::as_str).unwrap_or("px").to_string();
     let opts: Vec<(String, &str)> = UNITS.iter().map(|(k, l)| (k.to_string(), *l)).collect();
-    if crate::widgets::dropdown(ui, id, &mut unit, &opts, 110.0) {
+    if crate::widgets::dropdown(ui, id, tl!("Units"), &mut unit, &opts, 110.0) {
         f.insert("__unit".into(), json!(unit));
     }
 }
@@ -263,7 +265,7 @@ fn image_size(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
     // Photoshop's chain bracket linking width and height (right of the unit dropdowns).
     let x0 = w_row.response.rect.right().max(h_row.response.rect.right()) + 4.0;
     let bracket = Rect::from_min_max(pos2(x0, w_row.response.rect.center().y), pos2(x0 + 14.0, h_row.response.rect.center().y));
-    let link = ui.interact(bracket.expand(2.0), ui.id().with("constrain"), Sense::click());
+    let link = ui.interact(bracket.expand(2.0), ui.scope_id().with("constrain"), Sense::click());
     let col = if constrain { t.text } else { t.text_faint };
     if constrain {
         let p = ui.painter();
@@ -290,7 +292,7 @@ fn image_size(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
     ui.horizontal(|ui| {
         label(ui, tl!("Resolution:"), 90.0);
         let mut r = f.get("resolution").and_then(Value::as_f64).unwrap_or(72.0) as f32;
-        if crate::widgets::value_field(ui, &mut r, 1.0..=30000.0, "", 90.0).changed() {
+        if crate::widgets::value_field(ui, &mut r, 1.0..=30000.0, "", 90.0).accessible_name(tl!("Resolution")).changed() {
             let r = r.max(1.0) as f64;
             if !resampling {
                 // Without resampling the pixel count is fixed: physical size follows resolution.
@@ -340,7 +342,7 @@ fn image_size(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
             // which the command doesn't use and a save quantises away (#6019).
             let indexed = f.get("__indexed").and_then(Value::as_bool) == Some(true);
             let opts: Vec<_> = opts.into_iter().filter(|(k, _)| !indexed || k == "automatic" || k == "nearest").collect();
-            if crate::widgets::dropdown(ui, "is-resample", &mut cur, &opts, 200.0) {
+            if crate::widgets::dropdown(ui, "is-resample", tl!("Resample"), &mut cur, &opts, 200.0) {
                 f.insert("resample".into(), json!(cur));
             }
         }
@@ -404,7 +406,7 @@ fn canvas_size(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
             ("black".to_string(), tl!("Black")),
             ("transparent".to_string(), tl!("Transparent")),
         ];
-        if crate::widgets::dropdown(ui, "cs-ext", &mut cur, &opts, 140.0) {
+        if crate::widgets::dropdown(ui, "cs-ext", tl!("Canvas extension color:"), &mut cur, &opts, 140.0) {
             f.insert("extensionColor".into(), json!(cur));
         }
     });
@@ -421,7 +423,7 @@ fn anchor_grid(ui: &mut egui::Ui, current: &str, dw: f64, dh: f64) -> Option<&'s
     for (i, a) in ANCHORS.iter().enumerate() {
         let (x, y) = (i as i32 % 3, i as i32 / 3);
         let r = Rect::from_min_size(rect.min + vec2(x as f32 * cell, y as f32 * cell), vec2(cell, cell)).shrink(1.0);
-        let resp = ui.interact(r, ui.id().with(("anchor", i)), Sense::click());
+        let resp = ui.interact(r, ui.scope_id().with(("anchor", i)), Sense::click());
         let selected = i as i32 == ci;
         ui.painter().rect_filled(
             r,
diff --git a/crates/ui-egui/src/slice_ui.rs b/crates/ui-egui/src/slice_ui.rs
index b81376b77c..f812f94c14 100644
--- a/crates/ui-egui/src/slice_ui.rs
+++ b/crates/ui-egui/src/slice_ui.rs
@@ -413,7 +413,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
         let o = &mut app.ui.tool_options;
         crate::panels::opt_label(ui, tl!("Style"));
         let styles = [("normal".to_string(), tl!("Normal")), ("fixedRatio".to_string(), tl!("Fixed Ratio")), ("fixedSize".to_string(), tl!("Fixed Size"))];
-        if crate::widgets::dropdown(ui, "slice-style", &mut o.slice_style, &styles, 96.0) {
+        if crate::widgets::dropdown(ui, "slice-style", tl!("Style"), &mut o.slice_style, &styles, 96.0) {
             (o.slice_width, o.slice_height) = if o.slice_style == "fixedSize" { (64.0, 64.0) } else { (1.0, 1.0) };
         }
         let fixed_size = o.slice_style == "fixedSize";
diff --git a/crates/ui-egui/src/smart_filter_dialog.rs b/crates/ui-egui/src/smart_filter_dialog.rs
index cf184c5671..dbe00fdf9b 100644
--- a/crates/ui-egui/src/smart_filter_dialog.rs
+++ b/crates/ui-egui/src/smart_filter_dialog.rs
@@ -149,7 +149,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, fields: &mut Map<String,
         ui.label(tl!("Mode"));
         let mut blend = fields.get("blend").and_then(Value::as_str).unwrap_or("Normal").to_string();
         let options: Vec<_> = BlendMode::LAYER_MODES.iter().map(|m| (m.label().to_string(), m.label())).collect();
-        if widgets::dropdown(ui, "smart-filter-blend", &mut blend, &options, 200.0) {
+        if widgets::dropdown(ui, "smart-filter-blend", tl!("Blend Mode"), &mut blend, &options, 200.0) {
             fields.insert("blend".into(), json!(blend));
         }
     });
@@ -193,7 +193,7 @@ fn viewport(app: &mut PhotocraftApp, ui: &mut egui::Ui, fields: &mut Map<String,
         });
         return;
     };
-    let key = ui.id().with("smart-filter-view-image");
+    let key = ui.scope_id().with("smart-filter-view-image");
     let mut image = ui.ctx().data(|d| d.get_temp::<ViewImage>(key));
     if image.as_ref().is_none_or(|i| !Arc::ptr_eq(&i.doc, &doc)) {
         // Fixed thumbnail size and content identity: never composite a full surface per frame.
diff --git a/crates/ui-egui/src/smart_ui.rs b/crates/ui-egui/src/smart_ui.rs
index 578130d5b5..0f0c87ad58 100644
--- a/crates/ui-egui/src/smart_ui.rs
+++ b/crates/ui-egui/src/smart_ui.rs
@@ -2,6 +2,8 @@
 //! (eye toggles; double-click a filter to re-open its dialog with the recorded parameters; click
 //! to select one; drag onto another smart object to move it there, ⌥-drag to copy it, #4271;
 //! drag it up or down its own stack to reorder it).
+//! The Smart Filters row carries the filter mask thumbnail: click it to paint the filter mask,
+//! ⌥-click to view it, ⇧-click to disable it (FILE-215-3).
 
 use egui::{Color32, Rect, Sense, Stroke, StrokeKind, pos2, vec2};
 use photocraft_doc::{Document, Layer, LayerContent, LayerId, SmartObject};
@@ -133,7 +135,7 @@ pub fn filter_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, doc: &Document, l
             Some(i) => (filter_label(&sm.smart_filters[i]), sm.smart_filters[i].visible && sm.filters_enabled),
         };
         let eye = Rect::from_center_size(pos2(rect.left() + indent + if index.is_none() { 9.0 } else { 41.0 }, rect.center().y), vec2(18.0, 18.0));
-        let eye_resp = ui.interact(eye, ui.id().with(("sf-eye", l.id.0, index)), Sense::click());
+        let eye_resp = ui.interact(eye, ui.scope_id().with(("sf-eye", l.id.0, index)), Sense::click());
         let shown = match index {
             None => sm.filters_enabled,
             Some(i) => sm.smart_filters[i].visible,
@@ -141,7 +143,7 @@ pub fn filter_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, doc: &Document, l
         if shown {
             icons::paint(ui, eye, "eye", 12.0, if on { t.icon } else { t.text_faint });
         }
-        eye_resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, shown, format!("{} {name}", tl!("Visibility"))));
+        eye_resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, true, shown, format!("{} {name}", tl!("Visibility"))));
         if eye_resp.clicked() {
             actions.push(match index {
                 None => ("layer.smartFilter.disableSmartFilters".into(), json!({"layer": l.id.0})),
@@ -169,6 +171,13 @@ pub fn filter_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, doc: &Document, l
                 ui.painter().rect_filled(sw, 0.0, Color32::WHITE);
             }
             ui.painter().rect_stroke(sw, 1.0, Stroke::new(1.0, t.field_border), egui::StrokeKind::Inside);
+            if app.ui.filter_mask_target == Some(l.id.0) && app.filter_mask_targeted() {
+                crate::mask_thumbs_ui::paint_brackets(ui.painter(), sw, t.text);
+            }
+            let sw_resp = ui.interact(sw.expand(2.0), ui.scope_id().with(("sf-mask", l.id.0)), Sense::click());
+            if sw_resp.clicked() {
+                actions.extend(filter_mask_click(l, sm, ui.input(|i| i.modifiers)));
+            }
         }
         let blend = index.map(|_| Rect::from_center_size(pos2(rect.right() - crate::layer_row_ui::RIGHT_PAD - 9.0, rect.center().y), vec2(18.0, 18.0)));
         let right = blend.map_or(rect.right() - crate::layer_row_ui::RIGHT_PAD, |r| r.left() - 4.0);
@@ -186,11 +195,11 @@ pub fn filter_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, doc: &Document, l
         // it does the same, but only the name carries the row's label and selected state.
         let name_resp = index.map(|i| {
             let name_rect = Rect::from_min_max(pos2(x.min(right), rect.top()), pos2(right, rect.bottom()));
-            ui.interact(name_rect, ui.id().with(("sf-name", l.id.0, i)), Sense::click_and_drag())
+            ui.interact(name_rect, ui.scope_id().with(("sf-name", l.id.0, i)), Sense::click_and_drag())
         });
         match &name_resp {
-            Some(r) => r.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, selected, &name)),
-            None => resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::SelectableLabel, true, selected, &name)),
+            Some(r) => r.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected, &name)),
+            None => resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected, &name)),
         }
         let hit = |f: fn(&egui::Response) -> bool| f(&resp) || name_resp.as_ref().is_some_and(f);
         if hit(egui::Response::drag_started) {
@@ -208,10 +217,10 @@ pub fn filter_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, doc: &Document, l
             open_editor(app, ui.ctx(), l.id.0, sm, i);
         }
         if let (Some(i), Some(r)) = (index, blend) {
-            let blend_resp = ui.interact(r, ui.id().with(("sf-blend", l.id.0, i)), Sense::click());
+            let blend_resp = ui.interact(r, ui.scope_id().with(("sf-blend", l.id.0, i)), Sense::click());
             icons::paint(ui, r, "sliders-horizontal", 13.0, if blend_resp.hovered() { t.text } else { t.icon });
             let label = crate::i18n::fmt(tl!("Blending Options ({filter})"), &[("filter", &name)]);
-            blend_resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &label));
+            blend_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &label));
             if blend_resp.double_clicked()
                 && let Err(e) = crate::smart_filter_dialog::open(app, l.id, i)
             {
@@ -228,23 +237,47 @@ pub fn filter_rows(app: &mut PhotocraftApp, ui: &mut egui::Ui, doc: &Document, l
     }
 }
 
+/// What a click on the filter mask thumbnail does: target it for painting (selecting the smart
+/// object), ⌥ view it alone (⇧⌥ as an overlay), ⇧ disable or enable it.
+fn filter_mask_click(l: &Layer, sm: &SmartObject, m: egui::Modifiers) -> Vec<(String, Value)> {
+    let layer = l.id.0;
+    if m.alt {
+        let mode = if m.shift { "toggleOverlay" } else { "toggleGray" };
+        return sm
+            .filter_mask
+            .is_some()
+            .then(|| (photocraft_engine::mask_view_cmds::ID.to_string(), json!({"layer": layer, "mode": mode, "mask": "filter"})))
+            .into_iter()
+            .collect();
+    }
+    if m.shift {
+        return sm
+            .filter_mask
+            .as_ref()
+            .map(|f| ("layer.smartFilter.disableFilterMask".to_string(), json!({"layer": layer, "enabled": !f.enabled})))
+            .into_iter()
+            .collect();
+    }
+    vec![("layer.select".into(), json!({"layer": layer})), ("ui.filterMaskTarget".into(), json!(layer))]
+}
+
 /// Smart filter rows being dragged: the smart object and the filter index (`None` = the Smart
 /// Filters row, all of them). Also what a click selects.
 pub(crate) type FilterDrag = (u64, Option<usize>);
 
 /// Memory key of the smart filter row being dragged.
 pub(crate) fn drag_key() -> egui::Id {
-    egui::Id::new("smart-filter-drag")
+    egui::Id::unique("smart-filter-drag")
 }
 
 /// The selected smart filter row of a document.
 fn selected_key(doc: photocraft_doc::DocId) -> egui::Id {
-    egui::Id::new(("smart-filter-selected", doc))
+    egui::Id::unique(("smart-filter-selected", doc))
 }
 
 /// The pass in which the selected smart filter row of a document was last drawn.
 fn drawn_key(doc: photocraft_doc::DocId) -> egui::Id {
-    egui::Id::new(("smart-filter-selected-drawn", doc))
+    egui::Id::unique(("smart-filter-selected-drawn", doc))
 }
 
 /// The selected smart filter row, while its smart object is active, the filter still exists and
@@ -535,7 +568,81 @@ mod layer_thumbnail_scaling_tests {
 
 #[cfg(test)]
 mod tests {
+    use photocraft_engine::Session;
+
     use super::*;
+    use crate::Services;
+
+    fn smart(app: &PhotocraftApp) -> (photocraft_doc::Layer, photocraft_doc::SmartObject) {
+        let st = app.session.active().unwrap();
+        let l = st.doc.layer(st.active_layer.unwrap()).unwrap().clone();
+        let LayerContent::Smart(sm) = l.content.clone() else { panic!("not a smart object") };
+        (l, sm)
+    }
+
+    /// FILE-215-3: clicking the filter mask thumbnail targets it, the Brush paints into it (not
+    /// the layer mask, no rasterize prompt), and clicking the layer thumbnail goes back.
+    #[test]
+    fn the_filter_mask_thumbnail_targets_the_filter_mask() {
+        let mut app = PhotocraftApp::new(Session::new(), Services::default());
+        app.run("file.new", json!({"width": 32, "height": 32})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("edit.fill", json!({"contents": "color", "color": "#ff0000"})).unwrap();
+        app.run("layer.smartObjects.convertToSmartObject", json!({})).unwrap();
+        app.run("filter.blur.gaussianBlur", json!({"radius": 2})).unwrap();
+        let (l, sm) = smart(&app);
+        let actions = super::filter_mask_click(&l, &sm, egui::Modifiers::NONE);
+        assert_eq!(actions.last().unwrap().0, "ui.filterMaskTarget");
+        assert!(super::filter_mask_click(&l, &sm, egui::Modifiers::ALT).is_empty(), "nothing to view yet");
+        app.ui.filter_mask_target = Some(l.id.0);
+        app.sync_views();
+        assert!(app.filter_mask_targeted());
+        assert_eq!(crate::canvas::paint_target(&app), json!("filterMask"));
+        assert_eq!(app.with_mask_target("filter.blur.gaussianBlur", json!({}))["target"], "filterMask");
+        assert!(crate::rasterize_prompt::needed(&app).is_none(), "painting the filter mask needs no rasterizing");
+        app.run(
+            "paint.stroke",
+            json!({"points": [[4, 0], [4, 31]], "size": 4, "hardness": 1, "color": "#000000", "target": crate::canvas::paint_target(&app)}),
+        )
+        .unwrap();
+        let (l, sm) = smart(&app);
+        assert_eq!(sm.filter_mask.as_ref().unwrap().value(4, 16), 0.0);
+        assert!(l.mask.is_none(), "no layer mask");
+        assert_eq!(super::filter_mask_click(&l, &sm, egui::Modifiers::ALT)[0].1["mask"], "filter");
+        // Targeting a layer mask (or the pixels, `ui.maskTarget`) ends it.
+        app.ui.mask_target = true;
+        app.sync_views();
+        assert_eq!(app.ui.filter_mask_target, None, "a layer mask target replaces it");
+    }
+
+    #[test]
+    fn selecting_the_filter_mask_replaces_a_layer_mask_view() {
+        let mut app = PhotocraftApp::new(Session::new(), Services::default());
+        app.run("file.new", json!({"width": 32, "height": 32})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("edit.fill", json!({"contents": "color", "color": "#ff0000"})).unwrap();
+        app.run("layer.smartObjects.convertToSmartObject", json!({})).unwrap();
+        app.run("filter.blur.gaussianBlur", json!({"radius": 2})).unwrap();
+        app.run("layer.layerMask.revealAll", json!({})).unwrap();
+        app.run("view.layerMask", json!({"mode": "gray"})).unwrap();
+        app.sync_mask_targets();
+        assert!(app.layer_mask_targeted());
+        let id = app.session.active().unwrap().active_layer.unwrap();
+        app.select_filter_mask_target(Some(id.0));
+        app.sync_views();
+        assert!(app.filter_mask_targeted());
+        assert!(!app.layer_mask_targeted());
+        assert!(photocraft_engine::mask_view_cmds::current(app.session.active().unwrap()).is_none());
+        app.run("paint.stroke", json!({"points": [[8, 8]], "size": 6, "hardness": 1, "color": "#000000"})).unwrap();
+        let st = app.session.active().unwrap();
+        let layer = st.doc.layer(id).unwrap();
+        assert_eq!(layer.mask.as_ref().unwrap().value(8, 8), 1.0);
+        let LayerContent::Smart(sm) = &layer.content else { panic!("smart object") };
+        assert_eq!(sm.filter_mask.as_ref().unwrap().value(8, 8), 0.0);
+        app.run("view.layerMask", json!({"mode": "gray", "mask": "filter"})).unwrap();
+        app.select_filter_mask_target(Some(id.0));
+        assert!(photocraft_engine::mask_view_cmds::current(app.session.active().unwrap()).unwrap().filter, "a matching filter-mask view stays open");
+    }
 
     /// A pixel layer, a shape layer and a smart object, in that order.
     fn layers() -> [Layer; 3] {
@@ -694,4 +801,44 @@ mod tests {
         assert_eq!(smart(&app, doc).smart_filters.len(), 1);
         assert!(photocraft_compose::flatten(&shown).px == photocraft_compose::flatten(doc).px, "OK gives what the preview showed");
     }
+
+    /// FILE-215-3: with the filter mask targeted, Move and Edit › Transform act on the smart object
+    /// (no filter-mask target, so a move doesn't re-render the filters), and painting and filters
+    /// still edit the filter mask.
+    #[test]
+    fn only_filter_mask_edits_carry_the_filter_mask_target() {
+        let mut app = PhotocraftApp::new(Session::new(), Services::default());
+        app.run("file.new", json!({"width": 32, "height": 32})).unwrap();
+        app.run("layer.new.layer", json!({})).unwrap();
+        app.run("edit.fill", json!({"contents": "color", "color": "#ff0000"})).unwrap();
+        app.run("layer.smartObjects.convertToSmartObject", json!({})).unwrap();
+        app.run("filter.blur.gaussianBlur", json!({"radius": 2})).unwrap();
+        let id = app.session.active().unwrap().active_layer.unwrap();
+        app.select_filter_mask_target(Some(id.0));
+        assert!(app.filter_mask_targeted());
+        for cmd in [
+            "layer.translate",
+            "select.float",
+            "edit.transform.rotate180",
+            "filter.convertForSmartFilters",
+            "image.applyImage",
+            "filter.liquify",
+            "filter.lastFilter",
+            "image.adjustments.desaturate",
+            "filter.render.flame",
+        ] {
+            assert!(app.with_mask_target(cmd, json!({"dx": 1})).get("target").is_none(), "{cmd}");
+        }
+        for cmd in [
+            "paint.stroke",
+            "filter.blur.gaussianBlur",
+            "edit.fill",
+            "edit.paste",
+            "image.adjustments.invert",
+            "image.adjustments.equalize",
+            "filter.blur.average",
+        ] {
+            assert_eq!(app.with_mask_target(cmd, json!({}))["target"], "filterMask", "{cmd}");
+        }
+    }
 }
diff --git a/crates/ui-egui/src/snapshot_dialog.rs b/crates/ui-egui/src/snapshot_dialog.rs
new file mode 100644
index 0000000000..052b9b4f84
--- /dev/null
+++ b/crates/ui-egui/src/snapshot_dialog.rs
@@ -0,0 +1,71 @@
+//! History › New Snapshot (⌥-click the History panel's camera button, #2966): Photoshop's dialog
+//! for `history.newSnapshot`, with the snapshot's Name and what it is taken From (the full
+//! document, its layers merged, or only the current layer). The command stays directly callable
+//! with the same params by agents and Actions.
+
+use egui::{Align2, Sense, pos2, vec2};
+use serde_json::{Map, Value, json};
+
+use crate::PhotocraftApp;
+use crate::theme::Tokens;
+
+pub const COMMAND: &str = "history.newSnapshot";
+const MARK: &str = "__newSnapshot";
+
+pub fn owns(fields: &Map<String, Value>) -> bool {
+    fields.contains_key(MARK)
+}
+
+/// Open the dialog on the active document, suggesting the name the camera button would give.
+pub fn open(app: &mut PhotocraftApp) -> Option<u64> {
+    let name = photocraft_engine::history_cmds::next_snapshot_name(app.session.active()?);
+    let mut f = Map::new();
+    f.insert(MARK.into(), json!(true));
+    f.insert("__command".into(), json!(COMMAND));
+    f.insert("__label".into(), json!("New Snapshot"));
+    f.insert("name".into(), json!(name));
+    f.insert("from".into(), json!("fullDocument"));
+    Some(app.ui.open_dialog(crate::state::DialogKind::Command, f))
+}
+
+pub fn confirm(app: &mut PhotocraftApp, f: &Map<String, Value>) -> Result<Value, String> {
+    app.run(COMMAND, json!({"name": f.get("name"), "from": f.get("from")}))
+}
+
+fn label(ui: &mut egui::Ui, text: &str) {
+    let t = Tokens::get(ui.ctx());
+    let (r, _) = ui.allocate_exact_size(vec2(64.0, 22.0), Sense::hover());
+    ui.painter().text(pos2(r.right() - 6.0, r.center().y), Align2::RIGHT_CENTER, text, egui::FontId::proportional(12.0), t.text_dim);
+}
+
+pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
+    ui.spacing_mut().item_spacing.y = 6.0;
+    ui.horizontal(|ui| {
+        label(ui, tl!("Name:"));
+        let mut name = f.get("name").and_then(Value::as_str).unwrap_or_default().to_string();
+        let r = ui.add(egui::TextEdit::singleline(&mut name).desired_width(260.0));
+        // Opens on the name, selected, so typing replaces it (Photoshop).
+        if !ui.is_sizing_pass() && !f.contains_key("__named") {
+            r.request_focus();
+            if let Some(mut state) = egui::TextEdit::load_state(ui.ctx(), r.id) {
+                let all = egui::text::CCursorRange::two(egui::text::CCursor::new(0), egui::text::CCursor::new(name.chars().count()));
+                state.cursor.set_char_range(Some(all));
+                state.store(ui.ctx(), r.id);
+            }
+            f.insert("__named".into(), json!(true));
+        }
+        f.insert("name".into(), json!(name));
+    });
+    ui.horizontal(|ui| {
+        label(ui, tl!("From:"));
+        let mut from = f.get("from").and_then(Value::as_str).unwrap_or("fullDocument").to_string();
+        let opts = [
+            ("fullDocument".to_string(), tl!("Full Document")),
+            ("mergedLayers".to_string(), tl!("Merged Layers")),
+            ("currentLayer".to_string(), tl!("Current Layer")),
+        ];
+        if crate::widgets::dropdown(ui, "new-snapshot-from", tl!("From"), &mut from, &opts, 170.0) {
+            f.insert("from".into(), json!(from));
+        }
+    });
+}
diff --git a/crates/ui-egui/src/stack_dialog.rs b/crates/ui-egui/src/stack_dialog.rs
index 8eb8717e80..e500f7191f 100644
--- a/crates/ui-egui/src/stack_dialog.rs
+++ b/crates/ui-egui/src/stack_dialog.rs
@@ -118,7 +118,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
             ui.label(tl!("Choose Stack Mode:"));
             let mut mode = f.get("mode").and_then(Value::as_str).unwrap_or("median").to_string();
             let options: Vec<_> = photocraft_doc::StackMode::ALL.iter().map(|m| (m.id().to_string(), m.label())).collect();
-            if widgets::dropdown(ui, "statistics-stack-mode", &mut mode, &options, 180.0) {
+            if widgets::dropdown(ui, "statistics-stack-mode", tl!("Mode"), &mut mode, &options, 180.0) {
                 f.insert("mode".into(), json!(mode));
             }
         });
@@ -130,7 +130,7 @@ pub fn body(app: &mut PhotocraftApp, ui: &mut egui::Ui, f: &mut Map<String, Valu
         ui.label(tl!("Use:"));
         let mut mode = usize::from(folder_mode(f));
         let options = [(0, tl!("Files")), (1, tl!("Folder"))];
-        if widgets::dropdown(ui, "load-stack-use", &mut mode, &options, 120.0) {
+        if widgets::dropdown(ui, "load-stack-use", tl!("Use"), &mut mode, &options, 120.0) {
             f.insert("use".into(), json!(if mode == 1 { "folder" } else { "files" }));
             f.remove("selected");
         }
diff --git a/crates/ui-egui/src/state.rs b/crates/ui-egui/src/state.rs
index b3b9d7b05e..d9bad0e07c 100644
--- a/crates/ui-egui/src/state.rs
+++ b/crates/ui-egui/src/state.rs
@@ -176,6 +176,7 @@ pub enum Tool {
     CloneStamp,
     PatternStamp,
     HistoryBrush,
+    ArtHistoryBrush,
     Blur,
     Sharpen,
     Smudge,
@@ -206,7 +207,7 @@ pub enum Tool {
 }
 
 impl Tool {
-    pub const ALL: [Tool; 67] = [
+    pub const ALL: [Tool; 68] = [
         Tool::Move,
         Tool::Artboard,
         Tool::RectMarquee,
@@ -249,6 +250,7 @@ impl Tool {
         Tool::CloneStamp,
         Tool::PatternStamp,
         Tool::HistoryBrush,
+        Tool::ArtHistoryBrush,
         Tool::Blur,
         Tool::Sharpen,
         Tool::Smudge,
@@ -323,6 +325,7 @@ impl Tool {
             Tool::CloneStamp => "Clone Stamp Tool",
             Tool::PatternStamp => "Pattern Stamp Tool",
             Tool::HistoryBrush => "History Brush Tool",
+            Tool::ArtHistoryBrush => "Art History Brush Tool",
             Tool::Blur => "Blur Tool",
             Tool::Sharpen => "Sharpen Tool",
             Tool::Smudge => "Smudge Tool",
@@ -375,6 +378,7 @@ impl Tool {
                 | Tool::CloneStamp
                 | Tool::PatternStamp
                 | Tool::HistoryBrush
+                | Tool::ArtHistoryBrush
                 | Tool::Blur
                 | Tool::Sharpen
                 | Tool::Smudge
@@ -402,7 +406,7 @@ impl Tool {
             Tool::Zoom => 'Z',
             Tool::Remove | Tool::SpotHealing | Tool::Healing | Tool::Patch | Tool::ContentAwareMove | Tool::RedEye => 'J',
             Tool::CloneStamp | Tool::PatternStamp => 'S',
-            Tool::HistoryBrush => 'Y',
+            Tool::HistoryBrush | Tool::ArtHistoryBrush => 'Y',
             Tool::Blur | Tool::Sharpen | Tool::Smudge => '\0',
             // In the Marquee flyout, but M cycles only the Rectangular and Elliptical Marquee.
             Tool::SingleRowMarquee | Tool::SingleColumnMarquee => '\0',
@@ -650,6 +654,10 @@ pub struct ToolOptions {
     pub fill_opacity: f32,
     /// Paint Bucket fill source: false = Foreground colour, true = Pattern (Patterns panel selection).
     pub bucket_fill_pattern: bool,
+    /// Paint Bucket › Mode (any layer mode; Clear is `bucket_clear`).
+    pub bucket_blend_mode: photocraft_color::BlendMode,
+    /// Paint Bucket › Mode: Clear, which erases the filled area (see `brush_clear`).
+    pub bucket_clear: bool,
     /// Type tool: family, style name, size (pt), anti-aliasing and paragraph alignment.
     pub type_font: String,
     pub type_style: String,
@@ -711,6 +719,10 @@ pub struct ToolOptions {
     pub stroke_width: f32,
     #[serde(default)]
     pub shape_stroke: crate::shape_stroke_ui::StrokeOptions,
+    /// Shape tools: the gradient the next shape's fill / stroke takes (the swatches' Gradient
+    /// tab) instead of the foreground / background colour; `None` = the colour.
+    pub shape_fill_gradient: Option<photocraft_doc::Fill>,
+    pub shape_stroke_gradient: Option<photocraft_doc::Fill>,
     pub corner_radius: f32,
     pub polygon_sides: u32,
     pub line_weight: f32,
@@ -847,6 +859,17 @@ pub struct ToolOptions {
     /// Eyedropper › Show Sampling Ring.
     #[serde(default = "yes")]
     pub eyedropper_ring: bool,
+    /// Art History Brush: dab layout, Area (0–100), Tolerance (0–100).
+    #[serde(default = "default_art_history_style")]
+    pub art_history_style: String,
+    #[serde(default = "fifty")]
+    pub art_history_area: f32,
+    #[serde(default)]
+    pub art_history_tolerance: f32,
+}
+
+fn default_art_history_style() -> String {
+    "tightMedium".into()
 }
 
 fn yes() -> bool {
@@ -967,6 +990,8 @@ impl Default for ToolOptions {
             gradient_blend_mode: photocraft_color::BlendMode::Normal,
             fill_opacity: 100.0,
             bucket_fill_pattern: false,
+            bucket_blend_mode: photocraft_color::BlendMode::Normal,
+            bucket_clear: false,
             type_font: "Inter".into(),
             type_style: "Regular".into(),
             type_size: 48.0,
@@ -1002,6 +1027,8 @@ impl Default for ToolOptions {
             shape_fill: true,
             stroke_width: 0.0,
             shape_stroke: Default::default(),
+            shape_fill_gradient: None,
+            shape_stroke_gradient: None,
             corner_radius: 0.0,
             polygon_sides: 5,
             line_weight: 3.0,
@@ -1055,6 +1082,9 @@ impl Default for ToolOptions {
             eyedropper_size: 1,
             eyedropper_sample: default_eyedropper_sample(),
             eyedropper_ring: true,
+            art_history_style: default_art_history_style(),
+            art_history_area: 50.0,
+            art_history_tolerance: 0.0,
         }
     }
 }
@@ -1424,6 +1454,11 @@ pub struct UiState {
     /// tools edit it (#196). Never set together with `mask_target`.
     #[serde(default)]
     pub vector_mask_target: bool,
+    /// The smart object (layer id) whose filter mask is targeted (its thumbnail on the Smart
+    /// Filters row clicked): painting, fills, filters and adjustments edit that mask
+    /// (FILE-215-3). Never set together with `mask_target` or `vector_mask_target`.
+    #[serde(default)]
+    pub filter_mask_target: Option<u64>,
     /// The adjustment or fill layer (id) whose own settings Properties shows although its mask
     /// is targeted: set when that layer is created, as in Photoshop (#3369). Targeting the mask
     /// thumbnail, the layer's pixels or another layer clears it.
@@ -1501,6 +1536,10 @@ pub struct UiState {
     /// Preset panels (Gradients, Patterns, Styles, Shapes, Tool Presets, Clone Source).
     #[serde(default)]
     pub presets_ui: crate::preset_panels::PresetUi,
+    /// Save for Web: the preview tab last chosen (`original`, `optimized`, `2up`, `4up`), which the
+    /// dialog reopens on (#9174).
+    #[serde(default)]
+    pub web_view: Option<String>,
     /// Character/Paragraph Styles, Glyphs and Check Spelling (see `type_panels_ui`).
     #[serde(default)]
     pub type_panels: crate::type_panels_ui::TypePanelsUi,
@@ -1539,12 +1578,17 @@ pub struct UiState {
     pub dock: crate::dock::DockLayout,
     /// Authoritative custom panel membership and placement; legacy fields are compatibility projections.
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub docking: Option<craft_ui::docking::Layout<String>>,
+    pub docking: Option<craft_ui::docking::Workspace<String>>,
+    /// Where each floating panel docks back to.
     #[serde(default, skip_serializing_if = "std::collections::BTreeMap::is_empty")]
-    pub docking_hidden: std::collections::BTreeMap<String, craft_ui::docking::Location<String>>,
+    pub docking_returns: std::collections::BTreeMap<String, craft_ui::docking::Location<String>>,
     /// Invalidates in-flight gestures when a workspace is replaced.
     #[serde(skip)]
     pub docking_generation: u64,
+    /// The saved `docking`, `dockingReturns` and `dockingCollapsed` of a workspace from a newer
+    /// version, which shows the default layout: saved again unchanged until the layout changes.
+    #[serde(skip)]
+    pub docking_kept: Option<serde_json::Map<String, serde_json::Value>>,
     /// Panels belonging to explicitly collapsed custom tab groups.
     #[serde(default)]
     pub docking_collapsed: Vec<String>,
@@ -1554,6 +1598,12 @@ pub struct UiState {
     /// Which chip the Color panel edits, and how it shows the colour.
     #[serde(default)]
     pub color_panel: ColorPanelState,
+    /// Histogram panel options: view, channel, statistics, colours, source.
+    #[serde(default)]
+    pub histogram_panel: crate::histogram_panel::HistogramPanelState,
+    /// The tonal range dragged across the Histogram panel's graph (its statistics), `[from, to]`.
+    #[serde(default, skip_deserializing)]
+    pub histogram_range: Option<[u8; 2]>,
     /// Brush Settings: selected section (0 = Brush Tip Shape) and tab (0 settings, 1 Brushes).
     #[serde(default)]
     pub brush_section: usize,
@@ -1567,6 +1617,10 @@ pub struct UiState {
     pub selection_mode: u8,
     #[serde(default)]
     pub tool_options: ToolOptions,
+    /// The shape Fill / Stroke swatches' recently used gradients, newest first (the Gradient
+    /// tab's Recent row).
+    #[serde(default)]
+    pub recent_gradients: Vec<photocraft_doc::Fill>,
     /// In-progress polygonal lasso vertices (document coordinates).
     #[serde(default)]
     pub polygon: Vec<[f64; 2]>,
@@ -1641,6 +1695,7 @@ impl Default for UiState {
             layer_picker: None,
             mask_target: false,
             vector_mask_target: false,
+            filter_mask_target: None,
             properties_layer: None,
             brush_picker: None,
             brush_picker_list: crate::brush_picker::list_state(),
@@ -1658,6 +1713,7 @@ impl Default for UiState {
             actions: Default::default(),
             layer_comp_selected: None,
             presets_ui: Default::default(),
+            web_view: None,
             type_panels: Default::default(),
             analysis: Default::default(),
             timeline: Default::default(),
@@ -1667,6 +1723,8 @@ impl Default for UiState {
             shell: Default::default(),
             layer_filter: Vec::new(),
             layers_panel_options: LayersPanelOptions::default(),
+            histogram_panel: Default::default(),
+            histogram_range: None,
             layers_panel_dialog: None,
             layer_filter_by: Default::default(),
             layer_filter_name: String::new(),
@@ -1687,7 +1745,8 @@ impl Default for UiState {
             dock_tabs: DockTabs::default(),
             dock: Default::default(),
             docking: None,
-            docking_hidden: Default::default(),
+            docking_returns: Default::default(),
+            docking_kept: None,
             docking_generation: 0,
             docking_collapsed: Vec::new(),
             docking_reveal: None,
@@ -1697,6 +1756,7 @@ impl Default for UiState {
             brushes_panel: Default::default(),
             selection_mode: 0,
             tool_options: ToolOptions::default(),
+            recent_gradients: Vec::new(),
             polygon: Vec::new(),
             polygon_mode: String::new(),
             polygon_doc: None,
@@ -1796,11 +1856,14 @@ mod tests {
         assert_eq!(Tool::from_name("Color Replacement Tool"), Some(Tool::ColorReplacement));
         assert_eq!(Tool::from_name("redEye"), Some(Tool::RedEye));
         assert_eq!(Tool::from_name("Red Eye Tool"), Some(Tool::RedEye));
+        assert_eq!(Tool::from_name("artHistoryBrush"), Some(Tool::ArtHistoryBrush));
+        assert_eq!(Tool::from_name("Art History Brush"), Some(Tool::ArtHistoryBrush));
+        assert_eq!(Tool::from_name("Art History Brush Tool"), Some(Tool::ArtHistoryBrush));
         assert_eq!(Tool::RedEye.key(), 'J');
         assert!(!Tool::RedEye.is_brushlike());
         assert_eq!(Tool::from_name("patternStamp"), Some(Tool::PatternStamp));
         assert_eq!(Tool::from_name("Pattern Stamp Tool"), Some(Tool::PatternStamp));
-        assert_eq!(Tool::ALL.len(), 67);
+        assert_eq!(Tool::ALL.len(), 68);
         assert_eq!(Tool::from_name("Vertical Type Mask Tool"), Some(Tool::VerticalTypeMask));
         assert_eq!(Tool::from_name("addAnchorPoint"), Some(Tool::AddAnchorPoint));
         assert_eq!(Tool::from_name("Delete Anchor Point Tool"), Some(Tool::DeleteAnchorPoint));
@@ -1815,6 +1878,8 @@ mod tests {
         assert_eq!(Tool::from_name("RotateView"), Some(Tool::RotateView));
         assert_eq!(Tool::from_name("Rotate View Tool"), Some(Tool::RotateView));
         assert_eq!(Tool::RotateView.key(), 'R');
+        assert_eq!(Tool::ArtHistoryBrush.key(), 'Y');
+        assert!(Tool::ArtHistoryBrush.is_brushlike());
         assert_eq!(Tool::from_name("nope"), None);
     }
 
diff --git a/crates/ui-egui/src/status_bar_tests.rs b/crates/ui-egui/src/status_bar_tests.rs
index eebd7e84bc..1d42a65560 100644
--- a/crates/ui-egui/src/status_bar_tests.rs
+++ b/crates/ui-egui/src/status_bar_tests.rs
@@ -11,7 +11,7 @@ use crate::theme::{ThemeKind, Tokens};
 const SIZE: egui::Vec2 = vec2(900.0, 200.0);
 
 fn bottom_id() -> egui::Id {
-    egui::Id::new("status-bar-test-bottom")
+    egui::Id::unique("status-bar-test-bottom")
 }
 
 fn harness(kind: ThemeKind) -> Harness<'static, PhotocraftApp> {
diff --git a/crates/ui-egui/src/stroke_ui.rs b/crates/ui-egui/src/stroke_ui.rs
index e910887fc9..1d37927c81 100644
--- a/crates/ui-egui/src/stroke_ui.rs
+++ b/crates/ui-egui/src/stroke_ui.rs
@@ -84,7 +84,7 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
     ui.horizontal(|ui| {
         label(ui, tl!("Width:"));
         let mut width = f.get("width").and_then(Value::as_f64).unwrap_or(1.0) as f32;
-        if crate::widgets::value_field(ui, &mut width, 1.0..=250.0, "px", 84.0).changed() {
+        if crate::widgets::value_field(ui, &mut width, 1.0..=250.0, "px", 84.0).accessible_name(tl!("Width:")).changed() {
             f.insert("width".into(), json!(width.round()));
         }
     });
@@ -105,7 +105,7 @@ pub fn body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
         label(ui, tl!("Location:"));
         let mut location = f.get("location").and_then(Value::as_str).unwrap_or("center").to_string();
         let opts: Vec<(String, &str)> = LOCATIONS.iter().map(|(key, label)| (key.to_string(), tl!(label))).collect();
-        if crate::widgets::dropdown(ui, "stroke-location", &mut location, &opts, 170.0) {
+        if crate::widgets::dropdown(ui, "stroke-location", tl!("Location"), &mut location, &opts, 170.0) {
             f.insert("location".into(), json!(location));
         }
     });
diff --git a/crates/ui-egui/src/swatches_ui.rs b/crates/ui-egui/src/swatches_ui.rs
index 81167d6836..09420d4944 100644
--- a/crates/ui-egui/src/swatches_ui.rs
+++ b/crates/ui-egui/src/swatches_ui.rs
@@ -10,6 +10,7 @@
 //! `swatches.*` engine command; this module only draws and dispatches. Colours are shown in the
 //! RGB working space through `photocraft-cms` (cached per library revision and colour settings).
 
+use std::ffi::OsStr;
 use std::sync::Arc;
 
 use egui::{Color32, CornerRadius, Rect};
@@ -31,7 +32,7 @@ fn c32(c: [f32; 3]) -> Color32 {
 /// Display colours of every swatch, rebuilt when the library or the working spaces change.
 fn colors(app: &PhotocraftApp, ctx: &egui::Context) -> Arc<Vec<Vec<Color32>>> {
     let c = &app.session.color.settings;
-    let key = egui::Id::new(("swatch-colors", app.session.presets.rev, &c.working_rgb, &c.working_cmyk, &c.working_gray));
+    let key = egui::Id::unique(("swatch-colors", app.session.presets.rev, &c.working_rgb, &c.working_cmyk, &c.working_gray));
     if let Some(v) = ctx.data(|d| d.get_temp::<Arc<Vec<Vec<Color32>>>>(key)) {
         return v;
     }
@@ -39,10 +40,10 @@ fn colors(app: &PhotocraftApp, ctx: &egui::Context) -> Arc<Vec<Vec<Color32>>> {
     let v: Arc<Vec<Vec<Color32>>> = Arc::new(app.session.presets.swatches.iter().map(|g| g.items.iter().map(|s| c32(conv.rgb(&s.color))).collect()).collect());
     ctx.data_mut(|d| {
         // Only the newest table is kept.
-        if let Some(old) = d.get_temp::<egui::Id>(egui::Id::new("swatch-colors-key")) {
+        if let Some(old) = d.get_temp::<egui::Id>(egui::Id::unique("swatch-colors-key")) {
             d.remove::<Arc<Vec<Vec<Color32>>>>(old);
         }
-        d.insert_temp(egui::Id::new("swatch-colors-key"), key);
+        d.insert_temp(egui::Id::unique("swatch-colors-key"), key);
         d.insert_temp(key, v.clone());
     });
     v
@@ -52,9 +53,9 @@ fn colors(app: &PhotocraftApp, ctx: &egui::Context) -> Arc<Vec<Vec<Color32>>> {
 pub fn use_swatch(app: &mut PhotocraftApp, name: &str, background: bool) {
     let target = if background { "background" } else { "foreground" };
     if run(app, "swatches.use", json!({"swatch": name, "target": target})).is_some() && !background {
-        // Clicking a swatch recolours the selected characters (#364), or the selected type or
-        // shape layers with a Type, shape or Pen tool, as in Photoshop.
-        crate::apply_color::foreground_changed(app, None);
+        // Clicking a swatch recolours the selected characters (#364), or the selected type and
+        // shape layers whatever the tool, as in Photoshop (#9238).
+        crate::apply_color::swatch_picked(app);
     }
 }
 
@@ -157,7 +158,7 @@ pub fn import_bytes(app: &mut PhotocraftApp, name: &str, bytes: &[u8], replace:
     p["mode"] = json!(if replace { "replace" } else { "append" });
     // Bytes without a path (the browser, drag and drop) are sniffed by content, and `.act` has
     // no signature: one starting 00 01 or 00 02 reads as `.aco`. Its file name decides.
-    if std::path::Path::new(name).extension().and_then(|e| e.to_str()).is_some_and(|e| e.eq_ignore_ascii_case("act")) {
+    if std::path::Path::new(name).extension().and_then(OsStr::to_str).is_some_and(|e| e.eq_ignore_ascii_case("act")) {
         p["format"] = json!("act");
     }
     if let Some(stem) = stem {
diff --git a/crates/ui-egui/src/symmetry_ui.rs b/crates/ui-egui/src/symmetry_ui.rs
index 4ccdc2277c..95e6b61c61 100644
--- a/crates/ui-egui/src/symmetry_ui.rs
+++ b/crates/ui-egui/src/symmetry_ui.rs
@@ -94,12 +94,12 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) -> bool {
     widgets::vline(ui, 22.0);
     let tip = crate::i18n::fmt(tl!("Commit transform ({key})"), &[("key", &crate::shortcuts::pretty("Enter"))]);
     let commit_btn = icons::button(ui, "check", 26.0, false, &tip);
-    commit_btn.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, "Commit transform"));
+    commit_btn.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, "Commit transform"));
     if commit_btn.clicked() {
         commit(app);
     }
     let cancel = icons::button(ui, "ban", 26.0, false, tl!("Cancel transform (Esc)"));
-    cancel.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, "Cancel transform"));
+    cancel.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, "Cancel transform"));
     if cancel.clicked() {
         app.ui.symmetry_transform = None;
     }
@@ -149,7 +149,7 @@ pub fn track(app: &mut PhotocraftApp, ctx: &egui::Context) {
 
 /// Highlight the active mode without reserving a separate checkmark column.
 fn mode_button(ui: &mut egui::Ui, mode: SymmetryMode, checked: bool) -> egui::Response {
-    let icon = ui.id().with((mode.id(), "icon"));
+    let icon = egui::IdSalt::new((mode.id(), "icon"));
     let name = label(mode);
     let b = egui::Button::new((Atom::custom(icon, vec2(16.0, 16.0)), name, Atom::grow())).selected(checked).atom_ui(ui);
     let tint = Tokens::get(ui.ctx()).icon;
@@ -162,7 +162,7 @@ fn mode_button(ui: &mut egui::Ui, mode: SymmetryMode, checked: bool) -> egui::Re
         };
         icons::paint(ui, r, glyph, 14.0, tint);
     }
-    b.response.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, ui.is_enabled(), checked, name));
+    b.response.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, ui.is_enabled(), checked, name));
     b.response
 }
 pub fn menu(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
diff --git a/crates/ui-egui/src/symmetry_ui/tests.rs b/crates/ui-egui/src/symmetry_ui/tests.rs
index 85fd45b0a3..bde80224fb 100644
--- a/crates/ui-egui/src/symmetry_ui/tests.rs
+++ b/crates/ui-egui/src/symmetry_ui/tests.rs
@@ -172,7 +172,7 @@ fn overlays_follow_document_view_transforms_in_every_theme() {
         let xf =
             ViewXform { rect: Rect::from_min_size(Pos2::ZERO, vec2(500.0, 400.0)), zoom: 1.7, center: [50.0, 40.0], rotation: 37.0, flip: true, aspect: 1.0 };
         let mut out = ctx.run_ui(RawInput { screen_rect: Some(xf.rect), ..Default::default() }, |ui| {
-            let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Middle, egui::Id::new("symmetry")));
+            let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Middle, egui::Id::unique("symmetry")));
             draw(&app, &painter, &xf);
         });
         let lines: Vec<_> =
diff --git a/crates/ui-egui/src/tab_strip.rs b/crates/ui-egui/src/tab_strip.rs
index 1419471f1f..728486e973 100644
--- a/crates/ui-egui/src/tab_strip.rs
+++ b/crates/ui-egui/src/tab_strip.rs
@@ -1,10 +1,9 @@
-//! Dock tab strips that fit any width (#151), like Photoshop's: when the tabs don't fit beside
-//! the panel menu button they shrink, eliding their labels with '…', and once they are at their
-//! minimum width the ones that still don't fit move into a » chevron menu at the end of the
-//! strip. The selected tab always stays on the strip, and no tab ever runs under the menu button.
-//! On a reorderable strip a tab dragged along the strip moves to where it is dropped (#2272).
+//! Tab strips that fit any width (#151): when the tabs don't fit beside the panel menu button
+//! they shrink, eliding their labels with '…', and once they are at their minimum width the ones
+//! that still don't fit move into a » chevron menu at the end of the strip. The selected tab
+//! always stays on the strip, and no tab ever runs under the menu button.
 
-use egui::{CornerRadius, Rect, Response, Sense, Stroke, StrokeKind, Ui, pos2, vec2};
+use egui::{Rect, Response, Sense, Stroke, StrokeKind, Ui, pos2, vec2};
 
 use crate::theme::{self, Tokens};
 
@@ -30,26 +29,6 @@ pub enum TabContextAction {
     CloseGroup,
 }
 
-/// What a strip reported this frame.
-pub struct StripOut {
-    /// A tab was activated, including a choice from the overflow menu.
-    pub clicked: bool,
-    pub double_clicked: bool,
-    pub context: Option<TabContextAction>,
-    /// Rects of the tabs on the strip, `(tab index, rect)`.
-    pub tabs: Vec<(usize, Rect)>,
-    pub responses: Vec<(usize, Response)>,
-    /// The » overflow button, when some tabs didn't fit.
-    pub chevron: Option<Rect>,
-    /// A tab was dragged along the strip and dropped: `(tab, before)`, draw `tab` just before
-    /// tab `before` (`None`: last).
-    pub reorder: Option<(usize, Option<usize>)>,
-    /// The index of a tab being dragged away from this strip.
-    pub dragging_out: Option<usize>,
-    /// The index of a tab whose drag ended away from this strip.
-    pub dropped_out: Option<usize>,
-}
-
 /// Width of the » overflow button.
 pub const CHEVRON_W: f32 = 18.0;
 
@@ -66,7 +45,7 @@ pub fn overflow_button(ui: &mut Ui, id: egui::Id, r: Rect, tip: &str, labels: &[
         paint_ui.painter().rect_filled(r.shrink2(vec2(1.0, 3.0)), t.radius_sm, t.hover.gamma_multiply(0.6));
     }
     crate::icons::paint(&paint_ui, r, "chevrons-right", 12.0, if resp.hovered() { t.text } else { t.text_dim });
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), tip));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), tip));
     let resp = resp.on_hover_text(tip);
     egui::Popup::menu(&resp).show(|ui| {
         ui.set_min_width(140.0);
@@ -93,10 +72,9 @@ fn tabs_in(
     font: egui::FontId,
     pad: f32,
     min_w: f32,
-    reorderable: bool,
     active: impl Fn(usize) -> bool,
     mut paint_tab: impl FnMut(&Ui, Rect, usize, &str, std::sync::Arc<egui::Galley>, &Response, bool),
-) -> StripOut {
+) -> Option<TabContextAction> {
     let t = Tokens::get(ui.ctx());
     // Panel names are English keys; draw them in the UI language.
     let names: Vec<&str> = panel_ids.iter().map(|n| tl!(n)).collect();
@@ -104,20 +82,7 @@ fn tabs_in(
     let natural: Vec<f32> = translated_tabs.iter().map(|n| ui.painter().layout_no_wrap((*n).to_owned(), font.clone(), t.text).size().x + pad).collect();
     let f = fit(&natural, *selected, area.width(), min_w, CHEVRON_W);
     let mut x = area.left();
-    let mut out = StripOut {
-        clicked: false,
-        double_clicked: false,
-        context: None,
-        tabs: Vec::with_capacity(f.shown.len()),
-        responses: Vec::with_capacity(f.shown.len()),
-        chevron: None,
-        reorder: None,
-        dragging_out: None,
-        dropped_out: None,
-    };
-    // Without reordering, drags on a tab fall through to the strip behind it.
-    let sense = if reorderable { Sense::click_and_drag() } else { Sense::click() };
-    let mut drag: Option<(usize, bool)> = None;
+    let mut context = None;
     for &(i, w) in &f.shown {
         let Some(name) = translated_tabs.get(i) else { continue };
         let panel_id = panel_ids[i];
@@ -125,39 +90,27 @@ fn tabs_in(
         // The padding gives way (down to a third) before the label is cut.
         let galley = elided(ui, name, font.clone(), t.text, (w - pad / 3.0).max(1.0));
         let cut = galley.size().x + pad + 0.5 < natural.get(i).copied().unwrap_or(0.0) && galley.size().x + pad / 3.0 >= w - 0.5;
-        let resp = craft_ui::tabs::Tab::new(id.with(("tab", i)), name, i == *selected).sense(sense).focus_stroke(Stroke::new(1.0, t.accent)).show_at(
+        let resp = craft_ui::tabs::Tab::new(id.with(("tab", i)), name, i == *selected).sense(Sense::click()).focus_stroke(Stroke::new(1.0, t.accent)).show_at(
             ui,
             r,
             |ui, resp| paint_tab(ui, r, i, panel_id, galley, resp, active(i)),
         );
         let resp = if cut { resp.on_hover_text(*name) } else { resp };
-        if resp.drag_started() {
-            *selected = i;
-        }
-        if resp.dragged() {
-            drag = Some((i, false));
-        } else if resp.drag_stopped() {
-            drag = Some((i, true));
-        }
-        out.double_clicked |= resp.double_clicked();
         if resp.clicked() {
-            out.clicked = true;
             *selected = i;
         }
-        // The context menu belongs to the actual tab response, so its normal clicks
-        // and double-click-to-collapse behavior are not intercepted by an overlay.
+        // The context menu belongs to the actual tab response, so its clicks are not
+        // intercepted by an overlay.
         resp.context_menu(|ui| {
             if ui.button(tl!("Close")).clicked() {
-                out.context = Some(TabContextAction::Close(i));
+                context = Some(TabContextAction::Close(i));
                 ui.close();
             }
             if ui.button(tl!("Close Tab Group")).clicked() {
-                out.context = Some(TabContextAction::CloseGroup);
+                context = Some(TabContextAction::CloseGroup);
                 ui.close();
             }
         });
-        out.tabs.push((i, r));
-        out.responses.push((i, resp));
         x = r.right();
     }
     if !f.overflow.is_empty() && f.overflow_width > 0.0 {
@@ -165,82 +118,15 @@ fn tabs_in(
         let mut picked = None;
         overflow_button(ui, id.with("tab-overflow"), r, tl!("More panels"), translated_tabs, &f.overflow, None, &mut picked);
         if let Some(i) = picked {
-            out.clicked = true;
             *selected = i;
         }
-        out.chevron = Some(r);
     }
-    if let Some((tab, released)) = drag
-        && let Some(p) = ui.ctx().pointer_interact_pos().or_else(|| ui.ctx().pointer_latest_pos())
-    {
-        match drop_slot(&out.tabs, area, p) {
-            Some(slot) => {
-                ui.ctx().set_cursor_icon(egui::CursorIcon::Grabbing);
-                let before = match out.tabs.get(slot) {
-                    Some((b, _)) => Some(*b),
-                    // After the last tab on the strip: before the first overflowing one, if any.
-                    None => out.tabs.last().map(|(l, _)| l + 1).filter(|b| *b < panel_ids.len()),
-                };
-                if released {
-                    out.reorder = Some((tab, before));
-                } else if let Some((_, r)) = out.tabs.get(slot.min(out.tabs.len().saturating_sub(1))) {
-                    crate::widgets::drop_line(ui, *r, slot >= out.tabs.len(), true, &t);
-                }
-            }
-            None if released => out.dropped_out = Some(tab),
-            None => out.dragging_out = Some(tab),
-        }
-    }
-    out
+    context
 }
 
-/// Where a tab dragged to `p` lands: before the `n`th tab on the strip (`tabs.len()`: after the
-/// last), or `None` once the pointer has left the strip.
-pub fn drop_slot(tabs: &[(usize, Rect)], area: Rect, p: egui::Pos2) -> Option<usize> {
-    if !area.expand2(vec2(24.0, area.height())).contains(p) {
-        return None;
-    }
-    Some(tabs.iter().filter(|(_, r)| r.center().x < p.x).count())
-}
-
-/// Photoshop-grammar strip (Pro themes): flat tabs on the dark strip; `menu_left` is where the
-/// panel menu button starts.
-#[allow(clippy::too_many_arguments)]
-pub fn pro_tabs(ui: &mut Ui, id: egui::Id, strip: Rect, menu_left: f32, tabs: &[&str], selected: &mut usize, collapsed: bool, reorderable: bool) -> StripOut {
-    let t = Tokens::get(ui.ctx());
-    let area = Rect::from_min_max(strip.min, pos2(menu_left.max(strip.left()), strip.bottom()));
-    let sel = *selected;
-    tabs_in(
-        ui,
-        id,
-        area,
-        tabs,
-        selected,
-        egui::FontId::proportional(11.5),
-        22.0,
-        40.0,
-        reorderable,
-        |i| i == sel && !collapsed,
-        |ui, r, i, _, galley, resp, active| {
-            if active {
-                ui.painter().rect_filled(r, CornerRadius { nw: if i == 0 { 3 } else { 0 }, ne: 0, sw: 0, se: 0 }, t.card);
-            } else if resp.hovered() {
-                ui.painter().rect_filled(r, 0.0, t.hover.gamma_multiply(0.4));
-            }
-            let color = if active {
-                t.text
-            } else if resp.hovered() {
-                t.text_dim
-            } else {
-                t.text_faint
-            };
-            ui.painter().with_clip_rect(r.intersect(ui.clip_rect())).galley_with_override_text_color(r.center() - galley.size() / 2.0, galley, color);
-        },
-    )
-}
-
-/// Studio strip: pill tabs in `area` (the row minus the menu button).
-pub fn pill_tabs(ui: &mut Ui, id: egui::Id, area: Rect, tabs: &[&str], selected: &mut usize, reorderable: bool) -> StripOut {
+/// Studio strip: pill tabs in `area` (the row minus the menu button). Returns the action chosen
+/// from a tab's context menu.
+pub fn pill_tabs(ui: &mut Ui, id: egui::Id, area: Rect, tabs: &[&str], selected: &mut usize) -> Option<TabContextAction> {
     let t = Tokens::get(ui.ctx());
     let sel = *selected;
     tabs_in(
@@ -252,7 +138,6 @@ pub fn pill_tabs(ui: &mut Ui, id: egui::Id, area: Rect, tabs: &[&str], selected:
         theme::medium(12.5),
         20.0,
         44.0,
-        reorderable,
         |i| i == sel,
         |ui, r, _, _, galley, resp, active| {
             // 2 pt between pills, as the old horizontal layout had.
@@ -322,32 +207,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn tiny_panel_strips_keep_tabs_and_overflow_inside_the_available_area() {
-        let ctx = egui::Context::default();
-        crate::PhotocraftApp::setup_context(&ctx, crate::theme::ThemeKind::Pro);
-        for width in [0.0, 1.0, 5.0, 18.0, 19.0, 80.0, 180.0, 300.0] {
-            let area = Rect::from_min_size(pos2(20.0, 20.0), vec2(width, 26.0));
-            let mut selected = 3;
-            let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
-                let out =
-                    pro_tabs(ui, ui.id().with("tiny-tabs"), area, area.right(), &["Color", "Swatches", "Gradients", "Patterns"], &mut selected, false, false);
-                assert!(out.tabs.iter().any(|(i, _)| *i == 3));
-                for (_, rect) in &out.tabs {
-                    assert!(rect.left() >= area.left() && rect.right() <= area.right() + 0.001, "{width}: {rect:?}");
-                }
-                if let Some(chevron) = out.chevron {
-                    assert!(chevron.left() >= area.left() && chevron.right() <= area.right() + 0.001, "{width}: {chevron:?}");
-                }
-            });
-            output.textures_delta.clear();
-            assert_eq!(selected, 3);
-            for shape in output.shapes.iter().filter(|s| matches!(s.shape, egui::Shape::Text(_))) {
-                assert!(shape.clip_rect.right() <= area.right() + 0.001, "{width}: text is clipped to its tab");
-            }
-        }
-    }
-
     #[test]
     fn overflow_icon_and_hover_paint_stay_inside_a_tiny_button() {
         for scale in [1.0, 2.0] {
@@ -360,7 +219,7 @@ mod tests {
                     let mut picked = None;
                     let input = egui::RawInput { events: vec![egui::Event::PointerMoved(rect.center())], ..Default::default() };
                     let mut output = ctx.run_ui(input, |ui| {
-                        overflow_button(ui, ui.id().with("tiny-overflow"), rect, "More panels", &["Layers"], &[0], None, &mut picked);
+                        overflow_button(ui, ui.scope_id().with("tiny-overflow"), rect, "More panels", &["Layers"], &[0], None, &mut picked);
                     });
                     output.textures_delta.clear();
                     let mut icons = 0;
diff --git a/crates/ui-egui/src/targa_options_ui.rs b/crates/ui-egui/src/targa_options_ui.rs
index 446bd0cb7f..1c6772dfea 100644
--- a/crates/ui-egui/src/targa_options_ui.rs
+++ b/crates/ui-egui/src/targa_options_ui.rs
@@ -59,7 +59,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let Some(p) = &mut app.targa_options else { return };
     let (mut ok, mut cancel) = (false, false);
     let mut bits = p.bits;
-    let modal = egui::Modal::new(egui::Id::new("targa-options")).show(ctx, |ui| {
+    let modal = egui::Modal::new(egui::Id::unique("targa-options")).show(ctx, |ui| {
         ui.set_max_width(340.0);
         ui.label(egui::RichText::new(tl!("Targa Options")).font(crate::theme::semibold(15.0)));
         ui.add_space(4.0);
diff --git a/crates/ui-egui/src/text_field_menu.rs b/crates/ui-egui/src/text_field_menu.rs
index 6556c68cfc..99499bfd67 100644
--- a/crates/ui-egui/src/text_field_menu.rs
+++ b/crates/ui-egui/src/text_field_menu.rs
@@ -98,7 +98,7 @@ impl State {
 
 /// The menu's area.
 pub fn menu_id() -> Id {
-    Id::new("text-field-menu")
+    Id::unique("text-field-menu")
 }
 
 /// Is the edit menu open, and on which text field?
@@ -297,7 +297,7 @@ mod tests {
         let ctx = h.ctx.clone();
         assert!(start_rename(&ctx, layer, "Alpha").is_none());
         h.run_steps(4);
-        (h, Id::new(("layer-rename-field", layer)))
+        (h, Id::unique(("layer-rename-field", layer)))
     }
 
     fn button(h: &mut Harness<'_, PhotocraftApp>, at: Pos2, button: PointerButton) {
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index d637f193d0..aa35282e72 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -764,7 +764,7 @@ impl Tokens {
 
     /// Tokens for the active theme (stored in egui's context data by [`apply`]).
     pub fn get(ctx: &egui::Context) -> Tokens {
-        ctx.data(|d| d.get_temp::<Tokens>(egui::Id::new("photocraft-theme"))).unwrap_or_else(|| Tokens::for_kind(ThemeKind::Studio))
+        ctx.data(|d| d.get_temp::<Tokens>(egui::Id::unique("photocraft-theme"))).unwrap_or_else(|| Tokens::for_kind(ThemeKind::Studio))
     }
 
     /// Thin RGB outlines; the filled bands use the same hues with subdued coverage.
@@ -872,6 +872,29 @@ pub fn install_fonts_with(ctx: &egui::Context, cjk: crate::cjk_fonts::Sources) {
     if let Some(mono) = mono {
         fonts.families.entry(FontFamily::Monospace).or_default().insert(0, mono);
     }
+    // The optional craft-fonts input carries Japanese, Simplified Chinese, Korean, Arabic, Thai and
+    // other faces. Register them up front: the lazy loader cannot react before the first frame
+    // shapes (and a headless frame panics on a missing glyph rather than drawing tofu).
+    if cjk.eager_craft_fonts {
+        // The UI Japanese face comes first, as in the lazy loader (`japanese_for_ui`): egui uses
+        // the first family member that covers a glyph, and the manifest lists Shippori Mincho
+        // before BIZ UDPGothic, so manifest order alone would draw Japanese UI in serif glyphs
+        // and shared Han characters in Japanese forms.
+        let craft = photocraft_text::craft_fonts::CRAFT_FONTS;
+        let ui_first: Vec<usize> =
+            photocraft_text::craft_fonts::japanese_for_ui().iter().filter_map(|f| craft.iter().position(|c| std::ptr::eq(c, *f))).collect();
+        let order = ui_first.iter().copied().chain((0..craft.len()).filter(|i| !ui_first.contains(i)));
+        for i in order {
+            let f = &craft[i];
+            if f.bytes.is_empty() {
+                continue;
+            }
+            let name = format!("craft-font-{i}");
+            fonts.font_data.insert(name.clone(), Arc::new(FontData::from_static(f.bytes)));
+            fonts.families.entry(FontFamily::Proportional).or_default().push(name.clone());
+            fonts.families.entry(FontFamily::Monospace).or_default().push(name);
+        }
+    }
     // Named weights fall back to the default stack for missing glyphs.
     let fallback: Vec<String> = fonts.families.get(&FontFamily::Proportional).cloned().unwrap_or_default();
     for (fam, primary) in [("medium", medium), ("semibold", semibold)] {
@@ -908,7 +931,7 @@ fn ui_fonts_active(ctx: &egui::Context) -> bool {
 }
 
 fn ui_fonts_id() -> egui::Id {
-    egui::Id::new("photocraft-ui-fonts")
+    egui::Id::unique("photocraft-ui-fonts")
 }
 
 fn ui_font_size(ctx: &egui::Context) -> UiFontSize {
@@ -997,7 +1020,7 @@ pub fn apply(ctx: &egui::Context, kind: ThemeKind) {
     // including when an integration or restored egui state pinned its own theme preference.
     ctx.set_theme(egui::ThemePreference::System);
     let t = Tokens::for_kind(kind);
-    ctx.data_mut(|d| d.insert_temp(egui::Id::new("photocraft-theme"), t));
+    ctx.data_mut(|d| d.insert_temp(egui::Id::unique("photocraft-theme"), t));
     let mut v = if t.dark() { Visuals::dark() } else { Visuals::light() };
     v.panel_fill = t.chrome;
     v.window_fill = t.card;
@@ -1131,6 +1154,29 @@ mod tests {
         assert_eq!(ctx.zoom_factor(), 1.0);
     }
 
+    // Regression test for #4630: the stock thin scroll bar fades its handle to the same opacity
+    // as its track while the pointer is on it, so the thumb disappeared when it was grabbed.
+    #[test]
+    fn scrollbar_thumb_stays_more_visible_than_its_track_in_every_theme() {
+        for kind in ThemeKind::ALL {
+            let ctx = egui::Context::default();
+            apply(&ctx, kind);
+            for theme in [egui::Theme::Dark, egui::Theme::Light] {
+                let scroll = ctx.style_of(theme).spacing.scroll;
+                if !scroll.floating {
+                    continue;
+                }
+                assert!(
+                    scroll.interact_handle_opacity > scroll.interact_background_opacity,
+                    "{kind:?}/{theme:?}: handle {} vs track {} under the pointer",
+                    scroll.interact_handle_opacity,
+                    scroll.interact_background_opacity
+                );
+                assert_eq!(scroll.interact_handle_opacity, 1.0, "{kind:?}/{theme:?}: the thumb is opaque under the pointer");
+            }
+        }
+    }
+
     /// The desktop app installs fonts and loads the saved UI Font Size in its first frame, while
     /// egui's default fonts are still active. Any size but Small then panicked on the next pass
     /// ("FontFamily::Name("medium") is not bound to any fonts") because the plugin rescaled a
@@ -1471,7 +1517,7 @@ pub mod live {
                     super::apply(ctx, kind);
                     let mut t = Tokens::get(ctx);
                     let unknown = apply_overrides(&mut t, &v);
-                    ctx.data_mut(|d| d.insert_temp(egui::Id::new("photocraft-theme"), t));
+                    ctx.data_mut(|d| d.insert_temp(egui::Id::unique("photocraft-theme"), t));
                     if !unknown.is_empty() {
                         log::warn!("unknown token keys: {unknown:?}");
                     }
diff --git a/crates/ui-egui/src/tiff_options_ui.rs b/crates/ui-egui/src/tiff_options_ui.rs
index eed78830a1..b387f1aa41 100644
--- a/crates/ui-egui/src/tiff_options_ui.rs
+++ b/crates/ui-egui/src/tiff_options_ui.rs
@@ -45,7 +45,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let Some(p) = &mut app.tiff_options else { return };
     let (mut ok, mut cancel) = (false, false);
     let (mut discard, mut dont_ask) = (p.discard_layers, p.dont_ask_again);
-    let modal = egui::Modal::new(egui::Id::new("tiff-options")).show(ctx, |ui| {
+    let modal = egui::Modal::new(egui::Id::unique("tiff-options")).show(ctx, |ui| {
         ui.set_max_width(420.0);
         ui.label(egui::RichText::new(tl!("TIFF Options")).font(crate::theme::semibold(15.0)));
         ui.add_space(4.0);
diff --git a/crates/ui-egui/src/tile_overlay.rs b/crates/ui-egui/src/tile_overlay.rs
index 731ddc06b8..2afc0c98ef 100644
--- a/crates/ui-egui/src/tile_overlay.rs
+++ b/crates/ui-egui/src/tile_overlay.rs
@@ -141,7 +141,7 @@ pub fn paint(app: &PhotocraftApp, ctx: &egui::Context, painter: &Painter, xf: &V
     let Some(st) = app.session.documents().get(idx) else { return };
     let Some(surface) = st.active_layer.and_then(|id| st.doc.layer(id)).and_then(|l| l.surface()) else { return };
     let revision = st.revision;
-    let mem = egui::Id::new(("pc-tile-overlay", st.doc.id.0, st.active_layer.map(|l| l.0)));
+    let mem = egui::Id::unique(("pc-tile-overlay", st.doc.id.0, st.active_layer.map(|l| l.0)));
     let cached = ctx.data(|d| d.get_temp::<Cached>(mem)).filter(|c| c.revision == revision);
     let tiles = match cached {
         Some(c) => c.tiles,
diff --git a/crates/ui-egui/src/titlebar.rs b/crates/ui-egui/src/titlebar.rs
index e81adb9f15..b7044e4caf 100644
--- a/crates/ui-egui/src/titlebar.rs
+++ b/crates/ui-egui/src/titlebar.rs
@@ -54,7 +54,7 @@ pub enum CaptionFamily {
 /// The title bar's unused gap, saved by `panels::title_bar` for drags that begin while a modal
 /// backdrop is on top of the normal title-bar widgets.
 pub(crate) fn modal_drag_area_id() -> Id {
-    Id::new(MODAL_DRAG_AREA)
+    Id::unique(MODAL_DRAG_AREA)
 }
 
 /// Restore window dragging over the title bar's empty gap after a modal has blocked the normal
@@ -65,7 +65,7 @@ pub(crate) fn modal_drag_overlay(ctx: &egui::Context) {
     if !area.is_positive() || egui::Popup::is_any_open(ctx) || !crate::dialogs::titlebar_drag_area_is_clear(ctx, area) {
         return;
     }
-    egui::Area::new(Id::new("titlebar-modal-drag-overlay")).order(Order::Tooltip).fixed_pos(area.min).movable(false).sense(Sense::hover()).show(ctx, |ui| {
+    egui::Area::new(Id::unique("titlebar-modal-drag-overlay")).order(Order::Tooltip).fixed_pos(area.min).movable(false).sense(Sense::hover()).show(ctx, |ui| {
         let response = ui.allocate_rect(area, Sense::click_and_drag());
         if response.drag_started_by(PointerButton::Primary) {
             start_os_move(ctx);
@@ -241,7 +241,7 @@ fn layout(s: &CaptionStyle, bar: Rect, left: f32, right: f32) -> Vec<(Caption, R
 
 /// Caption button ids (stable, so tests and agents can find them).
 fn caption_id(c: Caption) -> Id {
-    Id::new(("titlebar-caption", c as u8))
+    Id::unique(("titlebar-caption", c as u8))
 }
 
 fn maximized(ctx: &egui::Context) -> bool {
@@ -290,7 +290,7 @@ pub fn caption_buttons(app: &mut PhotocraftApp, ui: &mut Ui, bar: Rect) {
             Caption::Maximize => tl!("Maximize"),
             Caption::Close => tl!("Close"),
         };
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tip));
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tip));
         if resp.on_hover_text(tip).clicked() {
             clicked = Some(c);
         }
@@ -427,7 +427,7 @@ fn paint_round(ui: &Ui, t: &Tokens, s: &CaptionStyle, c: Caption, maximized: boo
 /// `icon` from the theme at `px` device pixels, uploaded once per theme and size; `None` (also
 /// remembered) when the theme lacks it or it doesn't render.
 fn theme_icon(ctx: &egui::Context, icons: &CaptionIcons, icon: CaptionIcon, px: u32) -> Option<egui::TextureHandle> {
-    let id = Id::new(("caption-icon", &icons.theme, icon, px));
+    let id = Id::unique(("caption-icon", &icons.theme, icon, px));
     if let Some(cached) = ctx.data(|d| d.get_temp::<Option<egui::TextureHandle>>(id)) {
         return cached;
     }
@@ -465,7 +465,7 @@ fn zones(w: Rect) -> [(Rect, ResizeDirection, CursorIcon); 8] {
 }
 
 fn resize_handed_off_id() -> Id {
-    Id::new("titlebar-resize-handed-off")
+    Id::unique("titlebar-resize-handed-off")
 }
 
 /// An OS resize or move started at `pass`; `released` is the pass whose input ended the press
@@ -533,10 +533,10 @@ pub fn resize_zones(ui: &mut Ui) {
         return;
     }
     let w = ctx.content_rect();
-    let layer = LayerId::new(Order::Foreground, Id::new("titlebar-resize"));
+    let layer = LayerId::new(Order::Foreground, Id::unique("titlebar-resize"));
     let zui = ui.new_child(egui::UiBuilder::new().layer_id(layer).max_rect(w));
     for (i, (r, dir, cursor)) in zones(w).into_iter().enumerate() {
-        let resp = zui.interact(r, Id::new(("titlebar-resize", i)), Sense::drag()).on_hover_cursor(cursor);
+        let resp = zui.interact(r, Id::unique(("titlebar-resize", i)), Sense::drag()).on_hover_cursor(cursor);
         if resp.drag_started_by(PointerButton::Primary) {
             ctx.send_viewport_cmd(ViewportCommand::BeginResize(dir));
             hand_off(&ctx);
@@ -604,7 +604,7 @@ mod tests {
             let mut out = self.ctx.run_ui(input, |ui| {
                 crate::panels::title_bar(app, ui);
                 if modal {
-                    egui::Modal::new(Id::new("titlebar-drag-test-modal")).backdrop_color(Color32::TRANSPARENT).show(ui.ctx(), |ui| {
+                    egui::Modal::new(Id::unique("titlebar-drag-test-modal")).backdrop_color(Color32::TRANSPARENT).show(ui.ctx(), |ui| {
                         ui.label("Modal dialog");
                     });
                     modal_drag_overlay(ui.ctx());
@@ -819,7 +819,7 @@ mod tests {
         w.frame_with_modal(vec![], true);
         let area = w.ctx.data(|d| d.get_temp::<Rect>(modal_drag_area_id())).unwrap_or(Rect::NOTHING);
         assert!(area.contains(pos2(980.0, 16.0)), "the probe point must be in the gap: {area:?}");
-        w.ctx.data_mut(|d| d.insert_temp(Id::new("pc-dialog-rects"), vec![area]));
+        w.ctx.data_mut(|d| d.insert_temp(Id::unique("pc-dialog-rects"), vec![area]));
         let cmds = w.gesture_with_modal(&[area.center(), area.center() + vec2(12.0, 4.0)], true);
         assert!(!cmds.iter().any(|c| matches!(c, ViewportCommand::StartDrag)), "{cmds:?}");
     }
diff --git a/crates/ui-egui/src/tone.rs b/crates/ui-egui/src/tone.rs
index f02c108dbb..1c9aad9091 100644
--- a/crates/ui-egui/src/tone.rs
+++ b/crates/ui-egui/src/tone.rs
@@ -1,34 +1,41 @@
 //! Histograms for the tone editors (Levels, Curves, Threshold) and the Histogram panel.
 //!
-//! The adjustment editors themselves live in `adjust_editors`; this module computes and caches
-//! the histograms they draw behind their controls, in the channels of the adjustment's space
-//! (RGB, CMYK ink brightness, Lab), and draws them.
+//! The adjustment editors themselves live in `adjust_editors` and the panel in `histogram_panel`;
+//! this module computes and caches the histograms they draw, in the channels of the adjustment's
+//! space (RGB, CMYK ink brightness, Lab), and draws them.
 
 use std::sync::Arc;
 
-use egui::{Color32, Rect, Sense, vec2};
+use egui::{Color32, Rect};
 use photocraft_doc::adjust::ToneSpace;
 use photocraft_doc::{Document, Layer, LayerId};
 
 use crate::PhotocraftApp;
 use crate::theme::Tokens;
 
-const CHANNELS: [(&str, &str); 4] = [("rgb", "RGB"), ("red", "Red"), ("green", "Green"), ("blue", "Blue")];
-
 static EMPTY: [u32; 256] = [0; 256];
 
-/// 256-bin histograms: the composite then one per channel of the space (RGB: luminosity, R, G, B;
-/// CMYK: composite, C, M, Y, K as channel brightness; Lab: L, a, b). `tag` identifies what they
-/// were computed from (see [`HistSource`]).
-#[derive(Clone, Debug, Default)]
+/// 256-bin histograms: the composite then one per channel of the space (RGB: the channel mean,
+/// R, G, B; CMYK: composite, C, M, Y, K as channel brightness; Lab: L, a, b). `tag` identifies
+/// what they were computed from (see [`HistSource`]).
+#[derive(Clone, Debug)]
 pub struct Histograms {
     pub tag: u64,
     pub ch: Vec<[u32; 256]>,
+    /// Luminosity of the composite (0.30 R + 0.59 G + 0.11 B), whatever the space;
+    /// empty for a gray plane's.
+    pub lum: [u32; 256],
     /// Photoshop's histogram cache level of a composite histogram: 1 when every document pixel
     /// was counted, `n` when a proxy 2^(n-1) times smaller stood in; 0 for a gray plane's.
     pub level: u32,
 }
 
+impl Default for Histograms {
+    fn default() -> Self {
+        Self { tag: 0, ch: Vec::new(), lum: [0; 256], level: 0 }
+    }
+}
+
 impl std::ops::Index<usize> for Histograms {
     type Output = [u32; 256];
     fn index(&self, i: usize) -> &[u32; 256] {
@@ -46,9 +53,18 @@ pub enum HistSource {
     /// The gray plane a Curves target edits: a layer mask, a saved channel or the Quick Mask.
     /// The dialog shows this plane's own levels, not the colour layers beneath (#5335).
     Channel { layer: LayerId, surface: photocraft_engine::channel_cmds::GraySurface },
+    /// A layer and everything beneath it, the layers above hidden (the Histogram panel's
+    /// Adjustment Composite: what an adjustment layer outputs).
+    UpTo(LayerId),
 }
 
-fn tag(source: HistSource, space: ToneSpace) -> u64 {
+/// The whole composited image (the Histogram panel's Entire Image).
+pub const IMAGE: HistSource = HistSource::BelowLayer(LayerId(u64::MAX));
+
+/// The highest histogram cache level: a proxy 2^7 = 128 times smaller.
+pub const MAX_CACHE_LEVEL: u32 = 8;
+
+pub(crate) fn tag(source: HistSource, space: ToneSpace) -> u64 {
     let (k, id) = match source {
         HistSource::BelowLayer(l) => (1u64, l.0),
         HistSource::Layer(l) => (2, l.0),
@@ -56,7 +72,9 @@ fn tag(source: HistSource, space: ToneSpace) -> u64 {
             photocraft_engine::channel_cmds::GraySurface::LayerMask => (3, layer.0),
             photocraft_engine::channel_cmds::GraySurface::Alpha(i) => (4, i as u64),
             photocraft_engine::channel_cmds::GraySurface::QuickMask => (5, layer.0),
+            photocraft_engine::channel_cmds::GraySurface::FilterMask => (6, layer.0),
         },
+        HistSource::UpTo(l) => (7, l.0),
     };
     let s = match space {
         ToneSpace::Rgb => 0u64,
@@ -77,9 +95,31 @@ fn isolate(layers: &mut [Layer], id: LayerId) -> bool {
     found
 }
 
-/// Histograms of `doc` as seen by `source`, in the channels of `space`.
+/// Hides every layer composited above `id` (later siblings, and the later siblings of each group
+/// holding it). Returns whether `id` is in `layers`.
+fn hide_above(layers: &mut [Layer], id: LayerId) -> bool {
+    let mut found = false;
+    for l in layers.iter_mut() {
+        if found {
+            l.visible = false;
+        } else if l.id == id || l.children_mut().is_some_and(|c| hide_above(c, id)) {
+            found = true;
+        }
+    }
+    found
+}
+
+/// Histograms of `doc` as seen by `source`, in the channels of `space`, at whatever cache level
+/// the document's size calls for (up to [`MAX_CACHE_LEVEL`]).
 pub fn compute_histograms(doc: &Document, source: HistSource, space: ToneSpace) -> Histograms {
+    compute_histograms_at(doc, source, space, MAX_CACHE_LEVEL)
+}
+
+/// [`compute_histograms`] at cache level `max_level` or below (Preferences › Performance › Cache
+/// Levels; 1 counts every pixel, the Histogram panel's Uncached Refresh).
+pub fn compute_histograms_at(doc: &Document, source: HistSource, space: ToneSpace, max_level: u32) -> Histograms {
     let mut level = 0;
+    let mut lum = [0u32; 256];
     let mut h = vec![
         [0u32; 256];
         match space {
@@ -96,6 +136,9 @@ pub fn compute_histograms(doc: &Document, source: HistSource, space: ToneSpace)
                 photocraft_engine::channel_cmds::GraySurface::LayerMask => doc.layer(layer).and_then(|l| l.mask.as_ref()).map(|m| &m.surface),
                 photocraft_engine::channel_cmds::GraySurface::Alpha(i) => doc.channels.get(i).map(|c| &c.surface),
                 photocraft_engine::channel_cmds::GraySurface::QuickMask => doc.quick_mask.as_ref().map(|c| &c.surface),
+                photocraft_engine::channel_cmds::GraySurface::FilterMask => {
+                    doc.layer(layer).and_then(|l| photocraft_engine::mask_view_cmds::viewed_mask(l, true)).map(|m| &m.surface)
+                }
             };
             if let Some(s) = surf
                 && let Some(bin) = h.first_mut()
@@ -103,16 +146,45 @@ pub fn compute_histograms(doc: &Document, source: HistSource, space: ToneSpace)
                 *bin = gray_bins(s, doc.bounds());
             }
         }
-        HistSource::BelowLayer(_) | HistSource::Layer(_) => {
-            level = composite_bins(doc, source, space, &mut h);
+        HistSource::BelowLayer(_) | HistSource::Layer(_) | HistSource::UpTo(_) => {
+            // Luminosity rides along as one more histogram after the space's channels.
+            h.push([0; 256]);
+            level = composite_bins(doc, source, space, max_level, &mut h);
+            if let Some(l) = h.pop() {
+                lum = l;
+            }
         }
     }
-    Histograms { tag: tag(source, space), ch: h, level }
+    Histograms { tag: tag(source, space), ch: h, lum, level }
 }
 
-/// Bins of the composited image below (`BelowLayer`) or of one layer alone (`Layer`), in `space`.
-/// Returns the cache level counted: 1 when every document pixel was counted, higher when a
-/// downsampled proxy stood in (like Photoshop's histogram cache levels).
+/// The largest document counted pixel by pixel at the automatic cache level. The web build counts
+/// on the UI thread (it has no worker threads), so it reduces documents a quarter that size.
+fn exact_limit() -> u64 {
+    if cfg!(target_arch = "wasm32") { photocraft_compose::PROXY_THUMBNAIL_PIXELS / 4 } else { photocraft_compose::PROXY_THUMBNAIL_PIXELS }
+}
+
+/// The cache level a histogram of `doc` is counted at: 1 (every pixel) up to the size a proxy
+/// would stand in for, else the level whose 2^(n-1) reduction leaves about 768 pixels on the
+/// longest side, at most `max_level` (clamped to 1..=[`MAX_CACHE_LEVEL`]).
+pub fn cache_level(doc: &Document, max_level: u32) -> u32 {
+    let longest = doc.size.width.max(doc.size.height);
+    let k = longest / 768;
+    let auto = if k >= 2 && doc.size.area() > exact_limit() && photocraft_compose::proxy::proxy_faithful(doc) { k.next_power_of_two().ilog2() + 1 } else { 1 };
+    auto.min(max_level.clamp(1, MAX_CACHE_LEVEL))
+}
+
+/// How many times smaller the proxy counted at `level` (> 1) is: about 768 pixels on the longest
+/// side (as at the automatic level), or 2^(level-1) when Cache Levels caps the level below that.
+fn proxy_factor(doc: &Document, level: u32) -> u32 {
+    let k = doc.size.width.max(doc.size.height) / 768;
+    k.min(1 << (level.clamp(1, MAX_CACHE_LEVEL) - 1)).max(1)
+}
+
+/// Bins of the composited image below (`BelowLayer`), up to (`UpTo`) or of one layer alone
+/// (`Layer`), in `space`, then luminosity in the last of `h`. Returns the cache level counted
+/// (see [`cache_level`]): 1 when every document pixel was counted, higher when a downsampled proxy
+/// stood in (like Photoshop's histogram cache levels).
 ///
 /// The pixels are counted as they are, never blended: an area-averaged thumbnail invented greys
 /// that aren't in the image wherever an edge fell inside one of its cells (#6538). Documents up to
@@ -120,7 +192,7 @@ pub fn compute_histograms(doc: &Document, source: HistSource, space: ToneSpace)
 /// composited in bands and counted exactly, which costs what the thumbnail did (it reduced the
 /// same full composite). Larger ones count a nearest-neighbour proxy composite of about the old
 /// thumbnail's work: it only holds values the layers have.
-fn composite_bins(doc: &Document, source: HistSource, space: ToneSpace, h: &mut [[u32; 256]]) -> u32 {
+fn composite_bins(doc: &Document, source: HistSource, space: ToneSpace, max_level: u32, h: &mut [[u32; 256]]) -> u32 {
     let mut d = doc.clone();
     match source {
         HistSource::BelowLayer(hide) => {
@@ -131,15 +203,13 @@ fn composite_bins(doc: &Document, source: HistSource, space: ToneSpace, h: &mut
         HistSource::Layer(id) => {
             isolate(&mut d.layers, id);
         }
+        HistSource::UpTo(id) => {
+            hide_above(&mut d.layers, id);
+        }
         HistSource::Channel { .. } => {}
     }
-    let longest = d.size.width.max(d.size.height);
-    let k = longest / 768;
-    let (d, level) = if k >= 2 && d.size.area() > photocraft_compose::PROXY_THUMBNAIL_PIXELS && photocraft_compose::proxy::proxy_faithful(&d) {
-        (photocraft_compose::proxy::proxy_document(&d, k), k.next_power_of_two().ilog2() + 1)
-    } else {
-        (d, 1)
-    };
+    let level = cache_level(&d, max_level);
+    let d = if level > 1 { photocraft_compose::proxy::proxy_document(&d, proxy_factor(&d, level)) } else { d };
     let _ = photocraft_compose::render_bands(&d, d.bounds(), 0, |band| -> Result<(), ()> {
         #[cfg(not(target_arch = "wasm32"))]
         let part = {
@@ -180,10 +250,18 @@ fn add_bins(mut a: Vec<[u32; 256]>, b: Vec<[u32; 256]>) -> Vec<[u32; 256]> {
     a
 }
 
-/// Counts straight-alpha composite pixels into `h` (one histogram per channel of `space`);
-/// transparent pixels are skipped.
+/// Luminosity weights (the Histogram panel's Luminosity channel).
+pub const LUMINOSITY: [f32; 3] = [0.30, 0.59, 0.11];
+
+/// Counts straight-alpha composite pixels into `h` (one histogram per channel of `space`, then
+/// luminosity when `h` has room for it); transparent pixels are skipped.
 fn count_pixels(px: &[[f32; 4]], space: ToneSpace, h: &mut [[u32; 256]]) {
     let bin = |v: f32| (v.clamp(0.0, 1.0) * 255.0).round() as usize;
+    let lum_at = match space {
+        ToneSpace::Rgb => 4,
+        ToneSpace::Cmyk => 5,
+        ToneSpace::Lab => 3,
+    };
     let mut add = |c: usize, b: usize| {
         if let Some(n) = h.get_mut(c).and_then(|ch| ch.get_mut(b)) {
             *n = n.saturating_add(1);
@@ -194,6 +272,8 @@ fn count_pixels(px: &[[f32; 4]], space: ToneSpace, h: &mut [[u32; 256]]) {
         if p[3].is_nan() || p[3] <= 0.0 {
             continue;
         }
+        let rgb = [p[0], p[1], p[2]].map(|v| v.clamp(0.0, 1.0));
+        add(lum_at, bin(rgb.iter().zip(LUMINOSITY).map(|(v, w)| v * w).sum()));
         match space {
             ToneSpace::Rgb => {
                 let q = [p[0], p[1], p[2]].map(bin);
@@ -246,7 +326,7 @@ pub fn histograms(app: &mut PhotocraftApp, source: HistSource, space: ToneSpace)
     let (doc_id, rev) = (st.doc.id, st.revision);
     let want = tag(source, space);
     let layer = match source {
-        HistSource::BelowLayer(l) | HistSource::Layer(l) => l,
+        HistSource::BelowLayer(l) | HistSource::Layer(l) | HistSource::UpTo(l) => l,
         HistSource::Channel { layer, .. } => layer,
     };
     let pixels_kept = view_only(st);
@@ -268,7 +348,7 @@ pub fn histograms(app: &mut PhotocraftApp, source: HistSource, space: ToneSpace)
 
 /// Whether the latest revision changed no pixels (selecting a layer, say): cached histograms of
 /// the previous revision still hold (#125).
-fn view_only(st: &photocraft_engine::DocState) -> bool {
+pub(crate) fn view_only(st: &photocraft_engine::DocState) -> bool {
     st.last_damage.is_some_and(|r| r.is_empty())
 }
 
@@ -331,134 +411,6 @@ pub fn channel_color(name: &str, t: &Tokens) -> Color32 {
     }
 }
 
-fn channel_picker(ui: &mut egui::Ui, id: egui::Id, label: &str) -> usize {
-    let mut ch: usize = ui.data(|d| d.get_temp(id)).unwrap_or(0);
-    ui.horizontal(|ui| {
-        let t = Tokens::get(ui.ctx());
-        ui.label(egui::RichText::new(tl!(&label)).color(t.text_dim).size(12.0));
-        let opts: Vec<(usize, &str)> = CHANNELS.iter().enumerate().map(|(i, (_, l))| (i, *l)).collect();
-        crate::widgets::dropdown(ui, &format!("{id:?}-ch"), &mut ch, &opts, 110.0);
-    });
-    ui.data_mut(|d| d.insert_temp(id, ch));
-    ch
-}
-
-// ---------------------------------------------------------------------------------------------
-// Histogram panel
-
-/// Histogram panel (Window › Histogram): whole-image histogram with Photoshop's statistics.
-/// Recomputed at most every 250 ms while the document keeps changing (e.g. during painting).
-pub fn histogram_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
-    let t = Tokens::get(ui.ctx());
-    let Some(st) = app.session.active() else {
-        ui.label(egui::RichText::new(tl!("No document")).color(t.text_faint));
-        return;
-    };
-    let (doc_id, rev) = (st.doc.id, st.revision);
-    let now = crate::gpu_canvas::now_ms();
-    if view_only(st)
-        && let Some((d, r, _, _)) = app.doc_hist.as_mut()
-        && *d == doc_id
-        && *r + 1 == rev
-    {
-        *r = rev;
-    }
-    let stale = !matches!(&app.doc_hist, Some((d, r, _, _)) if *d == doc_id && *r == rev);
-    let due = app.doc_hist.as_ref().is_none_or(|(d, _, at, _)| *d != doc_id || now - at > 250.0);
-    if stale && due {
-        // Computed off the UI thread (doc clone + proxy + pixel counts cost tens of ms on
-        // large documents): the panel keeps showing the previous histogram with the existing
-        // "cached data" warning until the worker delivers.
-        let pending = app.hist_job.as_ref().is_some_and(|(d, r, _)| *d == doc_id && *r == rev);
-        if !pending {
-            let (tx, rx) = std::sync::mpsc::channel();
-            // No threads on the web (and a spawn can fail natively): compute inline then, and
-            // deliver through the same channel so one receive path lands both.
-            #[cfg(not(target_arch = "wasm32"))]
-            let spawned = {
-                let doc = st.doc.clone();
-                let tx = tx.clone();
-                let ctx = ui.ctx().clone();
-                std::thread::Builder::new()
-                    .name("histogram".into())
-                    .spawn(move || {
-                        let t0 = crate::gpu_canvas::now_ms();
-                        let h = Arc::new(compute_histograms(&doc, HistSource::BelowLayer(LayerId(u64::MAX)), ToneSpace::Rgb));
-                        let _ = tx.send((doc.id, crate::gpu_canvas::now_ms() - t0, h));
-                        ctx.request_repaint();
-                    })
-                    .is_ok()
-            };
-            #[cfg(target_arch = "wasm32")]
-            let spawned = false;
-            if !spawned {
-                let t0 = crate::gpu_canvas::now_ms();
-                let h = Arc::new(compute_histograms(&st.doc, HistSource::BelowLayer(LayerId(u64::MAX)), ToneSpace::Rgb));
-                let _ = tx.send((doc_id, crate::gpu_canvas::now_ms() - t0, h));
-            }
-            app.hist_job = Some((doc_id, rev, rx));
-        }
-    } else if stale {
-        ui.ctx().request_repaint_after(std::time::Duration::from_millis(260));
-    }
-    // A finished worker lands its histogram; the revision check keeps a stale result from
-    // overwriting a newer one. A worker that died without sending clears the job so the next
-    // frame schedules a new one.
-    if let Some((jd, jr, rx)) = &app.hist_job {
-        match rx.try_recv() {
-            Ok((_, ms, h)) => {
-                app.perf.span("histogram", ms);
-                if *jd == doc_id {
-                    app.doc_hist = Some((doc_id, *jr, crate::gpu_canvas::now_ms(), h));
-                }
-                app.hist_job = None;
-            }
-            Err(std::sync::mpsc::TryRecvError::Disconnected) => app.hist_job = None,
-            Err(std::sync::mpsc::TryRecvError::Empty) => {}
-        }
-    }
-    let Some((_, _, _, h)) = app.doc_hist.clone() else { return };
-    // 1 when the statistics count every pixel; higher when a downsampled proxy stood in.
-    let level = h.level.max(1);
-    let ch = channel_picker(ui, egui::Id::new("histogram-panel-ch"), "Channel:");
-    let w = ui.available_width();
-    let (r, _) = ui.allocate_exact_size(vec2(w, 100.0), Sense::hover());
-    let p = ui.painter_at(r);
-    p.rect_filled(r, 0.0, t.field);
-    let color = if ch == 0 { Color32::from_gray(if t.pro { 190 } else { 70 }) } else { channel_color(CHANNELS[ch.min(3)].0, &t) };
-    draw_histogram(&p, r, &h[ch], color);
-    if stale {
-        // Photoshop's "cached data" warning triangle while the histogram lags the image.
-        crate::icons::paint(ui, Rect::from_min_size(r.right_top() + vec2(-18.0, 2.0), vec2(16.0, 16.0)), "triangle-alert", 12.0, t.warning);
-    }
-    let hist = &h[ch];
-    let n: u64 = hist.iter().map(|v| *v as u64).sum();
-    if n == 0 {
-        return;
-    }
-    let mean = hist.iter().enumerate().map(|(i, v)| i as f64 * *v as f64).sum::<f64>() / n as f64;
-    let var = hist.iter().enumerate().map(|(i, v)| (i as f64 - mean).powi(2) * *v as f64).sum::<f64>() / n as f64;
-    let mut acc = 0u64;
-    let median = hist.iter().position(|v| {
-        acc += *v as u64;
-        acc * 2 >= n
-    });
-    ui.add_space(4.0);
-    egui::Grid::new("hist-stats").num_columns(2).spacing(vec2(12.0, 2.0)).show(ui, |ui| {
-        for (k, v) in [
-            (tl!("Mean:"), format!("{mean:.2}")),
-            (tl!("Std Dev:"), format!("{:.2}", var.sqrt())),
-            (tl!("Median:"), median.unwrap_or(0).to_string()),
-            (tl!("Pixels:"), n.to_string()),
-            (tl!("Cache Level:"), level.to_string()),
-        ] {
-            ui.label(egui::RichText::new(k).color(t.text_dim).size(11.5));
-            ui.label(egui::RichText::new(v).font(crate::theme::mono(11.5)).color(t.text));
-            ui.end_row();
-        }
-    });
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -523,6 +475,21 @@ mod tests {
             tag(HistSource::Channel { layer, surface: GraySurface::LayerMask }, ToneSpace::Rgb)
         );
         assert_ne!(tag(HistSource::Channel { layer, surface: GraySurface::LayerMask }, ToneSpace::Rgb), tag(HistSource::Layer(layer), ToneSpace::Rgb));
+        // Every source of one layer has its own tag (the filter mask and the Adjustment
+        // Composite once shared one).
+        let sources = [
+            HistSource::BelowLayer(layer),
+            HistSource::Layer(layer),
+            HistSource::UpTo(layer),
+            HistSource::Channel { layer, surface: GraySurface::LayerMask },
+            HistSource::Channel { layer, surface: GraySurface::QuickMask },
+            HistSource::Channel { layer, surface: GraySurface::FilterMask },
+        ];
+        for (i, a) in sources.iter().enumerate() {
+            for b in &sources[i + 1..] {
+                assert_ne!(tag(*a, ToneSpace::Rgb), tag(*b, ToneSpace::Rgb), "{a:?} and {b:?}");
+            }
+        }
     }
 
     /// #6574: bar heights scale linearly to the tallest bin. A 90/10 black/white
@@ -629,77 +596,3 @@ mod tests {
         assert!((mean(&hist[0]) - 255.0 * 3999.0 / 6000.0).abs() < 1.0, "mean {}", mean(&hist[0]));
     }
 }
-
-#[cfg(test)]
-mod hist_async_tests {
-    use super::*;
-    use crate::PhotocraftApp;
-    use serde_json::json;
-
-    /// The panel schedules the histogram on a worker and keeps showing the previous data
-    /// until it lands: right after the trigger the job exists (nothing computed in this
-    /// frame), the receiver delivers, and a stale result cannot overwrite a newer revision.
-    #[test]
-    fn panel_histogram_is_computed_off_the_ui_thread() {
-        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
-        let ctx = egui::Context::default();
-        let _ = &ctx;
-        app.run("file.new", json!({"width": 640, "height": 480})).unwrap();
-        let (doc_id, rev) = {
-            let st = app.session.active().unwrap();
-            (st.doc.id, st.revision)
-        };
-        // Drive one panel frame through a minimal egui pass.
-        let ctx = egui::Context::default();
-        ctx.begin_pass(Default::default());
-        let panel_ui = egui::Ui::new(
-            ctx.clone(),
-            egui::Id::new("hist-test"),
-            egui::UiBuilder::new().max_rect(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(300.0, 200.0))),
-        );
-        let mut panel_ui = panel_ui;
-        histogram_panel(&mut app, &mut panel_ui);
-        // A fast worker (or the inline fallback) may already have landed the result this frame.
-        if let Some(job) = app.hist_job.take() {
-            assert_eq!(job.0, doc_id);
-            assert_eq!(job.1, rev);
-            // The worker delivers (its repaint request is a no-op outside a frame).
-            let (did, _, h) = job.2.recv().expect("the worker delivers the histogram");
-            assert_eq!(did, doc_id);
-            assert!(!h.ch.is_empty(), "the histogram has data");
-            // Delivering it for the revision it was computed from lands in the cache.
-            app.doc_hist = Some((doc_id, rev, crate::gpu_canvas::now_ms(), h.clone()));
-        }
-        assert_eq!(app.doc_hist.as_ref().map(|h| (h.0, h.1)), Some((doc_id, rev)));
-        // …and a newer revision keeps the old entry stale instead of being overwritten by it.
-        app.run("layer.new.layer", json!({})).unwrap();
-        let rev2 = app.session.active().unwrap().revision;
-        assert_ne!(rev, rev2);
-        assert_ne!(app.doc_hist.as_ref().unwrap().1, rev2, "stale after an edit");
-    }
-
-    /// A worker that died without sending (its sender dropped) clears the job, so the next
-    /// frame schedules a new one instead of waiting forever.
-    #[test]
-    fn a_dead_histogram_worker_clears_the_job() {
-        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
-        app.run("file.new", json!({"width": 64, "height": 48})).unwrap();
-        let (doc_id, rev) = {
-            let st = app.session.active().unwrap();
-            (st.doc.id, st.revision)
-        };
-        let (tx, rx) = std::sync::mpsc::channel();
-        drop(tx);
-        app.hist_job = Some((doc_id, rev, rx));
-        let ctx = egui::Context::default();
-        ctx.begin_pass(Default::default());
-        let mut ui = egui::Ui::new(
-            ctx.clone(),
-            egui::Id::new("hist-dead"),
-            egui::UiBuilder::new().max_rect(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(300.0, 200.0))),
-        );
-        histogram_panel(&mut app, &mut ui);
-        assert!(app.hist_job.is_none(), "a disconnected job is dropped");
-        assert!(app.doc_hist.is_none(), "nothing landed from the dead worker");
-    }
-}
diff --git a/crates/ui-egui/src/tool_cursor.rs b/crates/ui-egui/src/tool_cursor.rs
index 5062c839da..fbe108f256 100644
--- a/crates/ui-egui/src/tool_cursor.rs
+++ b/crates/ui-egui/src/tool_cursor.rs
@@ -140,14 +140,61 @@ fn native(ctx: &egui::Context) -> bool {
     cfg!(not(target_arch = "wasm32")) && ctx.viewport_id() == egui::ViewportId::ROOT && !scaled_wayland(ctx)
 }
 
+/// Whether the pointer this viewport last saw has moved on to another of the app's windows,
+/// `others` (the current viewport among them is skipped): from the frame one of them reports the
+/// pointer arriving until this viewport gets a pointer event again. macOS sends a window no
+/// pointer-left event when the pointer moves onto another of the app's windows lying over it (a
+/// floating panel's own OS window), so egui's pointer stays where it was last seen. This also
+/// covers the pointer moving on from that window to the desktop, where this one still hears
+/// nothing. Always false where egui embeds viewports, as they share one window's pointer.
+pub(crate) fn pointer_elsewhere(ctx: &egui::Context, others: &[egui::ViewportId]) -> bool {
+    let own = ctx.viewport_id();
+    let key = egui::Id::unique(("pc-pointer-elsewhere", own));
+    let before = ctx.data(|d| d.get_temp::<bool>(key)).unwrap_or(false);
+    let separate = !ctx.embed_viewports() && others.iter().any(|&v| v != own);
+    if !separate && !before {
+        return false;
+    }
+    let here = ctx.input(|i| i.events.iter().any(|e| matches!(e, egui::Event::PointerMoved(_) | egui::Event::PointerButton { .. } | egui::Event::PointerGone)));
+    // A pointer that arrived: moving or pressing there. One that only stayed (a hidden window
+    // keeps its last one) does not take the pointer from this window.
+    let arrived = |i: &egui::InputState| {
+        i.pointer.has_pointer() && i.events.iter().any(|e| matches!(e, egui::Event::PointerMoved(_) | egui::Event::PointerButton { .. }))
+    };
+    // Where this window has pointer events of its own too, another window's report counts only
+    // if this window's pointer lies inside that window: one just outside its edge, where both
+    // may hear the pointer, stays this window's.
+    let at = ctx.input(|i| i.viewport().inner_rect.zip(i.pointer.latest_pos()).map(|(r, p)| r.min + p.to_vec2()));
+    let there = separate && others.iter().any(|&v| v != own && ctx.input_for(v, |i| arrived(i) && (!here || covers(i.viewport().inner_rect, at))));
+    let now = separate && elsewhere(before, here, there);
+    if now != before {
+        ctx.data_mut(|d| d.insert_temp(key, now));
+    }
+    now
+}
+
+/// Whether a window at `rect` (desktop points) lies over the desktop point `at`; unknown when
+/// either is, which counts as covering.
+fn covers(rect: Option<egui::Rect>, at: Option<Pos2>) -> bool {
+    rect.zip(at).is_none_or(|(r, p)| r.contains(p))
+}
+
+/// [`pointer_elsewhere`] for one frame: whether the pointer belonged to another window `before`,
+/// whether this window got a pointer event (`here`) and whether another window reports the
+/// pointer arriving (`there`). Both in one frame mean the pointer just crossed into the other
+/// window: this window's last events come from before the crossing.
+fn elsewhere(before: bool, here: bool, there: bool) -> bool {
+    there || (before && !here)
+}
+
 /// Mark this window as a Wayland surface (or not), for [`native`]; the shell calls it every pass.
 pub(crate) fn set_wayland(ctx: &egui::Context, wayland: bool) {
-    ctx.data_mut(|d| d.insert_temp(egui::Id::new("photocraft-cursor-wayland"), wayland));
+    ctx.data_mut(|d| d.insert_temp(egui::Id::unique("photocraft-cursor-wayland"), wayland));
 }
 
 /// A Wayland window whose scale is not 1, where winit's cursor bitmaps are unreliable.
 fn scaled_wayland(ctx: &egui::Context) -> bool {
-    let wayland = cfg!(target_os = "linux") && ctx.data(|d| d.get_temp::<bool>(egui::Id::new("photocraft-cursor-wayland"))).unwrap_or(false);
+    let wayland = cfg!(target_os = "linux") && ctx.data(|d| d.get_temp::<bool>(egui::Id::unique("photocraft-cursor-wayland"))).unwrap_or(false);
     wayland && ctx.native_pixels_per_point().unwrap_or_else(|| ctx.pixels_per_point() / ctx.zoom_factor()) != 1.0
 }
 
@@ -259,7 +306,7 @@ fn show(painter: &Painter, at: Pos2, shape: Shape) -> CursorIcon {
 }
 
 fn cached_image(ctx: &egui::Context, shape: &Shape, scale: f32) -> Option<CustomCursorImage> {
-    let id = egui::Id::new("photocraft-tool-cursor");
+    let id = egui::Id::unique("photocraft-tool-cursor");
     if let Some(cached) = ctx.data(|d| d.get_temp::<Cached>(id))
         && cached.shape == *shape
         && cached.scale == scale
diff --git a/crates/ui-egui/src/tool_cursor/tests.rs b/crates/ui-egui/src/tool_cursor/tests.rs
index a57e7f0ae2..c4a9c10364 100644
--- a/crates/ui-egui/src/tool_cursor/tests.rs
+++ b/crates/ui-egui/src/tool_cursor/tests.rs
@@ -599,3 +599,20 @@ fn type_path_cursors_are_small_and_centred() {
         }
     }
 }
+
+#[test]
+fn the_pointer_belongs_to_another_window_from_its_report_until_this_one_hears_it_again() {
+    // The main window, then a floating panel's window over it, the desktop, and back.
+    let mut state = false;
+    let mut frame = |here, there| {
+        state = elsewhere(state, here, there);
+        state
+    };
+    assert!(!frame(true, false), "over the main window");
+    assert!(frame(true, true), "crossing into the floating window");
+    assert!(frame(false, true), "moving in the floating window");
+    assert!(frame(false, false), "on the desktop: the main window still heard nothing");
+    assert!(!frame(true, false), "back over the main window");
+    let float = Some(egui::Rect::from_min_size(egui::pos2(100.0, 100.0), egui::vec2(200.0, 300.0)));
+    assert!(covers(float, Some(egui::pos2(150.0, 150.0))) && !covers(float, Some(egui::pos2(98.0, 150.0))), "just outside its edge stays here");
+}
diff --git a/crates/ui-egui/src/tool_reset.rs b/crates/ui-egui/src/tool_reset.rs
index a93e38f2dd..6381244af3 100644
--- a/crates/ui-egui/src/tool_reset.rs
+++ b/crates/ui-egui/src/tool_reset.rs
@@ -190,7 +190,7 @@ pub fn option_keys(tool: Tool) -> &'static [&'static str] {
         Tool::ColorReplacement => reset!(cr_mode, cr_sampling, cr_limits, cr_tolerance, cr_anti_alias),
         Tool::MagicEraser => reset!(tolerance, anti_alias, contiguous, magic_eraser_opacity),
         Tool::Gradient => reset!(gradient_style, gradient_reverse, gradient_dither, gradient_classic, gradient_blend_mode, fill_opacity),
-        Tool::PaintBucket => reset!(bucket_fill_pattern, fill_opacity, tolerance, anti_alias, contiguous),
+        Tool::PaintBucket => reset!(bucket_fill_pattern, bucket_blend_mode, bucket_clear, fill_opacity, tolerance, anti_alias, contiguous),
         Tool::Type | Tool::VerticalType | Tool::HorizontalTypeMask | Tool::VerticalTypeMask => {
             reset!(type_font, type_style, type_size, type_aa, type_align, type_direction, type_style_defaults)
         }
@@ -201,6 +201,7 @@ pub fn option_keys(tool: Tool) -> &'static [&'static str] {
         Tool::ContentAwareMove => reset!(cam_mode, cam_structure, cam_color, cam_transform_on_drop),
         Tool::RedEye => reset!(red_eye_pupil_size, red_eye_darken),
         Tool::CloneStamp => reset!(clone_aligned, clone_sample),
+        Tool::ArtHistoryBrush => reset!(art_history_style, art_history_area, art_history_tolerance),
         Tool::PatternStamp => reset!(pattern_stamp_aligned, pattern_stamp_impressionist, pattern_stamp_scale, pattern_stamp_angle),
         Tool::Blur | Tool::Sharpen => reset!(strength, protect_detail),
         Tool::Smudge => reset!(strength, finger_painting),
@@ -211,7 +212,7 @@ pub fn option_keys(tool: Tool) -> &'static [&'static str] {
         Tool::CurvaturePen => reset!(vector_mode),
         Tool::FreeformPen => reset!(vector_mode, curve_fit),
         Tool::Rectangle | Tool::EllipseShape | Tool::Triangle | Tool::Polygon | Tool::Line | Tool::CustomShape => {
-            reset!(vector_mode, shape_fill, stroke_width, shape_stroke, corner_radius, polygon_sides, line_weight)
+            reset!(vector_mode, shape_fill, stroke_width, shape_stroke, shape_fill_gradient, shape_stroke_gradient, corner_radius, polygon_sides, line_weight)
         }
         Tool::ColorSampler
         | Tool::Ruler
diff --git a/crates/ui-egui/src/tool_shortcuts.rs b/crates/ui-egui/src/tool_shortcuts.rs
index 91f66a0f07..77d36b1d1c 100644
--- a/crates/ui-egui/src/tool_shortcuts.rs
+++ b/crates/ui-egui/src/tool_shortcuts.rs
@@ -80,7 +80,9 @@ mod tests {
         app.run("prefs.set", json!({"path": "shortcuts.tools.select.pencil", "value": "Q"})).unwrap();
         let mut h = egui_kittest::Harness::builder().build_ui_state(
             |ui, app: &mut PhotocraftApp| {
-                ui.text_edit_singleline(&mut app.ui.status).request_focus();
+                let edit = ui.text_edit_singleline(&mut app.ui.status);
+                edit.request_focus();
+                edit.accessible_name("Status");
                 crate::shortcuts::handle(app, ui.ctx());
             },
             app,
diff --git a/crates/ui-egui/src/transform_tool.rs b/crates/ui-egui/src/transform_tool.rs
index 61e00e8257..9cd31d2e29 100644
--- a/crates/ui-egui/src/transform_tool.rs
+++ b/crates/ui-egui/src/transform_tool.rs
@@ -2904,16 +2904,17 @@ fn transform_fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, t: &TransformSes
     let (r, resp) = ui.allocate_exact_size(vec2(18.0, 22.0), egui::Sense::hover());
     crate::icons::paint(ui, r, "rotate-cw", 13.0, tk.text_dim);
     resp.on_hover_text(tl!("Rotate"));
-    if crate::widgets::value_field(ui, &mut a, -180.0..=180.0, "°", 60.0).changed() {
+    if crate::widgets::value_field(ui, &mut a, -180.0..=180.0, "°", 60.0).accessible_name(tl!("Rotate")).changed() {
         rotate_about_pivot(app, (a as f64 - angle).to_radians());
     }
     // Photoshop's H and V skew fields: the box's sides lean by H, its top and bottom by V.
     let (mut h, mut v) = (skew_h as f32, t.skew_v as f32);
     let lim = -SKEW_LIMIT_DEG..=SKEW_LIMIT_DEG;
     lbl(ui, "H:");
-    let rh = crate::widgets::value_field(ui, &mut h, lim.clone(), "°", 56.0).on_hover_text(tl!("Set horizontal skew"));
+    let rh =
+        crate::widgets::value_field(ui, &mut h, lim.clone(), "°", 56.0).accessible_name(tl!("Set horizontal skew")).on_hover_text(tl!("Set horizontal skew"));
     lbl(ui, "V:");
-    let rv = crate::widgets::value_field(ui, &mut v, lim, "°", 56.0).on_hover_text(tl!("Set vertical skew"));
+    let rv = crate::widgets::value_field(ui, &mut v, lim, "°", 56.0).accessible_name(tl!("Set vertical skew")).on_hover_text(tl!("Set vertical skew"));
     if rh.changed() || rv.changed() {
         skew_about_pivot(app, f64::from(h), f64::from(v));
     }
@@ -2921,7 +2922,7 @@ fn transform_fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, t: &TransformSes
     lbl(ui, tl!("Interpolation:"));
     let mut interp = t.interpolation.clone();
     let opts = [("bicubic".to_string(), tl!("Bicubic")), ("bilinear".to_string(), tl!("Bilinear")), ("nearest".to_string(), tl!("Nearest Neighbor"))];
-    if crate::widgets::dropdown(ui, "transform-interp", &mut interp, &opts, 130.0)
+    if crate::widgets::dropdown(ui, "transform-interp", tl!("Interpolation"), &mut interp, &opts, 130.0)
         && let Some(s) = app.ui.transform.as_mut()
     {
         s.interpolation = interp;
@@ -2983,9 +2984,9 @@ pub(crate) fn position_size_fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, t
     let mut px = pivot[0] as f32;
     let mut py = pivot[1] as f32;
     lbl(ui, "X:");
-    let rx = crate::widgets::value_field(ui, &mut px, -POSITION_LIMIT_PX..=POSITION_LIMIT_PX, "px", 72.0);
+    let rx = crate::widgets::value_field(ui, &mut px, -POSITION_LIMIT_PX..=POSITION_LIMIT_PX, "px", 72.0).accessible_name("X");
     lbl(ui, "Y:");
-    let ry = crate::widgets::value_field(ui, &mut py, -POSITION_LIMIT_PX..=POSITION_LIMIT_PX, "px", 72.0);
+    let ry = crate::widgets::value_field(ui, &mut py, -POSITION_LIMIT_PX..=POSITION_LIMIT_PX, "px", 72.0).accessible_name("Y");
     if (rx.changed() || ry.changed())
         && let Some(s) = app.ui.transform.as_mut()
     {
@@ -3008,13 +3009,13 @@ pub(crate) fn position_size_fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, t
     // in a length), converted at the document's resolution against the box's original side (#6284).
     let units = crate::widgets::FieldUnits { unit: u.unit, dpi: u.dpi, ppi: u.ppi };
     lbl(ui, "W:");
-    let rw = crate::widgets::value_field_extent(ui, &mut w, -wlim_u..=wlim_u, suffix, size_w, places, units, side_w);
+    let rw = crate::widgets::value_field_extent(ui, &mut w, -wlim_u..=wlim_u, suffix, size_w, places, units, side_w).accessible_name(tl!("Width"));
     let link = !app.ui.transform_unlinked;
     if crate::icons::button(ui, if link { "link" } else { "unlink" }, 22.0, link, tl!("Maintain aspect ratio")).clicked() {
         app.ui.transform_unlinked = link;
     }
     lbl(ui, "H:");
-    let rh = crate::widgets::value_field_extent(ui, &mut h, -hlim_u..=hlim_u, suffix, size_w, places, units, side_h);
+    let rh = crate::widgets::value_field_extent(ui, &mut h, -hlim_u..=hlim_u, suffix, size_w, places, units, side_h).accessible_name(tl!("Height"));
     for r in [&rw, &rh] {
         r.context_menu(|ui| {
             if let Some(name) = crate::rulers::unit_menu(ui, u.unit) {
@@ -3050,7 +3051,7 @@ fn warp_fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, w: &Warp) {
     lbl(ui, tl!("Warp:"));
     let mut style = w.style;
     let opts: Vec<(WarpStyle, &str)> = WarpStyle::all().filter(|s| !(on_type && *s == WarpStyle::Custom)).map(|s| (s, s.label())).collect();
-    if crate::widgets::dropdown(ui, "warp-style", &mut style, &opts, 120.0)
+    if crate::widgets::dropdown(ui, "warp-style", tl!("Warp"), &mut style, &opts, 120.0)
         && let Some(t) = app.ui.transform.as_mut()
     {
         let b = t.rect;
@@ -3065,7 +3066,7 @@ fn warp_fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, w: &Warp) {
     let preset = w.style.is_preset();
     ui.add_enabled_ui(preset, |ui| {
         let orient = crate::icons::button(ui, "arrow-left-right", 26.0, w.vertical, tl!("Vertical"));
-        orient.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, preset, "Change warp orientation"));
+        orient.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, preset, "Change warp orientation"));
         if orient.clicked()
             && let Some(Some(cur)) = app.ui.transform.as_mut().map(|t| t.warp.as_mut())
         {
@@ -3075,7 +3076,7 @@ fn warp_fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, w: &Warp) {
         for (k, (name, v)) in fields.iter().enumerate() {
             lbl(ui, name);
             let mut f = *v as f32;
-            if crate::widgets::value_field(ui, &mut f, -100.0..=100.0, "%", 58.0).changed()
+            if crate::widgets::value_field(ui, &mut f, -100.0..=100.0, "%", 58.0).accessible_name(*name).changed()
                 && let Some(Some(cur)) = app.ui.transform.as_mut().map(|t| t.warp.as_mut())
             {
                 match k {
@@ -3122,7 +3123,7 @@ fn warp_mesh_fields(app: &mut PhotocraftApp, ui: &mut egui::Ui, w: &Warp) {
         ("4".to_string(), tl!("4 x 4")),
         ("5".to_string(), tl!("5 x 5")),
     ];
-    if crate::widgets::dropdown(ui, "warp-grid", &mut grid, &opts, 92.0)
+    if crate::widgets::dropdown(ui, "warp-grid", tl!("Grid"), &mut grid, &opts, 92.0)
         && let Some(n) = match grid.as_str() {
             "default" => Some(1),
             "3" => Some(3),
@@ -3205,7 +3206,7 @@ fn split_icon(ui: &mut egui::Ui, kind: &str, tip: &str, on: bool) -> egui::Respo
     } else {
         ui.painter().circle_stroke(c, 2.1, stroke);
     }
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tip));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tip));
     resp.on_hover_text(tip)
 }
 
@@ -3220,20 +3221,20 @@ fn transform_actions(app: &mut PhotocraftApp, ui: &mut egui::Ui, warping: bool,
     };
     let commit_btn = crate::icons::button(ui, "check", 26.0, false, &commit_tip);
     let label = "Commit transform";
-    commit_btn.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!(label)));
+    commit_btn.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(label)));
     if commit_btn.clicked() {
         commit(app);
     }
     let cancel_tip = if warping { tl!("Cancel warp (Esc)") } else { tl!("Cancel transform (Esc)") };
     let cancel_btn = crate::icons::button(ui, "ban", 26.0, false, cancel_tip);
     let label = "Cancel transform";
-    cancel_btn.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!(label)));
+    cancel_btn.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(label)));
     if cancel_btn.clicked() {
         cancel(app);
     }
     if warping {
         let reset = crate::icons::button(ui, "undo-2", 26.0, false, tl!("Reset"));
-        reset.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, "Reset warp"));
+        reset.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, "Reset warp"));
         if reset.clicked() {
             reset_warp(app);
         }
@@ -3243,7 +3244,7 @@ fn transform_actions(app: &mut PhotocraftApp, ui: &mut egui::Ui, warping: bool,
     }
     crate::widgets::vline(ui, 22.0);
     let mode = crate::icons::button(ui, "grid-3x3", 26.0, warping, tl!("Switch between free transform and warp modes"));
-    mode.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, "Switch between free transform and warp modes"));
+    mode.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, "Switch between free transform and warp modes"));
     if mode.clicked() {
         if warping {
             leave_warp(app);
@@ -4636,7 +4637,7 @@ mod tests {
         let ctx = egui::Context::default();
         let mut drawn = false;
         let mut output = ctx.run_ui(Default::default(), |ui| {
-            let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::new("ants-test")));
+            let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Foreground, egui::Id::unique("ants-test")));
             drawn = draw_selection(app, &painter, xf, st.doc.id, &segs, 0.0);
         });
         output.textures_delta.clear();
@@ -4864,6 +4865,56 @@ mod tests {
         assert_eq!(rotate_cursor_dir(&app, [f64::NAN, 32.0]), None);
     }
 
+    // Regression test for #4139: the rotate zone hides the OS pointer (`CursorIcon::None`), so the
+    // canvas has to draw the curved turn arrow itself where the box has no preview to draw it
+    // (the preview's overlay draws it otherwise); the pointer vanished over the zone.
+    #[test]
+    fn the_rotate_zone_draws_the_turn_arrow_where_the_pointer_is_hidden() {
+        let mut app = app_with_square(256, photocraft_geom::Rect::new(32, 32, 160, 160));
+        app.ui.tool = Tool::Move;
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(1200.0, 800.0)).with_max_steps(64).build_eframe(move |cc| {
+            PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
+            app
+        });
+        h.run_steps(4);
+        let ctx = h.ctx.clone();
+        crate::menus::invoke(h.state_mut(), &ctx, "edit.freeTransform", json!({})).unwrap();
+        h.run_steps(3);
+        let tol = handle_tolerance(h.state());
+        let xf = ViewXform::active(h.state()).unwrap();
+        let accent = crate::theme::Tokens::get(&h.ctx).accent_text;
+        // The arrow's bright stroke: a 17-point arc in the accent colour around the pointer.
+        let arrows = |h: &egui_kittest::Harness<'_, PhotocraftApp>, at: egui::Pos2| {
+            h.output()
+                .shapes
+                .iter()
+                .filter(|c| match &c.shape {
+                    egui::Shape::Path(p) => {
+                        p.points.len() == 17
+                            && p.stroke.width == 1.5
+                            && p.stroke.color == egui::epaint::ColorMode::Solid(accent)
+                            && p.points.iter().all(|q| q.distance(at) < 40.0)
+                    }
+                    _ => false,
+                })
+                .count()
+        };
+        let outside = xf.to_screen((32.0 - tol * 1.5) as f32, (32.0 - tol * 1.5) as f32);
+
+        // A box with no preview (its overlay is what draws the arrow otherwise).
+        h.state_mut().transform_preview = None;
+        h.hover_at(outside);
+        h.run_steps(3);
+        assert!(h.state().ui.transform.is_some() && h.state().transform_preview.is_none());
+        assert_eq!(h.output().platform_output.cursor_icon, CursorIcon::None, "the OS pointer is hidden in the rotate zone");
+        assert_eq!(arrows(&h, outside), 1, "and the curved arrow is drawn in its place");
+
+        let inside = xf.to_screen(96.0, 96.0);
+        h.hover_at(inside);
+        h.run_steps(3);
+        assert_eq!(arrows(&h, inside), 0, "no arrow over the box");
+    }
+
     /// The resize arrows follow the box's turn and the view's rotation and flip: each handle
     /// shows the arrow it resizes along on screen, not the one it had on the upright box.
     #[test]
diff --git a/crates/ui-egui/src/transform_type_tests.rs b/crates/ui-egui/src/transform_type_tests.rs
index 457c03c1cb..eeb91f44b9 100644
--- a/crates/ui-egui/src/transform_type_tests.rs
+++ b/crates/ui-egui/src/transform_type_tests.rs
@@ -55,6 +55,7 @@ fn type_layers_offer_free_transform_but_not_distort_or_perspective() {
         type_layer: false,
         guide: false,
         spelling: None,
+        crop: None,
     };
     assert!(crate::canvas_tool_menu::available(&app, &menu, "edit.freeTransform"));
     assert!(!crate::canvas_tool_menu::available(&app, &menu, "edit.transform.distort"));
diff --git a/crates/ui-egui/src/type_font_picker_tests.rs b/crates/ui-egui/src/type_font_picker_tests.rs
index 12c1dec020..48d03c18fc 100644
--- a/crates/ui-egui/src/type_font_picker_tests.rs
+++ b/crates/ui-egui/src/type_font_picker_tests.rs
@@ -16,6 +16,12 @@ struct State {
     recents: Vec<String>,
 }
 
+/// Frames a harness may take to settle. Opening the font menu scrolls it to the current family on
+/// the first laid-out pass, and the rows that scroll into view load their samples then: a family
+/// with an Arabic sample asks for one more pass to widen its row. How many do depends on the
+/// fonts installed (Linux CI settled after 6), so 4 frames, egui's default, is too few.
+const SETTLE_STEPS: u64 = 16;
+
 fn harness() -> Harness<'static, State> {
     harness_with(FontPreview::Medium)
 }
@@ -29,7 +35,7 @@ fn harness_with_recents(preview: FontPreview, recents: Vec<String>) -> Harness<'
     let mut families: Vec<String> = (0..60).map(|i| format!("Family {i:02}")).collect();
     families.push("Zeta Sans".into());
     let state = State { current: "Family 00".into(), families, button: egui::Id::NULL, popup: egui::Id::NULL, preview, recents };
-    let mut h = Harness::builder().with_size(vec2(600.0, 900.0)).build_ui_state(
+    let mut h = Harness::builder().with_size(vec2(600.0, 900.0)).with_max_steps(SETTLE_STEPS).build_ui_state(
         |ui, s: &mut State| {
             s.button = ui.make_persistent_id(egui::IdSalt::new("type-font"));
             s.popup = s.button.with("popup");
@@ -73,7 +79,7 @@ fn hovering_a_font_row_sets_preview_and_leaving_clears_it() {
     assert!(popup.contains(row), "row {row:?} is outside popup {popup:?}");
     h.hover_at(row);
     h.run_steps(2);
-    let hover_id = egui::Id::new("type-font-hover");
+    let hover_id = egui::Id::unique("type-font-hover");
     assert_eq!(h.ctx.input(|i| i.pointer.interact_pos()), Some(row));
     assert!(popup_rect(&h).is_some(), "popup closes while moving pointer to the row");
     assert_eq!(
@@ -132,6 +138,7 @@ fn the_search_field_stays_put_while_the_list_scrolls() {
     h.hover_at(h.get_by_label("Family 05").rect().center());
     for _ in 0..6 {
         h.event(egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
             unit: egui::MouseWheelUnit::Line,
             delta: vec2(0.0, -3.0),
             phase: egui::TouchPhase::Move,
@@ -340,7 +347,7 @@ fn the_first_arrow_after_a_pick_keeps_the_focus_between_neighbours() {
         let families: Vec<String> = (0..20).map(|i| format!("Family {i:02}")).collect();
         let state =
             State { current: "Family 03".into(), families, button: egui::Id::NULL, popup: egui::Id::NULL, preview: FontPreview::Off, recents: Vec::new() };
-        let mut h = Harness::builder().with_size(vec2(600.0, 900.0)).build_ui_state(
+        let mut h = Harness::builder().with_size(vec2(600.0, 900.0)).with_max_steps(SETTLE_STEPS).build_ui_state(
             |ui, s: &mut State| {
                 let _ = ui.button("Above");
                 s.button = ui.make_persistent_id(egui::IdSalt::new("type-font"));
@@ -435,7 +442,7 @@ fn font_cycle_in_options_bar_edits_the_layer_and_can_be_undone() {
     let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Services::default());
     app.run("file.new", json!({"width": 200, "height": 100})).unwrap();
     app.run("type.create", json!({"text": "Sample", "font": "Inter", "size": 18})).unwrap();
-    let mut h = Harness::builder().with_size(vec2(900.0, 700.0)).build_ui_state(
+    let mut h = Harness::builder().with_size(vec2(900.0, 700.0)).with_max_steps(SETTLE_STEPS).build_ui_state(
         |ui, app| {
             if ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
                 ui.horizontal(|ui| crate::type_tool::options_bar(app, ui));
@@ -446,7 +453,8 @@ fn font_cycle_in_options_bar_edits_the_layer_and_can_be_undone() {
     crate::PhotocraftApp::setup_context(&h.ctx, Default::default());
     h.run_steps(4);
     h.query_all_by_role(Role::ComboBox).next().unwrap().click();
-    h.run();
+    // The font search field's caret blinks every pass, so settle with bounded steps instead.
+    h.run_steps(2);
     h.get_by_role(Role::TextInput).type_text("JetBrains");
     h.key_press(Key::ArrowDown);
     h.run();
@@ -480,7 +488,7 @@ fn hovering_a_font_does_not_pollute_history_and_clears_on_close() {
 
     // Simulate hovering a font directly via the preview module
     let ctx = egui::Context::default();
-    ctx.data_mut(|d| d.insert_temp(egui::Id::new("type-font-hover"), "JetBrains Mono".to_string()));
+    ctx.data_mut(|d| d.insert_temp(egui::Id::unique("type-font-hover"), "JetBrains Mono".to_string()));
     crate::type_font_preview::follow_hover(&mut app, &ctx);
 
     // Verify a preview document is generated
@@ -529,7 +537,9 @@ fn options_bar_hover_previews_on_canvas_without_committing() {
         }
     }
 
-    let mut h = Harness::builder().with_size(vec2(900.0, 700.0)).build_eframe(|cc| {
+    // Opening the menu on the current family (#9197) paints rows that load their font samples
+    // over a few frames, more than the default four steps.
+    let mut h = Harness::builder().with_size(vec2(900.0, 700.0)).with_max_steps(64).build_eframe(|cc| {
         PhotocraftApp::setup_context(&cc.egui_ctx, crate::theme::ThemeKind::ALL[0]);
         PreviewApp { app: PhotocraftApp::new(photocraft_engine::Session::new(), Services::default()) }
     });
@@ -656,7 +666,7 @@ fn localized_font_names_label_the_menu_but_pick_the_family() {
         preview: FontPreview::Medium,
         recents: Vec::new(),
     };
-    let mut h = Harness::builder().with_size(vec2(600.0, 900.0)).build_ui_state(
+    let mut h = Harness::builder().with_size(vec2(600.0, 900.0)).with_max_steps(SETTLE_STEPS).build_ui_state(
         |ui, s: &mut State| {
             s.popup = ui.make_persistent_id(egui::IdSalt::new("type-font")).with("popup");
             let fams = s.families.clone();
@@ -665,6 +675,9 @@ fn localized_font_names_label_the_menu_but_pick_the_family() {
         },
         state,
     );
+    // The localized menu lists Japanese names, so install the app's bundled theme fonts
+    // (including the craft-fonts Japanese faces) before the first pass shapes text.
+    crate::theme::install_fonts(&h.ctx);
     // Show Font Names in English on: no localized labels.
     crate::type_tool::sync_font_names(&h.ctx, true);
     let labels: HashMap<String, String> = [("MS Gothic".to_string(), "ＭＳ ゴシック".to_string())].into();
@@ -768,26 +781,162 @@ fn open_menu_arrows_walk_on_through_recent_fonts() {
 }
 
 /// Opened on a family that is also a recent one (the usual case: every pick records it), the
-/// arrows start from its alphabetical place, and only that row is marked.
+/// menu marks its copy in the recent group, as Photoshop's does (#9160), and only that row; the
+/// arrows walk on from there through the list as shown (Photoshop: ↓ goes to the next recent
+/// family).
 #[test]
-fn open_menu_on_a_recent_font_steps_through_the_alphabet() {
+fn open_menu_on_a_recent_font_marks_its_recent_row() {
     use egui_kittest::kittest::NodeT;
-    for (key, want) in [(Key::ArrowDown, "Family 06"), (Key::ArrowUp, "Family 04")] {
-        let mut h = harness_with_recents(FontPreview::Off, vec!["Family 05".into(), "Family 09".into()]);
-        h.state_mut().current = "Family 05".into();
-        h.run();
-        open(&mut h);
-        let marked = |h: &Harness<'static, State>, label: &str| {
-            h.query_all_by_label(label).filter(|n| n.accesskit_node().toggled() == Some(egui::accesskit::Toggled::True)).count()
-        };
-        assert_eq!(marked(&h, "Family 05"), 1, "one row marked");
-        h.key_press(key);
-        h.run();
-        assert_eq!(h.state().current, want);
-        h.key_press(Key::ArrowDown);
+    let mut h = harness_with_recents(FontPreview::Off, vec!["Family 05".into(), "Family 09".into()]);
+    h.state_mut().current = "Family 05".into();
+    h.run();
+    open(&mut h);
+    let marked = |h: &Harness<'static, State>, label: &str| -> Vec<f32> {
+        h.query_all_by_label(label).filter(|n| n.accesskit_node().toggled() == Some(egui::accesskit::Toggled::True)).map(|n| n.rect().top()).collect()
+    };
+    let tops = |h: &Harness<'static, State>, label: &str| -> Vec<f32> {
+        let mut t: Vec<f32> = h.query_all_by_label(label).map(|n| n.rect().top()).collect();
+        t.sort_by(f32::total_cmp);
+        t
+    };
+    assert_eq!(marked(&h, "Family 05"), [tops(&h, "Family 05")[0]], "the upper (recent) copy alone is marked");
+    h.key_press(Key::ArrowDown);
+    h.run();
+    assert_eq!(h.state().current, "Family 09", "↓ walks on to the next recent family");
+    h.key_press(Key::ArrowUp);
+    h.run();
+    assert_eq!(h.state().current, "Family 05", "and ↑ back");
+}
+
+/// #9160: the menu opens showing the current family, as Photoshop's does: a family deep in the
+/// list is scrolled to the top of the view, not left wherever the list happens to start.
+#[test]
+fn open_menu_shows_the_current_family() {
+    let mut h = harness_with_recents(FontPreview::Off, vec!["Zeta Sans".into()]);
+    h.state_mut().current = "Family 40".into();
+    h.run();
+    open(&mut h);
+    h.run();
+    let popup = popup_rect(&h).expect("the menu is open");
+    let row = h.query_all_by_label("Family 40").next().expect("its row").rect();
+    assert!(popup.contains_rect(row), "Family 40 is in view: {row:?} in {popup:?}");
+}
+
+/// The current family is in view the frame the menu opens, with the app's scroll animation on:
+/// the reveal jumps, where an animated scroll left the row outside the popup for a while.
+/// The harness turns animations off, so this turns a slow one back on.
+#[test]
+fn open_menu_shows_the_current_family_without_animating() {
+    let mut h = harness_with_recents(FontPreview::Off, Vec::new());
+    h.ctx.all_styles_mut(|s| s.scroll_animation = egui::style::ScrollAnimation::duration(10.0));
+    h.state_mut().current = "Family 40".into();
+    h.run();
+    h.query_all_by_role(Role::ComboBox).next().unwrap().click();
+    h.run_steps(4);
+    let popup = popup_rect(&h).expect("the menu is open");
+    let row = h.query_all_by_label("Family 40").next().expect("its row").rect();
+    assert!(popup.contains_rect(row), "Family 40 is in view: {row:?} in {popup:?}");
+}
+
+/// Photoshop: ↑ on the top recent row stays there, without wrapping or changing the font.
+#[test]
+fn open_menu_arrow_up_on_the_top_recent_row_stays_there() {
+    use egui_kittest::kittest::NodeT;
+    let mut h = harness_with_recents(FontPreview::Off, vec!["Family 05".into(), "Family 09".into()]);
+    h.state_mut().current = "Family 05".into();
+    h.run();
+    open(&mut h);
+    let marked_top = |h: &Harness<'static, State>| -> Vec<f32> {
+        h.query_all_by_label("Family 05").filter(|n| n.accesskit_node().toggled() == Some(egui::accesskit::Toggled::True)).map(|n| n.rect().top()).collect()
+    };
+    let before = marked_top(&h);
+    assert_eq!(before.len(), 1, "one row marked");
+    for _ in 0..2 {
         h.key_press(Key::ArrowUp);
         h.run();
-        assert_eq!(h.state().current, want, "and walks on from there");
+        assert_eq!(h.state().current, "Family 05", "↑ on the top row keeps the font");
+        assert_eq!(marked_top(&h), before, "and the mark stays on the top row");
+    }
+}
+
+/// #9160: when the marked recent row fits below the top of the recent group, the menu opens
+/// with the whole group in view, its first row just below the search field.
+#[test]
+fn open_menu_shows_the_recent_group_when_the_marked_row_fits_below_it() {
+    use egui_kittest::kittest::NodeT;
+    let recents: Vec<String> = (10..15).map(|i| format!("Family {i}")).collect();
+    let mut h = harness_with_recents(FontPreview::Off, recents);
+    h.state_mut().current = "Family 12".into();
+    h.run();
+    open(&mut h);
+    h.run();
+    let popup = popup_rect(&h).expect("the menu is open");
+    let search = h.get_by_role(Role::TextInput).rect();
+    let first = h.query_all_by_label("Family 10").map(|n| n.rect()).min_by(|a, b| a.top().total_cmp(&b.top())).expect("the recent group's first row");
+    let row = h.query_all_by_label("Family 12").find(|n| n.accesskit_node().toggled() == Some(egui::accesskit::Toggled::True)).expect("its marked row").rect();
+    assert!(popup.contains_rect(row) && row.top() >= search.bottom(), "recent #3 is in view: {row:?} in {popup:?}");
+    assert!(
+        popup.contains_rect(first) && (0.0..=12.0).contains(&(first.top() - search.bottom())),
+        "the group's first row sits just below the search field: {first:?} under {search:?}"
+    );
+}
+
+/// #9160 with large previews: a recent family further down the default ten recents opens in view,
+/// not below the fold because the menu scrolled to the top of the recent group.
+#[test]
+fn open_menu_shows_a_lower_recent_family_with_large_previews() {
+    use egui_kittest::kittest::NodeT;
+    for preview in [FontPreview::Huge, FontPreview::ExtraLarge] {
+        let recents: Vec<String> = (10..20).map(|i| format!("Family {i}")).collect();
+        let mut h = harness_with_recents(preview, recents);
+        h.state_mut().current = "Family 17".into();
+        h.run();
+        open(&mut h);
+        h.run();
+        let popup = popup_rect(&h).expect("the menu is open");
+        let search = h.get_by_role(Role::TextInput).rect();
+        let row =
+            h.query_all_by_label("Family 17").find(|n| n.accesskit_node().toggled() == Some(egui::accesskit::Toggled::True)).expect("its marked row").rect();
+        assert!(popup.contains_rect(row) && row.top() >= search.bottom(), "{preview:?}: recent #8 is in view: {row:?} in {popup:?} below {search:?}");
+    }
+}
+
+/// The open-scroll happens once, when the menu opens. With no row for the current family then
+/// (a missing font, a mixed selection), the list the user scrolled does not jump later when one
+/// turns up: the font finishes loading, or the selection settles on one family.
+#[test]
+fn open_menu_without_the_current_family_never_jumps_later() {
+    for missing in [true, false] {
+        let mut h = harness_with_recents(FontPreview::Off, Vec::new());
+        if missing {
+            h.state_mut().families.retain(|f| f != "Family 40");
+            h.state_mut().current = "Family 40".into();
+        } else {
+            h.state_mut().current = String::new();
+        }
+        h.run();
+        open(&mut h);
+        h.run();
+        h.hover_at(h.get_by_label("Family 05").rect().center());
+        for _ in 0..3 {
+            h.event(egui::Event::MouseWheel {
+                source: egui::MouseWheelSource::Unknown,
+                unit: egui::MouseWheelUnit::Line,
+                delta: vec2(0.0, -3.0),
+                phase: egui::TouchPhase::Move,
+                modifiers: Modifiers::NONE,
+            });
+            h.run();
+        }
+        let scrolled = h.get_by_label("Family 00").rect();
+        if missing {
+            h.state_mut().families.push("Family 40".into());
+        } else {
+            h.state_mut().current = "Family 40".into();
+        }
+        h.run_steps(3);
+        assert!(popup_rect(&h).is_some(), "the menu stays open");
+        assert_eq!(h.get_by_label("Family 00").rect(), scrolled, "missing = {missing}: the list jumped");
     }
 }
 
@@ -799,7 +948,7 @@ fn options_bar_menu_arrows_walk_on_while_recording_recent_fonts() {
     let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Services::default());
     app.run("file.new", json!({"width": 200, "height": 100})).unwrap();
     app.run("type.create", json!({"text": "Sample", "font": "Inter", "size": 18})).unwrap();
-    let mut h = Harness::builder().with_size(vec2(900.0, 700.0)).build_ui_state(
+    let mut h = Harness::builder().with_size(vec2(900.0, 700.0)).with_max_steps(SETTLE_STEPS).build_ui_state(
         |ui, app| {
             if ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
                 ui.horizontal(|ui| crate::type_tool::options_bar(app, ui));
@@ -814,7 +963,8 @@ fn options_bar_menu_arrows_walk_on_while_recording_recent_fonts() {
     let mut seen = vec![h.state().ui.tool_options.type_font.clone()];
     for _ in 0..4 {
         h.key_press(Key::ArrowDown);
-        h.run();
+        // The open font menu repaints for its caret, so step a bounded number of times.
+        h.run_steps(2);
         seen.push(h.state().ui.tool_options.type_font.clone());
     }
     let mut once = seen.clone();
@@ -831,7 +981,13 @@ fn wheel_over_the_closed_font_button_steps_through_the_families() {
     h.hover_at(button);
     h.run();
     let wheel = |h: &mut Harness<'static, State>, y: f32| {
-        h.event(egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: vec2(0.0, y), phase: egui::TouchPhase::Move, modifiers: Modifiers::NONE });
+        h.event(egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: egui::MouseWheelUnit::Line,
+            delta: vec2(0.0, y),
+            phase: egui::TouchPhase::Move,
+            modifiers: Modifiers::NONE,
+        });
         h.run();
     };
     wheel(&mut h, -2.0);
@@ -850,7 +1006,13 @@ fn wheel_over_the_closed_button_keeps_a_stable_order_with_recents() {
     h.hover_at(button);
     h.run();
     let wheel = |h: &mut Harness<'static, State>, y: f32| {
-        h.event(egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta: vec2(0.0, y), phase: egui::TouchPhase::Move, modifiers: Modifiers::NONE });
+        h.event(egui::Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: egui::MouseWheelUnit::Line,
+            delta: vec2(0.0, y),
+            phase: egui::TouchPhase::Move,
+            modifiers: Modifiers::NONE,
+        });
         h.run();
     };
     wheel(&mut h, -1.0);
diff --git a/crates/ui-egui/src/type_font_preview.rs b/crates/ui-egui/src/type_font_preview.rs
index 7f420d2494..bb91b61ea0 100644
--- a/crates/ui-egui/src/type_font_preview.rs
+++ b/crates/ui-egui/src/type_font_preview.rs
@@ -29,8 +29,8 @@ pub struct TypeFontPreview {
 }
 
 pub(crate) fn follow_hover(app: &mut PhotocraftApp, ctx: &egui::Context) {
-    let hover_id = egui::Id::new("type-font-hover");
-    let since_id = egui::Id::new("type-font-hover-since");
+    let hover_id = egui::Id::unique("type-font-hover");
+    let since_id = egui::Id::unique("type-font-hover-since");
     let family = ctx.data_mut(|d| {
         let family = d.get_temp::<String>(hover_id);
         d.remove::<String>(hover_id);
@@ -170,7 +170,7 @@ mod tests {
     fn frame(app: &mut PhotocraftApp, ctx: &egui::Context, family: Option<&str>, time: f64) {
         let mut out = ctx.run_ui(egui::RawInput { time: Some(time), ..Default::default() }, |ui| {
             if let Some(f) = family {
-                ui.ctx().data_mut(|d| d.insert_temp(egui::Id::new("type-font-hover"), f.to_string()));
+                ui.ctx().data_mut(|d| d.insert_temp(egui::Id::unique("type-font-hover"), f.to_string()));
             }
             follow_hover(app, ui.ctx());
         });
diff --git a/crates/ui-egui/src/type_panels_ui.rs b/crates/ui-egui/src/type_panels_ui.rs
index 65e28e04be..02c99b9dd4 100644
--- a/crates/ui-egui/src/type_panels_ui.rs
+++ b/crates/ui-egui/src/type_panels_ui.rs
@@ -145,7 +145,7 @@ pub fn windows(app: &mut PhotocraftApp, ctx: &egui::Context) {
     if app.ui.type_panels.styles {
         let mut close = false;
         egui::Window::new(tl!("Type Styles"))
-            .id(egui::Id::new("type-styles-window"))
+            .id(egui::Id::unique("type-styles-window"))
             .title_bar(false)
             .resizable(false)
             .frame(float_frame(&t))
@@ -180,7 +180,7 @@ pub fn windows(app: &mut PhotocraftApp, ctx: &egui::Context) {
     if app.ui.type_panels.glyphs {
         let mut close = false;
         egui::Window::new(tl!("Glyphs"))
-            .id(egui::Id::new("glyphs-window"))
+            .id(egui::Id::unique("glyphs-window"))
             .title_bar(false)
             .resizable(false)
             .frame(float_frame(&t))
@@ -358,11 +358,11 @@ fn options_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, paragraph: bool, s
         });
     });
     // Name.
-    let key = egui::Id::new(("style-name", paragraph, id));
+    let key = egui::Id::unique(("style-name", paragraph, id));
     let mut name: String = ui.data(|d| d.get_temp(key)).unwrap_or_else(|| s["name"].as_str().unwrap_or("").to_string());
     ui.horizontal(|ui| {
-        ui.label(RichText::new(tl!("Name")).color(t.text_dim).size(11.5));
-        let r = ui.add_enabled(id != 0, egui::TextEdit::singleline(&mut name).desired_width(170.0));
+        let name_label = ui.label(RichText::new(tl!("Name")).color(t.text_dim).size(11.5));
+        let r = ui.add_enabled(id != 0, egui::TextEdit::singleline(&mut name).desired_width(170.0)).labelled_by(name_label.id);
         if r.lost_focus() && name.trim() != s["name"].as_str().unwrap_or("") && !name.trim().is_empty() {
             let _ = run(app, &format!("{prefix}.rename"), json!({ "id": id, "name": name.trim() }));
             ui.data_mut(|d| d.remove::<String>(key));
@@ -395,8 +395,9 @@ fn options_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, paragraph: bool, s
         for &(label, key, panel, kind) in rows {
             let mut on = defined(&char_attrs, key);
             let was = on;
-            ui.checkbox(&mut on, "");
-            ui.label(RichText::new(tl!(&label)).color(if on { t.text } else { t.text_faint }).size(11.5));
+            let on_box = ui.checkbox(&mut on, "");
+            let row_label = ui.label(RichText::new(tl!(&label)).color(if on { t.text } else { t.text_faint }).size(11.5));
+            on_box.labelled_by(row_label.id);
             let v = if on { char_attrs[key].clone() } else { resolved_c[key].clone() };
             ui.add_enabled_ui(on, |ui| match kind {
                 "font" => {
@@ -412,7 +413,7 @@ fn options_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, paragraph: bool, s
                     let unit = if kind == "num" { "" } else { " pt" };
                     if auto {
                         ui.label(RichText::new(tl!("Auto")).color(t.text_dim).size(11.5));
-                    } else if crate::widgets::value_field(ui, &mut x, range, unit, 70.0).changed() {
+                    } else if crate::widgets::value_field(ui, &mut x, range, unit, 70.0).accessible_name(tl!(&label)).changed() {
                         set = Some(json!({ key: x }));
                     }
                 }
@@ -423,7 +424,7 @@ fn options_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, paragraph: bool, s
                 }
                 _ => {
                     let mut b = v.as_bool().unwrap_or(false);
-                    if ui.checkbox(&mut b, "").changed() {
+                    if ui.checkbox(&mut b, "").accessible_name(tl!(&label)).changed() {
                         set = Some(json!({ key: b }));
                     }
                 }
@@ -450,8 +451,9 @@ fn options_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, paragraph: bool, s
             for &(label, key, kind) in rows {
                 let mut on = defined(&para_attrs, key);
                 let was = on;
-                ui.checkbox(&mut on, "");
-                ui.label(RichText::new(tl!(&label)).color(if on { t.text } else { t.text_faint }).size(11.5));
+                let on_box = ui.checkbox(&mut on, "");
+                let row_label = ui.label(RichText::new(tl!(&label)).color(if on { t.text } else { t.text_faint }).size(11.5));
+                on_box.labelled_by(row_label.id);
                 let v = if on { para_attrs[key].clone() } else { resolved_p[key].clone() };
                 ui.add_enabled_ui(on, |ui| match kind {
                     "align" => {
@@ -469,19 +471,22 @@ fn options_editor(app: &mut PhotocraftApp, ui: &mut egui::Ui, paragraph: bool, s
                         .into_iter()
                         .map(|(v, l)| (v.to_string(), l))
                         .collect();
-                        if crate::widgets::dropdown(ui, &format!("style-align-{id}"), &mut a, &opts, 110.0) {
+                        if crate::widgets::dropdown(ui, &format!("style-align-{id}"), tl!("Alignment"), &mut a, &opts, 110.0) {
                             set = Some(json!({ "align": a }));
                         }
                     }
                     "pt" => {
                         let mut x = v.as_f64().unwrap_or(0.0) as f32 * type_unit;
-                        if crate::widgets::value_field(ui, &mut x, -1296.0 * type_unit..=1296.0 * type_unit, &format!(" {unit_label}"), 70.0).changed() {
+                        if crate::widgets::value_field(ui, &mut x, -1296.0 * type_unit..=1296.0 * type_unit, &format!(" {unit_label}"), 70.0)
+                            .accessible_name(tl!(&label))
+                            .changed()
+                        {
                             set = Some(json!({ key: x / type_unit }));
                         }
                     }
                     _ => {
                         let mut b = v.as_bool().unwrap_or(false);
-                        if ui.checkbox(&mut b, "").changed() {
+                        if ui.checkbox(&mut b, "").accessible_name(tl!(&label)).changed() {
                             set = Some(json!({ key: b }));
                         }
                     }
@@ -560,7 +565,7 @@ fn char_style_for(family: &str, style: &str) -> photocraft_doc::text::CharStyle
 }
 
 fn glyph_texture(ctx: &egui::Context, family: &str, style: &str, c: char, px: u32) -> TextureHandle {
-    let id = egui::Id::new(("glyph-tex", family, style, c, px));
+    let id = egui::Id::unique(("glyph-tex", family, style, c, px));
     if let Some(t) = ctx.data(|d| d.get_temp::<TextureHandle>(id)) {
         return t;
     }
@@ -577,7 +582,7 @@ fn glyph_texture(ctx: &egui::Context, family: &str, style: &str, c: char, px: u3
 
 /// Characters of a face, cached per (family, style).
 fn charmap(ctx: &egui::Context, family: &str, style: &str) -> std::sync::Arc<Vec<char>> {
-    let id = egui::Id::new(("glyph-cmap", family, style));
+    let id = egui::Id::unique(("glyph-cmap", family, style));
     if let Some(v) = ctx.data(|d| d.get_temp::<std::sync::Arc<Vec<char>>>(id)) {
         return v;
     }
@@ -627,7 +632,7 @@ pub fn glyphs_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         let styles = crate::type_tool::styles(&family);
         let mut s = style.clone();
         let opts: Vec<(String, &str)> = styles.iter().map(|x| (x.clone(), x.as_str())).collect();
-        if crate::widgets::dropdown(ui, "glyph-style", &mut s, &opts, 110.0) {
+        if crate::widgets::dropdown(ui, "glyph-style", tl!("Style"), &mut s, &opts, 110.0) {
             app.ui.type_panels.glyph_family = family.clone();
             app.ui.type_panels.glyph_style = s;
         }
@@ -637,7 +642,7 @@ pub fn glyphs_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     ui.horizontal(|ui| {
         ui.label(RichText::new(tl!("Show:")).color(t.text_dim).size(11.5));
         let opts: Vec<(String, &str)> = photocraft_text::glyphs::CATEGORIES.iter().map(|c| (c.to_string(), *c)).collect();
-        if crate::widgets::dropdown(ui, "glyph-category", &mut cat, &opts, 160.0) {
+        if crate::widgets::dropdown(ui, "glyph-category", tl!("Category"), &mut cat, &opts, 160.0) {
             app.ui.type_panels.glyph_category = cat.clone();
         }
     });
@@ -657,7 +662,7 @@ pub fn glyphs_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         if cell.right() > rr.right() {
             break;
         }
-        let resp = ui.interact(cell, ui.id().with(("glyph-recent", i)), Sense::click());
+        let resp = ui.interact(cell, ui.scope_id().with(("glyph-recent", i)), Sense::click());
         if resp.hovered() {
             ui.painter().rect_filled(cell, 2.0, t.hover);
         }
@@ -684,7 +689,7 @@ pub fn glyphs_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             for col in 0..cols {
                 let Some(&c) = chars.get(row * cols + col) else { break };
                 let cell = Rect::from_min_size(pos2(rect.left() + col as f32 * size, rect.top()), vec2(size, size));
-                let resp = ui.interact(cell, ui.id().with(("glyph", c)), Sense::click());
+                let resp = ui.interact(cell, ui.scope_id().with(("glyph", c)), Sense::click());
                 let is_sel = selected.as_deref().and_then(|s| s.chars().next()) == Some(c);
                 ui.painter().rect_stroke(cell, 0.0, Stroke::new(1.0, t.separator), egui::StrokeKind::Inside);
                 if is_sel {
@@ -715,7 +720,7 @@ pub fn glyphs_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         ui.label(RichText::new(info).color(t.text_faint).size(10.5));
         ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
             let mut s = size;
-            ui.add_sized([90.0, 16.0], egui::Slider::new(&mut s, 24.0..=64.0).show_value(false));
+            ui.add_sized([90.0, 16.0], egui::Slider::new(&mut s, 24.0..=64.0).show_value(false)).accessible_name(tl!("Size"));
             if (s - size).abs() > 0.1 {
                 app.ui.type_panels.glyph_size = s;
             }
@@ -763,7 +768,7 @@ fn spelling_window(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let mut change_to = d.change_to.clone();
     let mut all_layers = d.all_layers;
     egui::Window::new(tl!("Check Spelling"))
-        .id(egui::Id::new("check-spelling"))
+        .id(egui::Id::unique("check-spelling"))
         .collapsible(false)
         .resizable(false)
         .frame(float_frame(&t).inner_margin(egui::Margin::same(14)))
@@ -795,10 +800,10 @@ fn spelling_window(app: &mut PhotocraftApp, ctx: &egui::Context) {
                     } else {
                         String::new()
                     };
-                    ui.add_enabled(false, egui::TextEdit::singleline(&mut shown.clone()).desired_width(240.0));
+                    ui.add_enabled(false, egui::TextEdit::singleline(&mut shown.clone()).desired_width(240.0)).accessible_name(tl!("Not in Dictionary:"));
                     ui.add_space(4.0);
-                    ui.label(RichText::new(tl!("Change To:")).color(t.text_dim).size(11.5));
-                    ui.add_enabled(item.is_some(), egui::TextEdit::singleline(&mut change_to).desired_width(240.0));
+                    let change_label = ui.label(RichText::new(tl!("Change To:")).color(t.text_dim).size(11.5));
+                    ui.add_enabled(item.is_some(), egui::TextEdit::singleline(&mut change_to).desired_width(240.0)).labelled_by(change_label.id);
                     ui.add_space(4.0);
                     ui.label(RichText::new(tl!("Suggestions:")).color(t.text_dim).size(11.5));
                     egui::Frame::NONE.fill(t.field).corner_radius(CornerRadius::same(3)).inner_margin(egui::Margin::same(4)).show(ui, |ui| {
diff --git a/crates/ui-egui/src/type_panels_ui/color_picker.rs b/crates/ui-egui/src/type_panels_ui/color_picker.rs
index 7df76c0cd5..a530cdbf77 100644
--- a/crates/ui-egui/src/type_panels_ui/color_picker.rs
+++ b/crates/ui-egui/src/type_panels_ui/color_picker.rs
@@ -137,7 +137,7 @@ pub(crate) fn display_doc(app: &mut PhotocraftApp, idx: usize) -> Option<(Arc<Do
         app.text_style_preview = None;
         return None;
     }
-    let key = (egui::Id::new((t.document.0, t.revision, d.id, t.kind.paragraph(), t.id, &color)).value() & ((1 << 60) - 1)) | (1 << 60);
+    let key = (egui::Id::unique((t.document.0, t.revision, d.id, t.kind.paragraph(), t.id, &color)).value() & ((1 << 60) - 1)) | (1 << 60);
     if app.text_style_preview.as_ref().map(|p| p.key) != Some(key) {
         let shown = photocraft_engine::type_styles_cmds::preview_options(&st.doc, &json!({"id": t.id, "attrs": {"color": color}}), t.kind.paragraph())
             .map(Arc::new)
diff --git a/crates/ui-egui/src/type_tool.rs b/crates/ui-egui/src/type_tool.rs
index 2566454754..2f15e94723 100644
--- a/crates/ui-egui/src/type_tool.rs
+++ b/crates/ui-egui/src/type_tool.rs
@@ -5,8 +5,10 @@
 //! Offsets in [`TextEdit`] are character indices (the engine's unit); the layout works in bytes.
 
 use std::collections::HashMap;
+use std::ops::Range;
 use std::sync::{Arc, PoisonError};
 
+use egui::ime_context::{CommittedText, ImeContextTracker, ImeMutationStamp, ImeObservation, ImeTarget};
 use egui::{Color32, Pos2, Stroke};
 use photocraft_doc::{Document, LayerContent, LayerId, TextLayer};
 use photocraft_geom::{Affine, Point};
@@ -19,6 +21,705 @@ use crate::state::{BoxResize, TextEdit};
 
 pub const PLACEHOLDER: &str = "Lorem Ipsum";
 
+/// Per-editor IME owner/generation bookkeeping for the custom Type tool.
+///
+/// The tracker is shared by every viewport and keeps the context generation alive when this
+/// editor is replaced. The overlay records the pass's canvas mapping and the pass end recomputes
+/// the final geometry from the observed model, so an event-free or discarded pass never replays
+/// stale text.
+#[derive(Debug, Default)]
+pub(crate) struct ImeState {
+    tracker: ImeContextTracker,
+    frame: Option<ImeFrame>,
+    /// The canvas mapping of the current pass, so the final descriptor geometry is recomputed
+    /// from the observed model rather than from an earlier point in the pass.
+    view: Option<ImeView>,
+    /// The last descriptor identity the platform actually received (a discarded pass did not
+    /// receive it, so its transition must still be reported by the final pass).
+    emitted: Option<ImeEmitted>,
+    /// Ask the platform to cancel the native composition (owner/session transition or a stale
+    /// pre-edit). Stays set until a non-discarded descriptor carries it.
+    interrupt: bool,
+    /// Incoming composition provenance survives idle/discarded passes and an empty preedit.
+    /// A stale owner stays fenced until the exact host reset completion arrives.
+    incoming: Option<IncomingComposition>,
+    /// The composition text was invalidated; this pass must report `Unavailable` rather than
+    /// presenting the orphaned composition as committed text.
+    stale: bool,
+    /// The exact composition written into the layer, used to check the stored range before any
+    /// replacement, deletion, underline or surrounding-text report.
+    preedit: Option<ImePreedit>,
+    /// A local fence is released only by its exact host completion, never by terminal text.
+    resets: HashMap<egui::ViewportId, ResetPhase>,
+    context: Option<egui::Context>,
+    needs_request: bool,
+    /// One exclusive event owner per actual UI pass; logic-only ticks never replay input.
+    raw_pass: HashMap<egui::ViewportId, u64>,
+    custom_pass: HashMap<egui::ViewportId, (u64, Option<ResetContext>)>,
+    last_custom: HashMap<egui::ViewportId, ResetContext>,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct ResetContext(egui::Id, u64, egui::IMEPurpose);
+
+impl From<&egui::output::IMEOutput> for ResetContext {
+    fn from(ime: &egui::output::IMEOutput) -> Self {
+        Self(ime.owner, ime.context_generation, ime.purpose)
+    }
+}
+
+#[derive(Clone, Copy, Debug)]
+enum ResetPhase {
+    NeedsRequest,
+    Awaiting { id: egui::ImeResetId, destination: IncomingSelection, context: Option<ResetContext> },
+    Suspended,
+    AllocationFailed { destination: IncomingSelection, context: Option<ResetContext> },
+}
+
+#[derive(Clone, Copy, Debug)]
+struct ImeFrame {
+    viewport: egui::ViewportId,
+    frame_nr: u64,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct ImeEmitted {
+    target: ImeTarget,
+    generation: u64,
+}
+
+#[derive(Clone, Copy, Debug)]
+struct ImeView {
+    viewport: egui::ViewportId,
+    pass_nr: u64,
+    xf: ViewXform,
+}
+
+/// The composition text and the edit session that wrote it. A range that still lies inside the
+/// text is not enough: an application edit can shift it onto committed characters.
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct ImePreedit {
+    layer: u64,
+    session: String,
+    text: String,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct IncomingSelection {
+    target: ImeTarget,
+    caret: usize,
+    anchor: usize,
+    revision: u64,
+}
+
+#[derive(Clone, Copy, Debug)]
+enum IncomingComposition {
+    Active(IncomingSelection),
+    TerminalPending(IncomingSelection),
+    Stale,
+}
+
+/// A bounded committed snapshot captured from the type layer.
+///
+/// The snapshot owns at most `MAX_IME_SURROUNDING_TEXT_BYTES`; the layer's whole text is only
+/// borrowed while it is built. The current pre-edit lives in the layer so it lays out like
+/// typed text, and is removed from this value rather than reported as committed text.
+struct ImeCommitted {
+    snapshot: egui::output::IMESurroundingText,
+}
+
+impl ImeCommitted {
+    fn stamp(&self) -> ImeMutationStamp {
+        ImeMutationStamp::from_surrounding_text(self.snapshot.clone())
+    }
+}
+
+impl ImeState {
+    /// Remember the frame used by this pass's accepted IME receipts.
+    fn begin_frame(&mut self, ctx: &egui::Context) {
+        let viewport = ctx.viewport_id();
+        self.frame = Some(ImeFrame { viewport, frame_nr: ctx.cumulative_frame_nr_for(viewport) });
+    }
+
+    /// Record the canvas mapping of this pass. `sync_ime` recomputes both rectangles from the
+    /// model after every panel has run.
+    fn note_view(&mut self, viewport: egui::ViewportId, pass_nr: u64, xf: &ViewXform) {
+        self.view = Some(ImeView { viewport, pass_nr, xf: *xf });
+    }
+
+    /// Request the native composition reset; incoming ownership is tracked separately.
+    fn request_interrupt(&mut self) {
+        self.interrupt = true;
+        if self.incoming.is_some() || !self.resets.is_empty() {
+            self.needs_request = true;
+            // Context-less commands must retire every old id synchronously.
+            for phase in self.resets.values_mut() {
+                *phase = ResetPhase::NeedsRequest;
+            }
+        }
+    }
+
+    /// Forget a composition whose range no longer describes the recorded text.
+    fn invalidate_preedit(&mut self) {
+        self.preedit = None;
+        self.stale = true;
+        self.incoming = Some(IncomingComposition::Stale);
+        self.request_interrupt();
+    }
+
+    fn note_preedit(&mut self, ed: &TextEdit, text: &str) {
+        self.preedit = Some(ImePreedit { layer: ed.layer, session: ed.session.clone(), text: text.to_owned() });
+    }
+
+    fn clear_preedit(&mut self) {
+        self.preedit = None;
+    }
+}
+
+/// The immutable owner of the Type tool's IME context.
+///
+/// The document, layer and viewport identify the target; the edit session is the replacement
+/// epoch, so committing and editing the same layer again cannot reuse the old generation.
+fn ime_target(app: &PhotocraftApp, ed: &TextEdit, viewport: egui::ViewportId) -> Option<ImeTarget> {
+    let document = ed.document.or_else(|| active_doc_id(app))?;
+    // A Type Mask session is a distinct owner: its hidden working layer can have the same id as
+    // a regular type layer in another tool session. The session epoch replaces the context when
+    // an owner is recreated.
+    let owner = egui::Id::unique(("photocraft-type-ime", document, ed.layer, ed.mask, viewport.0.value()));
+    let epoch = egui::Id::unique(("photocraft-type-ime-session", &ed.session)).value().max(1);
+    Some(ImeTarget::new(owner, epoch))
+}
+
+fn incoming_selection(app: &PhotocraftApp, viewport: egui::ViewportId) -> Option<IncomingSelection> {
+    let ed = app.ui.text_edit.as_ref()?;
+    Some(IncomingSelection { target: ime_target(app, ed, viewport)?, caret: ed.caret, anchor: ed.anchor, revision: app.session.active()?.revision })
+}
+
+/// Settle the already-visible preview where it was typed, never replay it at a moved caret.
+fn interrupt_incoming(app: &mut PhotocraftApp) {
+    if !matches!(app.type_ime.incoming, Some(IncomingComposition::Active(_) | IncomingComposition::TerminalPending(_))) {
+        return;
+    }
+    app.type_ime.incoming = Some(IncomingComposition::Stale);
+    if let Some(ed) = &mut app.ui.text_edit {
+        ed.preedit = None;
+    }
+    app.type_ime.clear_preedit();
+    app.type_ime.request_interrupt();
+}
+
+fn interrupt_action(app: &mut PhotocraftApp, viewport: egui::ViewportId) {
+    let guarded = reset_guarded(app, viewport);
+    interrupt_incoming(app);
+    if guarded {
+        app.type_ime.request_interrupt();
+    }
+}
+
+fn sync_incoming(app: &mut PhotocraftApp, viewport: egui::ViewportId) {
+    let destination = incoming_selection(app, viewport);
+    if app.type_ime.resets.get(&viewport).is_some_and(|phase| match phase {
+        ResetPhase::Awaiting { destination: old, .. } | ResetPhase::AllocationFailed { destination: old, .. } => Some(*old) != destination,
+        _ => false,
+    }) {
+        app.type_ime.request_interrupt();
+    }
+    let expected = match app.type_ime.incoming {
+        Some(IncomingComposition::Active(expected) | IncomingComposition::TerminalPending(expected)) => expected,
+        _ => return,
+    };
+    let lost_preview = matches!(app.type_ime.incoming, Some(IncomingComposition::Active(_))) && app.ui.text_edit.as_ref().is_none_or(|ed| ed.preedit.is_none());
+    if incoming_selection(app, viewport) != Some(expected) || lost_preview {
+        // An external edit can move an in-bounds preview range onto committed characters.
+        // Validate it before interruption clears the metadata needed to detect that mismatch.
+        // A valid preview still settles normally; never inspect another document's layer here.
+        if let Some(ed) = app.ui.text_edit.clone()
+            && ed.preedit.is_some()
+            && ime_target(app, &ed, viewport) == Some(expected.target)
+            && let Some(active) = app.session.active_index()
+            && edit_home(app, &ed) == Some(active)
+            && let Some(text) = current_text(app, LayerId(ed.layer))
+            && reconcile_preedit(app, &ed, &text)
+        {
+            return;
+        }
+        interrupt_incoming(app);
+    }
+}
+
+/// Accepted IME mutations update provenance without canceling their own Delete→Commit chain.
+fn remember_incoming(app: &mut PhotocraftApp, preedit_empty: Option<bool>) {
+    let viewport = app.type_ime.frame.map_or(egui::ViewportId::ROOT, |frame| frame.viewport);
+    let Some(expected) = incoming_selection(app, viewport) else { return };
+    let next = match (preedit_empty, app.type_ime.incoming) {
+        (Some(false), _) | (None, Some(IncomingComposition::Active(_))) => IncomingComposition::Active(expected),
+        (Some(true), _) | (None, Some(IncomingComposition::TerminalPending(_))) => IncomingComposition::TerminalPending(expected),
+        _ => return,
+    };
+    app.type_ime.incoming = Some(next);
+}
+
+/// A host may recreate its Context while retaining the application. Old pass counters and
+/// output keys are not evidence of publication in that new Context.
+fn bind_reset_context(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    // `on_begin_pass` callbacks registered during this pass cannot mark the pass already
+    // running. Reinstall here so a replacement Context is ready for its next pass, and rely on
+    // the host's creator/`setup_context` having installed before the very first `run_ui`.
+    install_reset_hooks(ctx);
+    if app.type_ime.context.as_ref().is_some_and(|previous| previous != ctx) {
+        interrupt_incoming(app);
+        for phase in app.type_ime.resets.values_mut() {
+            *phase = ResetPhase::Suspended;
+        }
+        app.type_ime.needs_request = false;
+        app.type_ime.raw_pass.clear();
+        app.type_ime.custom_pass.clear();
+        app.type_ime.last_custom.clear();
+        app.type_ime.view = None;
+        app.type_ime.frame = None;
+        app.type_ime.tracker.observe(ctx.viewport_id(), None);
+    }
+    app.type_ime.context = Some(ctx.clone());
+}
+
+fn ui_mode_id(viewport: egui::ViewportId) -> egui::Id {
+    egui::Id::unique(("photocraft-type-reset-ui", viewport))
+}
+
+/// Install before the first UI pass on every Context, including a replacement. These callbacks
+/// retain neither the app nor its Context. Calling this from inside a running pass only affects
+/// subsequent passes: egui's begin-pass callback list is already being iterated.
+pub(crate) fn install_reset_hooks(ctx: &egui::Context) {
+    let installed = egui::Id::unique("photocraft-type-reset-hooks");
+    if ctx.data(|data| data.get_temp::<bool>(installed)).unwrap_or(false) {
+        return;
+    }
+    ctx.data_mut(|data| data.insert_temp(installed, true));
+    ctx.on_begin_pass(
+        "photocraft type reset UI mode",
+        Arc::new(|ui| {
+            let key = ui_mode_id(ui.ctx().viewport_id());
+            ui.ctx().data_mut(|data| data.insert_temp(key, true));
+        }),
+    );
+    ctx.on_end_pass(
+        "photocraft type reset UI mode end",
+        Arc::new(|ui| {
+            let key = ui_mode_id(ui.ctx().viewport_id());
+            ui.ctx().data_mut(|data| data.insert_temp(key, false));
+        }),
+    );
+}
+
+pub(crate) fn in_ui_pass(ctx: &egui::Context) -> bool {
+    let key = ui_mode_id(ctx.viewport_id());
+    ctx.data(|data| data.get_temp::<bool>(key)).unwrap_or(false)
+}
+
+fn reset_guarded(app: &PhotocraftApp, viewport: egui::ViewportId) -> bool {
+    app.type_ime.needs_request || app.type_ime.resets.contains_key(&viewport) || matches!(app.type_ime.incoming, Some(IncomingComposition::Stale))
+}
+
+fn reset_route_eligible(app: &PhotocraftApp, ctx: &egui::Context) -> bool {
+    // The actual app draws only after `logic_frame` marks fonts ready; `ui_frame` early-returns
+    // on the first frame. Direct handler tests that have not run the first logic frame use the
+    // pre-styled app state and are not an actual UI route.
+    (app.fonts_ready || !app.styled)
+        && app.ui.text_edit.is_some()
+        && app.ui.dialogs.is_empty()
+        && !crate::screen_picker::busy(ctx)
+        && ctx.input(|i| i.focused)
+        && !ctx.text_edit_focused()
+        && !ctx.egui_wants_keyboard_input()
+}
+
+/// Whether this input can be attributed to a visible custom descriptor right now. Completion
+/// arrives before the final descriptor exists, so use the last canvas mapping and the current
+/// model: requiring this pass's final output here would deadlock the ordered suffix.
+fn reset_geometry_available(app: &mut PhotocraftApp, viewport: egui::ViewportId) -> bool {
+    let Some(ed) = app.ui.text_edit.clone() else { return false };
+    let Some(view) = app.type_ime.view.filter(|view| view.viewport == viewport) else { return false };
+    ime_geometry(app, &ed, view.xf).is_some()
+}
+
+fn suspend_reset(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    let viewport = ctx.viewport_id();
+    if reset_guarded(app, viewport) {
+        app.type_ime.resets.insert(viewport, ResetPhase::Suspended);
+        app.type_ime.needs_request = false;
+    }
+    app.type_ime.last_custom.remove(&viewport);
+}
+
+fn allocate_reset(app: &mut PhotocraftApp, ctx: &egui::Context, destination: IncomingSelection, context: Option<ResetContext>) {
+    let viewport = ctx.viewport_id();
+    let phase = match ctx.request_ime_reset(viewport) {
+        Some(id) => ResetPhase::Awaiting { id, destination, context },
+        None => ResetPhase::AllocationFailed { destination, context },
+    };
+    app.type_ime.resets.insert(viewport, phase);
+    app.type_ime.needs_request = false;
+}
+
+/// Reconcile before the next raw element, not merely at descriptor publication.
+fn prepare_reset(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    let viewport = ctx.viewport_id();
+    sync_incoming(app, viewport);
+    if app.type_ime.needs_request {
+        app.type_ime.resets.insert(viewport, ResetPhase::NeedsRequest);
+        app.type_ime.needs_request = false;
+    }
+    // Allocation belongs to the true UI tail: a stock field drawn later in this pass
+    // must never inherit a speculative custom-editor reset request.
+}
+
+fn complete_reset(app: &mut PhotocraftApp, ctx: &egui::Context, request_id: egui::ImeResetId) {
+    let viewport = ctx.viewport_id();
+    let Some(ResetPhase::Awaiting { id, destination, context }) = app.type_ime.resets.get(&viewport).copied() else { return };
+    if request_id != id
+        || request_id.viewport_id() != viewport
+        || !reset_route_eligible(app, ctx)
+        || incoming_selection(app, viewport) != Some(destination)
+        || context != app.type_ime.last_custom.get(&viewport).copied()
+    {
+        return;
+    }
+    if !reset_geometry_available(app, viewport) {
+        // Retire the old id and keep the following preedit blocked before it can reach the
+        // editor. The UI tail may still rearm once this pass produces real custom output.
+        suspend_reset(app, ctx);
+        return;
+    }
+    app.type_ime.resets.remove(&viewport);
+    app.type_ime.incoming = None;
+    app.type_ime.preedit = None;
+    app.type_ime.stale = false;
+    app.type_ime.interrupt = false;
+    if let Some(ed) = app.ui.text_edit.as_mut() {
+        ed.preedit = None;
+    }
+}
+
+fn claim_raw_pass(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
+    let viewport = ctx.viewport_id();
+    let pass = ctx.cumulative_pass_nr_for(viewport);
+    app.type_ime.raw_pass.insert(viewport, pass) != Some(pass)
+}
+
+/// The exclusive route when no custom editor may mutate. Do not consume stock text/keys.
+pub(crate) fn controls_only(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    bind_reset_context(app, ctx);
+    if !claim_raw_pass(app, ctx) {
+        return;
+    }
+    if !reset_route_eligible(app, ctx) {
+        interrupt_incoming(app);
+    }
+    suspend_reset(app, ctx); // Retire an old id before visiting even the first marker.
+    for event in ctx.input(|i| i.events.clone()) {
+        if let egui::Event::ImeResetCompleted { request_id } = event {
+            complete_reset(app, ctx, request_id);
+        }
+    }
+}
+
+/// True outer UI tail, including discarded/early-return passes and host-side mutations.
+pub(crate) fn finish_reset_pass(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    bind_reset_context(app, ctx);
+    let viewport = ctx.viewport_id();
+    if app.type_ime.raw_pass.get(&viewport).copied() != Some(ctx.cumulative_pass_nr_for(viewport)) {
+        controls_only(app, ctx);
+    }
+    sync_incoming(app, viewport);
+    let produced = app.type_ime.custom_pass.get(&viewport).copied().filter(|(pass, _)| *pass == ctx.cumulative_pass_nr_for(viewport)).and_then(|(_, key)| key);
+    let actual = ctx.output(|o| o.ime.as_ref().map(ResetContext::from));
+    let Some(context) = produced.filter(|key| Some(*key) == actual && reset_route_eligible(app, ctx)) else {
+        suspend_reset(app, ctx);
+        return;
+    };
+    // Never allocate a request for output egui will throw away. Keep any existing guard and its
+    // queued R1 blocked; the final pass either publishes this context and reuses it or retires
+    // the old id through the ineligible branch above.
+    if ctx.will_discard() {
+        return;
+    }
+    app.type_ime.last_custom.insert(viewport, context);
+    if !reset_guarded(app, viewport) {
+        return;
+    }
+    let Some(destination) = incoming_selection(app, viewport) else {
+        suspend_reset(app, ctx);
+        return;
+    };
+    let unchanged = app.type_ime.resets.get(&viewport).is_some_and(|phase| match phase {
+        ResetPhase::Awaiting { destination: old, context: old_context, .. } | ResetPhase::AllocationFailed { destination: old, context: old_context } => {
+            *old == destination && *old_context == Some(context) && !app.type_ime.needs_request
+        }
+        _ => false,
+    });
+    if !unchanged {
+        allocate_reset(app, ctx, destination, Some(context));
+    }
+}
+
+pub(crate) fn finish_reset_logic(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    bind_reset_context(app, ctx);
+    if !in_ui_pass(ctx) {
+        sync_incoming(app, ctx.viewport_id());
+        suspend_reset(app, ctx);
+    }
+}
+
+/// UTF-8 byte offsets of the caret, anchor and pre-edit, found in one traversal.
+///
+/// The pre-edit is in characters in [`TextEdit`]; surround-text offsets are UTF-8 bytes. A range
+/// that runs past the text is an explicit unavailable state, not a reason to report the
+/// composition as committed.
+struct ImeOffsets {
+    cursor: usize,
+    anchor: usize,
+    preedit: Option<Range<usize>>,
+}
+
+fn ime_offsets(text: &str, ed: &TextEdit) -> Option<ImeOffsets> {
+    let (start, end) = match ed.preedit {
+        Some((start, len)) => (start, start.checked_add(len)?),
+        None => (0, 0),
+    };
+    let wanted = [ed.caret, ed.anchor, start, end];
+    let mut bytes = [usize::MAX; 4];
+    let mut chars = 0usize;
+    for (index, (byte, _)) in text.char_indices().enumerate() {
+        for (slot, want) in bytes.iter_mut().zip(wanted) {
+            if *slot == usize::MAX && want == index {
+                *slot = byte;
+            }
+        }
+        chars = index.saturating_add(1);
+    }
+    // An index at (or past) the end clamps to the end, as before; a pre-edit past the end is a
+    // stale composition and makes the surrounding text unavailable.
+    for (slot, (index, want)) in bytes.iter_mut().zip(wanted.into_iter().enumerate()) {
+        if *slot == usize::MAX {
+            // The caret and anchor clamp after undo/redo; a pre-edit beyond the text is stale.
+            if index >= 2 && want > chars {
+                return None;
+            }
+            *slot = text.len();
+        }
+    }
+    let preedit = match ed.preedit {
+        Some(_) if end > chars => return None,
+        Some(_) => Some(bytes[2]..bytes[3]),
+        None => None,
+    };
+    Some(ImeOffsets { cursor: bytes[0], anchor: bytes[1], preedit })
+}
+
+/// Whether the stored character range still contains exactly the composition that wrote it.
+fn ime_preedit_is_current(app: &PhotocraftApp, text: &str, ed: &TextEdit, offsets: &ImeOffsets) -> bool {
+    match (ed.preedit, offsets.preedit.as_ref()) {
+        (None, _) => true,
+        (Some(_), Some(range)) => {
+            app.type_ime.preedit.as_ref().is_some_and(|p| p.layer == ed.layer && p.session == ed.session && text.get(range.clone()) == Some(p.text.as_str()))
+        }
+        (Some(_), None) => false,
+    }
+}
+
+/// Check the stored pre-edit against the live text, invalidating it (and the native composition)
+/// when an application edit moved or replaced it. Returns true when it was stale.
+fn reconcile_preedit(app: &mut PhotocraftApp, ed: &TextEdit, text: &str) -> bool {
+    if ed.preedit.is_none() {
+        return false;
+    }
+    let current = ime_offsets(text, ed).is_some_and(|offset| ime_preedit_is_current(app, text, ed, &offset));
+    if current {
+        return false;
+    }
+    app.type_ime.invalidate_preedit();
+    if let Some(e) = app.ui.text_edit.as_mut() {
+        e.preedit = None;
+    }
+    true
+}
+
+/// A borrowed observation for the tracker. It copies only the bounded window.
+fn committed_text<'a>(app: &PhotocraftApp, text: &'a str, ed: &TextEdit) -> Option<CommittedText<'a>> {
+    let offsets = ime_offsets(text, ed)?;
+    if !ime_preedit_is_current(app, text, ed, &offsets) {
+        return None;
+    }
+    let committed = CommittedText::new(text, offsets.cursor, offsets.anchor);
+    Some(match offsets.preedit {
+        Some(preedit) => committed.with_preedit(preedit),
+        None => committed,
+    })
+}
+
+/// The bounded committed snapshot of the edited layer, or `None` when it cannot be exposed.
+fn ime_committed(app: &PhotocraftApp, ed: &TextEdit) -> Option<ImeCommitted> {
+    let text = text_layer(&app.session.active()?.doc, LayerId(ed.layer))?.text.as_str();
+    let offsets = ime_offsets(text, ed)?;
+    if !ime_preedit_is_current(app, text, ed, &offsets) {
+        return None;
+    }
+    Some(ImeCommitted { snapshot: egui::output::IMESurroundingText::from_text(text, offsets.cursor, offsets.anchor, offsets.preedit) })
+}
+
+/// Report an accepted IME commit/deletion. Call only after the engine accepted the mutation and
+/// from the snapshots immediately around it.
+fn note_ime_apply(app: &mut PhotocraftApp, ed: &TextEdit, before: &ImeCommitted, after: &ImeCommitted) -> bool {
+    let Some(frame) = app.type_ime.frame else { return false };
+    let Some(target) = ime_target(app, ed, frame.viewport) else { return false };
+    app.type_ime.tracker.note_input_method_apply(frame.viewport, frame.frame_nr, target, before.stamp(), after.stamp())
+}
+
+/// Report an application-origin edit (typing, paste, cut, deletion, undo or a toolbar action).
+fn note_ime_application_change(app: &mut PhotocraftApp, ed: &TextEdit) -> bool {
+    let Some(frame) = app.type_ime.frame else { return false };
+    let Some(target) = ime_target(app, ed, frame.viewport) else { return false };
+    app.type_ime.tracker.note_application_change(frame.viewport, frame.frame_nr, target)
+}
+
+/// Snapshot after the engine mutation and describe the current pass.
+///
+/// Run once per UI pass, after the editor has drawn its caret, so the descriptor reflects this
+/// pass's final model state. With no visible focused editor the context is ended; a moved focus
+/// therefore cannot leave the previous owner's surrounding text latched.
+pub(crate) fn sync_ime(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    bind_reset_context(app, ctx);
+    let viewport = ctx.viewport_id();
+    let frame_nr = ctx.cumulative_frame_nr_for(viewport);
+    let pass_nr = ctx.cumulative_pass_nr_for(viewport);
+    app.type_ime.custom_pass.insert(viewport, (pass_nr, None));
+    sync_incoming(app, viewport);
+    let Some(mut ed) = app.ui.text_edit.clone() else {
+        app.type_ime.view = None;
+        app.type_ime.tracker.observe(viewport, None);
+        return;
+    };
+    // An application edit (control channel, undo, a menu command) can move the stored composition
+    // range onto committed characters. Check the actual composition text before reporting it.
+    if ed.preedit.is_some()
+        && let Some(text) = current_text(app, LayerId(ed.layer))
+        && reconcile_preedit(app, &ed, &text)
+        && let Some(current) = app.ui.text_edit.clone()
+    {
+        ed = current;
+    }
+    let view = app.type_ime.view.filter(|view| view.viewport == viewport && view.pass_nr == pass_nr);
+    let visible = view.is_some() && app.session.active_index().is_some() && edit_home(app, &ed) == app.session.active_index();
+    let focused = visible && reset_route_eligible(app, ctx);
+    if !focused {
+        interrupt_incoming(app);
+        if let Some(current) = &app.ui.text_edit {
+            ed = current.clone();
+        }
+    }
+    let Some(target) = ime_target(app, &ed, viewport) else {
+        app.type_ime.tracker.observe(viewport, None);
+        return;
+    };
+    // The platform only resets the native composition from `should_interrupt_composition`; on
+    // X11, macOS, Windows and the web a changed owner/generation alone leaves it alive. Latch the
+    // last *delivered* target so a discarded pass does not lose the transition.
+    if app.type_ime.emitted.is_some_and(|last| last.target != target) {
+        app.type_ime.interrupt = true;
+    }
+    // Final geometry from this pass's model and canvas mapping: a later panel can move the caret
+    // after the overlay drew it, and `rect` is the edited layer's extent, not the caret.
+    let geometry = if focused { view.and_then(|view| ime_geometry(app, &ed, view.xf)) } else { None };
+    // Borrow the layer's logical text for this observation; only the bounded window is copied.
+    let committed = if focused && !app.type_ime.stale {
+        app.session.active().and_then(|state| text_layer(&state.doc, LayerId(ed.layer))).and_then(|layer| committed_text(app, &layer.text, &ed))
+    } else {
+        None
+    };
+    let observation = ImeObservation::new(frame_nr, pass_nr, target).focused(focused).purpose(egui::IMEPurpose::Normal).committed(committed);
+    let update = app.type_ime.tracker.observe(viewport, Some(observation));
+    // A generation change (focus/refocus, a pass gap, purpose or replacement) also needs the
+    // native reset; the tracker reports it only after observing.
+    let mut interrupt = app.type_ime.interrupt;
+    if let Some(update) = &update
+        && app.type_ime.emitted.is_some_and(|last| last.target != target || last.generation != update.context_generation)
+    {
+        app.type_ime.interrupt = true;
+        interrupt = true;
+    }
+    let mut sent = false;
+    let mut sent_generation = None;
+    if let (Some(update), Some((rect, cursor_rect))) = (update, geometry) {
+        let generation = update.context_generation;
+        // Owner and generation accompany even an Unavailable payload. The cause comes from the
+        // tracker's accepted-receipt chain, never from the event that happened to be last.
+        ctx.output_mut(|out| {
+            out.ime = Some(egui::output::IMEOutput {
+                owner: update.owner,
+                context_generation: update.context_generation,
+                purpose: update.purpose,
+                rect,
+                cursor_rect,
+                should_interrupt_composition: interrupt,
+                change_cause: update.change_cause,
+                surrounding_text: update.surrounding_text,
+                reset_request: None,
+            });
+        });
+        let key = ctx.output(|out| out.ime.as_ref().map(ResetContext::from));
+        app.type_ime.custom_pass.insert(viewport, (pass_nr, key));
+        sent = true;
+        sent_generation = Some(generation);
+    }
+    if sent && !ctx.will_discard() {
+        if let Some(generation) = sent_generation {
+            app.type_ime.emitted = Some(ImeEmitted { target, generation });
+        }
+        app.type_ime.interrupt = false;
+        app.type_ime.stale = false;
+    }
+}
+
+/// The final caret and layer rectangles for an IME descriptor, in screen points.
+fn ime_geometry(app: &mut PhotocraftApp, ed: &TextEdit, xf: ViewXform) -> Option<(egui::Rect, egui::Rect)> {
+    let id = LayerId(ed.layer);
+    let (l, aff, text) = layout(app, id)?;
+    let shape = app.session.active().and_then(|s| text_layer(&s.doc, id).map(|t| t.shape.clone()));
+    let bend = shape.as_ref().and_then(photocraft_text::warp::Warp::on_path);
+    let scr_t = |x: f32, y: f32| -> Pos2 {
+        let p = aff.apply(Point::new(f64::from(x), f64::from(y)));
+        xf.to_screen(p.x as f32, p.y as f32)
+    };
+    let scr = |x: f32, y: f32| -> Pos2 {
+        let (x, y) = l.to_text(x, y);
+        match &bend {
+            Some(w) => {
+                let (x, y) = w.apply(f64::from(x), f64::from(y));
+                scr_t(x as f32, y as f32)
+            }
+            None => scr_t(x, y),
+        }
+    };
+    let (x, top, bot) = l.caret(byte_of(&text, ed.caret));
+    let (x, top, bot) = if l.lines.is_empty() { (0.0, -(12.0 * l.px_per_pt.max(1.0)), 3.0) } else { (x, top, bot) };
+    let cursor = egui::Rect::from_two_pos(scr(x, top), scr(x, bot)).expand(1.0);
+    let doc_bounds =
+        app.session.active().and_then(|s| text_layer(&s.doc, id)).and_then(|t| t.cache.as_ref()).map(|c| c.content_bounds()).filter(|r| !r.is_empty());
+    let rect = doc_bounds.map(|r| xf.doc_rect(r)).or_else(|| {
+        l.bounds().map(|b| {
+            let corners = [scr_t(b[0], b[1]), scr_t(b[2], b[1]), scr_t(b[2], b[3]), scr_t(b[0], b[3])];
+            let mut min = corners[0];
+            let mut max = corners[0];
+            for p in corners {
+                min = min.min(p);
+                max = max.max(p);
+            }
+            egui::Rect::from_min_max(min, max)
+        })
+    });
+    Some((rect.unwrap_or(cursor).expand(1.0), cursor))
+}
+
 fn text_layer(doc: &Document, id: LayerId) -> Option<&TextLayer> {
     match &doc.layer(id)?.content {
         LayerContent::Text(t) => Some(t),
@@ -133,9 +834,20 @@ pub fn edit_active(app: &mut PhotocraftApp) -> Result<(), String> {
             resize: None,
             preedit: None,
         });
-    } else if let Some(ed) = app.ui.text_edit.as_mut() {
-        ed.anchor = 0;
-        ed.caret = n;
+    } else {
+        let mut cancelled = false;
+        if let Some(ed) = app.ui.text_edit.as_mut() {
+            ed.anchor = 0;
+            ed.caret = n;
+            // Re-entering the same session moves the caret away from the composition: cancel it
+            // rather than reusing a range that no longer describes the text.
+            cancelled = ed.preedit.take().is_some();
+        }
+        if cancelled {
+            app.type_ime.clear_preedit();
+            interrupt_incoming(app);
+            app.type_ime.request_interrupt();
+        }
     }
     let vertical = app.session.active().and_then(|st| text_layer(&st.doc, id)).is_some_and(|t| t.orientation == photocraft_doc::text::Orientation::Vertical);
     app.ui.text_edit_return_tool = None;
@@ -566,6 +1278,11 @@ fn current_text(app: &PhotocraftApp, id: LayerId) -> Option<String> {
     Some(text_layer(&app.session.active()?.doc, id)?.text.clone())
 }
 
+/// Character count without cloning the layer's text.
+fn text_char_count(app: &PhotocraftApp, id: LayerId) -> Option<usize> {
+    Some(text_layer(&app.session.active()?.doc, id)?.text.chars().count())
+}
+
 /// The selected characters, clamped after undo/redo may have shortened the text.
 pub(crate) fn selected_range(app: &PhotocraftApp) -> Option<[usize; 2]> {
     let ed = app.ui.text_edit.as_ref()?;
@@ -617,11 +1334,23 @@ fn insert(app: &mut PhotocraftApp, s: &str) {
         return;
     }
     crate::type_transform::finish(app);
-    if app.run("type.edit", json!({"layer": ed.layer, "replace": {"start": a, "end": b, "text": s}, "coalesce": ed.session})).is_ok()
-        && let Some(e) = app.ui.text_edit.as_mut()
-    {
-        e.caret = a + s.chars().count();
-        e.anchor = e.caret;
+    let applied = app.run("type.edit", json!({"layer": ed.layer, "replace": {"start": a, "end": b, "text": s}, "coalesce": ed.session})).is_ok();
+    if applied {
+        let mut cancelled = false;
+        if let Some(e) = app.ui.text_edit.as_mut() {
+            e.caret = a + s.chars().count();
+            e.anchor = e.caret;
+            // An application edit invalidates a live composition: its recorded range no longer
+            // describes the text, and its pending native commit must not be applied here.
+            cancelled = e.preedit.take().is_some();
+        }
+        if cancelled {
+            app.type_ime.clear_preedit();
+            interrupt_incoming(app);
+            app.type_ime.request_interrupt();
+        }
+        // Ordinary typing, paste, cut and deletion are application-origin, never IME receipts.
+        note_ime_application_change(app, &ed);
     }
 }
 
@@ -818,8 +1547,20 @@ pub(crate) fn toggle_hyphenate(app: &mut PhotocraftApp) {
 /// typed text) and replaced by every update; `commit` makes the result final.
 fn ime_update(app: &mut PhotocraftApp, s: &str, commit: bool) {
     let Some(ed) = app.ui.text_edit.clone() else { return };
-    let Some(text) = current_text(app, LayerId(ed.layer)) else { return };
-    let n = text.chars().count();
+    // Validate the composition only while one exists: a plain preedit/commit otherwise needs no
+    // copy of the whole layer.
+    let n = if ed.preedit.is_some() {
+        let Some(text) = current_text(app, LayerId(ed.layer)) else { return };
+        // A composition range that no longer holds the recorded composition belongs to an edit
+        // that was replaced under it: never use it to delete or replace text.
+        if reconcile_preedit(app, &ed, &text) {
+            return;
+        }
+        text.chars().count()
+    } else {
+        let Some(n) = text_char_count(app, LayerId(ed.layer)) else { return };
+        n
+    };
     let s = s.replace("\r\n", "\n").replace('\r', "\n");
     // An empty preedit or commit while nothing is being composed changes nothing. Wayland input
     // methods send one on every state change (the caret rectangle moving as a selection grows),
@@ -835,17 +1576,124 @@ fn ime_update(app: &mut PhotocraftApp, s: &str, commit: bool) {
         if let Some(e) = app.ui.text_edit.as_mut() {
             e.preedit = None;
         }
+        app.type_ime.clear_preedit();
         return;
     }
+    // Capture the committed text *before* the engine runs. The pre-edit is excluded from this
+    // and from the after snapshot; only an accepted commit earns an IME receipt.
+    let before = if commit { ime_committed(app, &ed) } else { None };
     let len = s.chars().count();
     crate::type_transform::finish(app);
-    if app.run("type.edit", json!({"layer": ed.layer, "replace": {"start": start, "end": end, "text": s}, "coalesce": ed.session})).is_ok()
-        && let Some(e) = app.ui.text_edit.as_mut()
-    {
-        e.caret = start + len;
-        e.anchor = e.caret;
-        e.preedit = if commit || len == 0 { None } else { Some((start, len)) };
+    if app.run("type.edit", json!({"layer": ed.layer, "replace": {"start": start, "end": end, "text": s}, "coalesce": ed.session})).is_err() {
+        return;
     }
+    let mut after_ed = ed.clone();
+    after_ed.caret = start + len;
+    after_ed.anchor = after_ed.caret;
+    after_ed.preedit = if commit || len == 0 { None } else { Some((start, len)) };
+    if let Some(e) = app.ui.text_edit.as_mut() {
+        *e = after_ed.clone();
+    }
+    if after_ed.preedit.is_some() {
+        app.type_ime.note_preedit(&after_ed, &s);
+    } else {
+        app.type_ime.clear_preedit();
+    }
+    if commit {
+        app.type_ime.incoming = None;
+    } else {
+        remember_incoming(app, Some(s.is_empty()));
+    }
+    if commit
+        && let Some(before) = before
+        && let Some(after) = ime_committed(app, &after_ed)
+    {
+        // A no-op commit (equal snapshots) is rejected by the tracker rather than fabricated.
+        note_ime_apply(app, &after_ed, &before, &after);
+    }
+}
+
+/// The active range for an IME delete-surrounding batch: the pre-edit when composing, otherwise
+/// the sorted selection. Returns `(start, end, length)` in character indices.
+fn ime_active_range(app: &PhotocraftApp, ed: &TextEdit) -> Option<(usize, usize, usize)> {
+    let n = text_char_count(app, LayerId(ed.layer))?;
+    if let Some((start, len)) = ed.preedit {
+        let end = start.checked_add(len)?;
+        return (end <= n).then_some((start, end, n));
+    }
+    let a = ed.caret.min(n);
+    let b = ed.anchor.min(n);
+    Some((a.min(b), a.max(b), n))
+}
+
+/// Delete characters around the selection/pre-edit, as one coalesced type edit.
+fn ime_delete_chars(app: &mut PhotocraftApp, before_chars: usize, after_chars: usize) -> bool {
+    let Some(ed) = app.ui.text_edit.clone() else { return false };
+    if ed.preedit.is_some() {
+        let Some(text) = current_text(app, LayerId(ed.layer)) else { return false };
+        if reconcile_preedit(app, &ed, &text) {
+            return false;
+        }
+    }
+    let Some((start, end, n)) = ime_active_range(app, &ed) else { return false };
+    let from = start.saturating_sub(before_chars);
+    let to = end.saturating_add(after_chars).min(n);
+    ime_delete_around(app, ed, from, start, end, to)
+}
+
+/// `DeleteSurroundingBytes` counts UTF-8 bytes from the active range's edges. A byte count that
+/// ends inside a character leaves that character, as the stock TextEdit does.
+fn ime_delete_bytes(app: &mut PhotocraftApp, before_bytes: usize, after_bytes: usize) -> bool {
+    let Some(ed) = app.ui.text_edit.clone() else { return false };
+    let Some(text) = current_text(app, LayerId(ed.layer)) else { return false };
+    if reconcile_preedit(app, &ed, &text) {
+        return false;
+    }
+    let Some((start, end, n)) = ime_active_range(app, &ed) else { return false };
+    let start_byte = byte_of(&text, start);
+    let end_byte = byte_of(&text, end);
+    let from_byte = start_byte.saturating_sub(before_bytes);
+    let before_chars = text.get(..start_byte).map_or(0, |before| before.char_indices().rev().take_while(|(index, _)| *index >= from_byte).count());
+    let after_chars =
+        text.get(end_byte..).map_or(0, |after| after.char_indices().take_while(|(index, character)| index + character.len_utf8() <= after_bytes).count());
+    let from = start.saturating_sub(before_chars);
+    let to = end.saturating_add(after_chars).min(n);
+    ime_delete_around(app, ed, from, start, end, to)
+}
+
+/// Apply one accepted IME deletion and record its receipt from the snapshots around it.
+///
+/// The active selection/pre-edit itself stays; only the requested runs before `start` and after
+/// `end` are removed. They are two engine mutations with the same coalescing key (one history
+/// step), and one receipt covers the whole batch.
+fn ime_delete_around(app: &mut PhotocraftApp, ed: TextEdit, from: usize, start: usize, end: usize, to: usize) -> bool {
+    if from >= start && end >= to {
+        return false;
+    }
+    let before = ime_committed(app, &ed);
+    crate::type_transform::finish(app);
+    // Delete the trailing run first so the leading run's character indices stay valid.
+    if end < to && app.run("type.edit", json!({"layer": ed.layer, "replace": {"start": end, "end": to, "text": ""}, "coalesce": ed.session})).is_err() {
+        return false;
+    }
+    if from < start && app.run("type.edit", json!({"layer": ed.layer, "replace": {"start": from, "end": start, "text": ""}, "coalesce": ed.session})).is_err() {
+        return false;
+    }
+    let shift = start - from;
+    let mut after_ed = ed.clone();
+    after_ed.caret = ed.caret.saturating_sub(shift);
+    after_ed.anchor = ed.anchor.saturating_sub(shift);
+    if let Some((preedit_start, preedit_len)) = ed.preedit {
+        after_ed.preedit = Some((preedit_start.saturating_sub(shift), preedit_len));
+    }
+    if let Some(e) = app.ui.text_edit.as_mut() {
+        *e = after_ed.clone();
+    }
+    if let (Some(before), Some(after)) = (before, ime_committed(app, &after_ed)) {
+        note_ime_apply(app, &after_ed, &before, &after);
+    }
+    remember_incoming(app, None);
+    true
 }
 
 /// Character index of the previous / next word boundary (shared with `type.navigate`).
@@ -981,28 +1829,51 @@ fn line_edge(app: &mut PhotocraftApp, id: LayerId, caret: usize, end: bool) -> u
 /// Keyboard input while editing. Returns true when a type edit session is active (single-key
 /// tool shortcuts must then be skipped). Handled events are removed from the frame's input.
 pub fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
+    bind_reset_context(app, ctx);
+    // A receipt is only valid for the frame that produced it; never reuse last frame's.
+    app.type_ime.frame = None;
     end_if_left(app);
+    sync_incoming(app, ctx.viewport_id());
+    if !ctx.input(|i| i.focused) || ctx.text_edit_focused() || ctx.egui_wants_keyboard_input() {
+        interrupt_incoming(app);
+    }
     crate::type_transform::cancel_stale(app);
     if !ctx.input(|i| i.focused) {
         crate::type_transform::cancel_drag(app);
     }
-    let Some(ed) = app.ui.text_edit.clone() else { return false };
+    let Some(ed) = app.ui.text_edit.clone() else {
+        controls_only(app, ctx);
+        return false;
+    };
     // The font picker (and other focused fields) owns keyboard input while it is open.
-    if ctx.text_edit_focused() || ctx.egui_wants_keyboard_input() {
+    if !reset_route_eligible(app, ctx) {
+        controls_only(app, ctx);
         return true;
     }
     let id = LayerId(ed.layer);
-    let Some(text) = current_text(app, id) else {
+    let Some(n) = text_char_count(app, id) else {
         app.ui.text_edit = None;
         app.ui.text_edit_return_tool = None;
+        app.type_ime.clear_preedit();
+        controls_only(app, ctx);
         return false;
     };
     // Undo/redo can shorten the text under us.
-    let n = text.chars().count();
     if let Some(e) = app.ui.text_edit.as_mut() {
         e.caret = e.caret.min(n);
         e.anchor = e.anchor.min(n);
     }
+    if !claim_raw_pass(app, ctx) {
+        return true;
+    }
+    app.type_ime.begin_frame(ctx);
+    prepare_reset(app, ctx);
+    // A target swap (session replacement, Type Mask, another layer) is known from the last
+    // descriptor the platform received. Cancel the native composition before any event in this
+    // pass can be applied to the new target.
+    if ime_target(app, &ed, ctx.viewport_id()).is_some_and(|target| app.type_ime.emitted.is_some_and(|last| last.target != target)) {
+        app.type_ime.interrupt = true;
+    }
     let time = ctx.input(|i| i.time);
     let elapsed = (time - app.ui.caret_blink_time).max(0.0);
     let period = 0.530;
@@ -1011,11 +1882,42 @@ pub fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
     let events = ctx.input(|i| i.events.clone());
     let vertical_flow = is_vertical(app, id);
     let mut handled = vec![false; events.len()];
+    let mut primary_down = events
+        .iter()
+        .find_map(|event| match event {
+            egui::Event::PointerButton { button: egui::PointerButton::Primary, pressed, .. } => Some(!pressed),
+            _ => None,
+        })
+        .unwrap_or_else(|| ctx.input(|input| input.pointer.primary_down()));
+    let mut custom_mutations = true;
+    let mut deferred_custom = false;
     for (k, ev) in events.iter().enumerate() {
-        let Some(ed) = app.ui.text_edit.clone() else { break };
+        if custom_mutations && !reset_route_eligible(app, ctx) {
+            custom_mutations = false;
+            suspend_reset(app, ctx);
+        }
+        if !custom_mutations {
+            if let egui::Event::ImeResetCompleted { request_id } = ev {
+                complete_reset(app, ctx, *request_id);
+                if let Some(slot) = handled.get_mut(k) {
+                    *slot = true;
+                }
+            } else if deferred_custom
+                && matches!(ev, egui::Event::Text(_) | egui::Event::Paste(_) | egui::Event::Cut | egui::Event::Ime(_))
+                && let Some(slot) = handled.get_mut(k)
+            {
+                *slot = true;
+            }
+            continue;
+        }
+        prepare_reset(app, ctx);
+        let Some(ed) = app.ui.text_edit.clone() else { continue };
         let (a, b) = (ed.caret.min(ed.anchor), ed.caret.max(ed.anchor));
-        let text = current_text(app, id).unwrap_or_default();
-        let n = text.chars().count();
+        // Only key handling needs the text (word/line edges); pointer, clipboard and IME events
+        // do not clone the whole layer.
+        let is_key = matches!(ev, egui::Event::Key { .. });
+        let text = if is_key { current_text(app, id).unwrap_or_default() } else { String::new() };
+        let n = if is_key { text.chars().count() } else { 0 };
         let set = |app: &mut PhotocraftApp, caret: usize, extend: bool| {
             if let Some(e) = app.ui.text_edit.as_mut() {
                 e.caret = caret.min(n);
@@ -1028,11 +1930,50 @@ pub fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
         match ev {
             egui::Event::Text(s) => insert_typed(app, s),
             egui::Event::Paste(s) => insert(app, s),
-            // A bare line break from the IME is the Enter key, which the key arm handles.
-            egui::Event::Ime(egui::ImeEvent::Preedit { text: s, .. } | egui::ImeEvent::Commit(s)) if s == "\n" || s == "\r" => handled[k] = false,
-            egui::Event::Ime(egui::ImeEvent::Preedit { text, .. }) => ime_update(app, text, false),
-            egui::Event::Ime(egui::ImeEvent::Commit(s)) => ime_update(app, s, true),
-            egui::Event::Ime(_) => {}
+            egui::Event::ImeResetCompleted { request_id } => complete_reset(app, ctx, *request_id),
+            egui::Event::Ime(ime_event) => {
+                // Untagged terminal payload cannot acknowledge a host reset. Only the exact
+                // current completion arm above may open admission for the following element.
+                if reset_guarded(app, ctx.viewport_id()) {
+                    continue;
+                }
+                match ime_event {
+                    // A bare line break from the IME is the Enter key, which the key arm handles.
+                    egui::ImeEvent::Preedit { text: s, .. } | egui::ImeEvent::Commit(s) if s == "\n" || s == "\r" => handled[k] = false,
+                    egui::ImeEvent::Preedit { text, .. } => ime_update(app, text, false),
+                    egui::ImeEvent::Commit(s) => {
+                        ime_update(app, s, true);
+                        app.type_ime.incoming = None;
+                    }
+                    egui::ImeEvent::DeleteSurrounding { before_chars, after_chars } => {
+                        ime_delete_chars(app, *before_chars, *after_chars);
+                    }
+                    egui::ImeEvent::DeleteSurroundingBytes { before_bytes, after_bytes } => {
+                        ime_delete_bytes(app, *before_bytes, *after_bytes);
+                    }
+                    _ => {}
+                }
+            }
+            egui::Event::PointerButton { button: egui::PointerButton::Primary, pressed, .. } => {
+                primary_down = *pressed;
+                if *pressed {
+                    // The canvas destination handler runs after this pass; never apply a
+                    // same-batch Text/Paste/Cut/IME suffix at the old caret just because no
+                    // composition or reset guard existed yet.
+                    interrupt_action(app, ctx.viewport_id());
+                    custom_mutations = false;
+                    deferred_custom = true;
+                    suspend_reset(app, ctx);
+                }
+                handled[k] = false;
+            }
+            egui::Event::PointerMoved(_) if primary_down => {
+                interrupt_action(app, ctx.viewport_id());
+                custom_mutations = false;
+                deferred_custom = true;
+                suspend_reset(app, ctx);
+                handled[k] = false;
+            }
             egui::Event::Copy => {
                 copy_selection(app, ctx);
             }
@@ -1155,6 +2096,12 @@ pub fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
                         if *key == Key::Z {
                             crate::type_transform::cancel_drag(app);
                         }
+                        if reset_guarded(app, ctx.viewport_id()) || app.type_ime.incoming.is_some() {
+                            interrupt_action(app, ctx.viewport_id());
+                            custom_mutations = false;
+                            deferred_custom = true;
+                            suspend_reset(app, ctx);
+                        }
                         handled[k] = false;
                     }
                     _ => {}
@@ -1164,6 +2111,7 @@ pub fn handle_keys(app: &mut PhotocraftApp, ctx: &egui::Context) -> bool {
             _ => handled[k] = false,
         }
     }
+    prepare_reset(app, ctx);
     if handled.iter().any(|h| *h) {
         app.ui.caret_blink_time = ctx.input(|i| i.time);
         let mut k = 0;
@@ -1207,6 +2155,7 @@ pub fn commit_with(app: &mut PhotocraftApp, mods: egui::Modifiers) {
             crate::type_transform::reset(app);
             app.ui.text_edit = None;
             app.ui.text_edit_return_tool = None;
+            app.type_ime.clear_preedit();
         }
     }
 }
@@ -1226,6 +2175,7 @@ fn commit_here(app: &mut PhotocraftApp, mods: egui::Modifiers) {
     }
     crate::type_transform::reset(app);
     let Some(ed) = app.ui.text_edit.take() else { return };
+    app.type_ime.clear_preedit();
     if let Some(tool) = app.ui.text_edit_return_tool.take()
         && app.ui.tool.is_type()
     {
@@ -1319,15 +2269,10 @@ pub fn draw_overlay(app: &mut PhotocraftApp, painter: &egui::Painter, xf: &ViewX
         let n = if bend.is_some() { ((x1 - x0) / 4.0).ceil().clamp(1.0, 512.0) as usize } else { 1 };
         (0..=n).map(|i| scr(x0 + (x1 - x0) * i as f32 / n as f32, y)).collect()
     };
-    // Tell the OS where the caret is: this is what enables the IME and places its candidate window.
-    {
-        let (x, top, bot) = l.caret(byte_of(&text, ed.caret));
-        let (x, top, bot) = if l.lines.is_empty() { (0.0, -(12.0 * l.px_per_pt.max(1.0)), 3.0) } else { (x, top, bot) };
-        let r = egui::Rect::from_two_pos(scr(x, top), scr(x, bot)).expand(1.0);
-        painter.ctx().output_mut(|o| {
-            o.ime = Some(egui::output::IMEOutput { purpose: egui::IMEPurpose::Normal, rect: r, cursor_rect: r, should_interrupt_composition: false });
-        });
-    }
+    // The IME descriptor is emitted once at pass end by `sync_ime`, from this pass's canvas
+    // mapping and the model as it stands after every panel has run.
+    let pass_nr = painter.ctx().cumulative_pass_nr_for(painter.ctx().viewport_id());
+    app.type_ime.note_view(painter.ctx().viewport_id(), pass_nr, xf);
     // Frame: paragraph text shows its box with handles; point text an underline per line.
     let mods = crate::workspace_ui::sticky_mods(app, painter.ctx().input(|i| i.modifiers));
     let has_transform = crate::type_transform::draw(app, painter, xf, mods);
@@ -1364,9 +2309,12 @@ pub fn draw_overlay(app: &mut PhotocraftApp, painter: &egui::Painter, xf: &ViewX
             }
         }
     }
-    // Uncommitted IME text is underlined.
-    if let Some((ps, pl)) = ed.preedit {
-        let (a, b) = (byte_of(&text, ps), byte_of(&text, ps + pl));
+    // Uncommitted IME text is underlined, but only while the stored range still holds exactly
+    // the composition: an application edit may have shifted it onto committed characters.
+    if let Some(offsets) = ime_offsets(&text, &ed)
+        && ime_preedit_is_current(app, &text, &ed, &offsets)
+        && let Some((a, b)) = offsets.preedit.map(|range| (range.start, range.end))
+    {
         for (li, ln) in l.lines.iter().enumerate() {
             let xs: Vec<(f32, f32)> =
                 l.clusters.iter().filter(|c| c.line == li && c.range.start >= a && c.range.end <= b).map(|c| (c.x, c.x + c.advance)).collect();
@@ -1464,7 +2412,7 @@ fn draw_mask_overlay(app: &PhotocraftApp, painter: &egui::Painter, xf: &ViewXfor
     // The text's box: a texture of the tint where there is no glyph, cached per revision.
     let ctx = painter.ctx();
     let key = (st.doc.id.0, st.revision, id.0);
-    let cache = egui::Id::new("pc-type-mask-overlay");
+    let cache = egui::Id::unique("pc-type-mask-overlay");
     let tex = ctx.data(|d| d.get_temp::<((u64, u64, u64), egui::TextureHandle)>(cache)).filter(|(k, _)| *k == key).map(|(_, t)| t);
     let tex = tex.unwrap_or_else(|| {
         let max = (ctx.input(|i| i.max_texture_side) as u32).clamp(256, 4096);
@@ -1517,7 +2465,7 @@ pub fn families() -> Arc<Vec<String>> {
 
 /// Where [`sync_font_names`] leaves the font menus' localized labels for this frame.
 fn font_labels_id() -> egui::Id {
-    egui::Id::new("photocraft-font-menu-localized-names")
+    egui::Id::unique("photocraft-font-menu-localized-names")
 }
 
 /// Preferences ▸ Type ▸ Show Font Names in English: when off, font menus list a family that has a
@@ -1690,9 +2638,10 @@ fn axis_sliders(app: &mut PhotocraftApp, ui: &mut egui::Ui, c: &photocraft_doc::
         let mut changed = false;
         ui.push_id(("type-axis", &axis.0), |ui| {
             ui.horizontal(|ui| {
-                ui.label(egui::RichText::new(axis_label(&axis.0)).color(t.text_dim));
+                let axis_name = axis_label(&axis.0);
+                ui.label(egui::RichText::new(&axis_name).color(t.text_dim));
                 ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                    changed |= crate::widgets::value_field(ui, &mut v, min..=max, "", 74.0).changed();
+                    changed |= crate::widgets::value_field(ui, &mut v, min..=max, "", 74.0).accessible_name(axis_name).changed();
                 });
             });
             changed |= crate::widgets::slider(ui, &mut v, min..=max, None).changed();
@@ -1744,7 +2693,7 @@ pub(crate) fn fonts_ready(ui: &mut egui::Ui, width: f32) -> bool {
         return true;
     }
     let label = tl!("Loading fonts…").to_string();
-    ui.add_enabled_ui(false, |ui| crate::widgets::dropdown(ui, "fonts-loading", &mut label.clone(), &[(label.clone(), label.as_str())], width));
+    ui.add_enabled_ui(false, |ui| crate::widgets::dropdown(ui, "fonts-loading", tl!("Font"), &mut label.clone(), &[(label.clone(), label.as_str())], width));
     ui.ctx().request_repaint_after(std::time::Duration::from_millis(100));
     false
 }
@@ -1784,7 +2733,7 @@ pub(crate) fn family_picker_in(
     let mut changed = false;
     // A font picked from the open menu (click or Enter): the field keeps the focus afterwards.
     let mut picked = false;
-    let search_id = ui.id().with(("font-search", salt));
+    let search_id = ui.scope_id().with(("font-search", salt));
     let focus_id = search_id.with("focus");
     let recents_id = search_id.with("recents");
     let row_id = search_id.with("row");
@@ -1802,7 +2751,7 @@ pub(crate) fn family_picker_in(
         // picking a font closes it explicitly below.
         .close_behavior(if matches!(close, egui::PopupCloseBehavior::IgnoreClicks) { close } else { egui::PopupCloseBehavior::CloseOnClickOutside });
 
-    let response = combo.show_ui(ui, |ui| {
+    let mut response = combo.show_ui(ui, |ui| {
         let height_id = search_id.with("height");
         // Each opening focuses the search, including a reopen on the very next pass. Keep
         // asking through the invisible sizing pass, until the field receives focus.
@@ -1828,16 +2777,31 @@ pub(crate) fn family_picker_in(
         let ql = q.to_lowercase();
         // The recent group stays as it was when the menu opened: each arrow step applies (and so
         // records) a family, and moving it to the top would send the next step back up.
+        let opening = ui.data(|d| d.get_temp::<Vec<String>>(recents_id).is_none());
         let open_recents: Vec<String> = ui.data_mut(|d| d.get_temp_mut_or_insert_with(recents_id, || recents.to_vec()).clone());
         let (rows, n_recent) = font_menu_rows(families, labels, &ql, &open_recents);
         // A recent family is listed twice. The current family's row is the one the last arrow
-        // selected while it still shows that family, else its alphabetical copy, so the arrows
-        // step through the alphabet as on the closed field.
+        // selected while it still shows that family, else its first copy: as in Photoshop, the
+        // one in the recent group when it has one (#9160), and the arrows walk on from there.
         let mut selected = ui
             .data(|d| d.get_temp::<usize>(row_id))
             .filter(|&i| rows.get(i).is_some_and(|(f, _)| *f == current))
-            .or_else(|| rows.iter().skip(n_recent).position(|(f, _)| *f == current).map(|i| i + n_recent))
             .or_else(|| rows.iter().position(|(f, _)| *f == current));
+        // The menu opens on the current family, as Photoshop's does: with the recent group at the
+        // top of the view when the marked row fits below it, else the marked row itself, at the
+        // top of the view when it is not a recent one. Applied on the first laid-out pass (the
+        // popup's first pass only measures), whether or not a row matches, so a missing font or
+        // a filtered list never scrolls the menu later.
+        let reveal_id = search_id.with("reveal");
+        if opening {
+            ui.data_mut(|d| d.insert_temp(reveal_id, true));
+        }
+        let revealing = ui.data(|d| d.get_temp::<bool>(reveal_id)).unwrap_or(false) && !ui.is_sizing_pass();
+        if revealing {
+            ui.data_mut(|d| d.remove::<bool>(reveal_id));
+        }
+        let reveal = if revealing { selected } else { None };
+        let reveal_from = reveal.map(|i| if i < n_recent { 0 } else { i });
         let mut stepped = None;
         if down || up {
             let next = match selected {
@@ -1868,6 +2832,8 @@ pub(crate) fn family_picker_in(
         // Wrap the font rows in a ScrollArea so only the list scrolls: the search field above
         // stays fixed at the top of the popup.
         let mut hovered: Option<String> = None;
+        let reveal = if stepped.is_some() { None } else { reveal };
+        let mut reveal_top: Option<egui::Rect> = None;
         egui::ScrollArea::vertical().show(ui, |ui| {
             for (i, (f, label)) in rows.into_iter().enumerate() {
                 if i == n_recent && n_recent > 0 {
@@ -1880,12 +2846,30 @@ pub(crate) fn family_picker_in(
                 // family is listed twice.
                 let mut button = egui::Button::selectable(selected == Some(i), label).truncate().stroke(egui::Stroke::NONE);
                 if let Some((size, [_, h])) = preview {
-                    button = button
-                        .right_text(egui::Atom::custom(ui.id().with(("font-sample", f)), egui::vec2(crate::font_preview::slot_width(ui.ctx(), f, size), h)));
+                    button = button.right_text(egui::Atom::custom(
+                        egui::IdSalt::new(("font-sample", f)),
+                        egui::vec2(crate::font_preview::slot_width(ui.ctx(), f, size), h),
+                    ));
                 }
                 let response = ui.add_sized([330.0, row_h], button);
                 if stepped == Some(i) {
                     response.scroll_to_me(Some(egui::Align::Center));
+                } else if reveal.is_some() {
+                    if reveal_from == Some(i) {
+                        reveal_top = Some(response.rect);
+                    }
+                    if reveal == Some(i) {
+                        // Jump, not glide: the menu opens with its current family in view. Arrow
+                        // steps above keep the animation. A recent row too far below the top of
+                        // the group (large previews, many recents) is brought up to the bottom.
+                        let top = reveal_top.unwrap_or(response.rect);
+                        let (rect, align) = if response.rect.bottom() - top.top() <= ui.clip_rect().height() {
+                            (top, egui::Align::Min)
+                        } else {
+                            (response.rect, egui::Align::Max)
+                        };
+                        ui.scroll_to_rect_animation(rect, Some(align), egui::style::ScrollAnimation::none());
+                    }
                 }
                 if let Some((size, _)) = preview
                     && ui.is_rect_visible(response.rect)
@@ -1919,12 +2903,14 @@ pub(crate) fn family_picker_in(
         }
         if accept { None } else { hovered }
     });
+    response.response = response.response.accessible_name(tl!("Font"));
     press.after(&response.response);
     if !egui::ComboBox::is_open(ui.ctx(), response.response.id) {
         ui.data_mut(|d| {
             d.remove::<bool>(focus_id);
             d.remove::<Vec<String>>(recents_id);
             d.remove::<usize>(row_id);
+            d.remove::<bool>(search_id.with("reveal"));
         });
     }
     let hovered_font = response.inner.unwrap_or_default();
@@ -1986,7 +2972,7 @@ pub(crate) fn family_picker_in(
     }
 
     if salt == "type-font" {
-        let hover_id = egui::Id::new("type-font-hover");
+        let hover_id = egui::Id::unique("type-font-hover");
         if let Some(f) = hovered_font {
             ui.ctx().data_mut(|d| d.insert_temp(hover_id, f));
         } else if egui::ComboBox::is_open(ui.ctx(), response.response.id) {
@@ -2027,7 +3013,16 @@ pub(crate) fn target(app: &PhotocraftApp) -> Option<(u64, Option<[usize; 2]>)> {
 /// The type layer whose properties the Type controls and dialogs show (see [`target`]).
 pub(crate) fn target_text(app: &PhotocraftApp) -> Option<&TextLayer> {
     let (id, _) = target(app)?;
-    text_layer(&app.session.active()?.doc, LayerId(id))
+    text_layer(&target_doc(app)?.doc, LayerId(id))
+}
+
+/// The document [`target`]'s layer is in: a text edit's own, which can stay in a background
+/// document where the same layer id may name another layer, else the active one.
+fn target_doc(app: &PhotocraftApp) -> Option<&photocraft_engine::DocState> {
+    match &app.ui.text_edit {
+        Some(ed) => app.session.documents().get(edit_home(app, ed)?),
+        None => app.session.active(),
+    }
 }
 
 /// Snapshot the mutation scope separately from the representative used to display properties.
@@ -2291,14 +3286,14 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         }
         let opts: Vec<(String, String)> = styles(&fam).into_iter().map(|s| (s.clone(), style_label(&s))).collect();
         let opts_ref: Vec<(String, &str)> = opts.iter().map(|(a, b)| (a.clone(), b.as_str())).collect();
-        if crate::widgets::dropdown(ui, "type-style", &mut style, &opts_ref, 110.0) {
+        if crate::widgets::dropdown(ui, "type-style", tl!("Style"), &mut style, &opts_ref, 110.0) {
             app.ui.tool_options.type_style = style.clone();
             apply(app, ui.ctx(), json!({"fontStyle": style}));
         }
     }
     let (r, icon) = ui.allocate_exact_size(egui::vec2(18.0, 22.0), egui::Sense::hover());
     crate::icons::paint(ui, r, "type", 13.0, t.icon);
-    icon.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Label, true, tl!("Font size")));
+    icon.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Label, true, tl!("Font size")));
     // Photoshop's "T" scrubs the size field beside it, like the Character panel's icons (#6437).
     crate::widgets::scrub_option_icon(ui, &icon, tl!("Font size"));
     let (unit, label) = type_unit(app);
@@ -2319,7 +3314,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         ("strong".to_string(), tl!("Strong")),
         ("smooth".to_string(), tl!("Smooth")),
     ];
-    if crate::widgets::dropdown(ui, "type-aa", &mut aa, &aa_opts, 80.0) {
+    if crate::widgets::dropdown(ui, "type-aa", tl!("Anti-aliasing method"), &mut aa, &aa_opts, 80.0) {
         app.ui.tool_options.type_aa = aa.clone();
         if let Some(params) = formatting_params(app) {
             let _ = app.run(&format!("type.antiAlias.{aa}"), params);
@@ -2327,10 +3322,23 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     }
     crate::widgets::vline(ui, 22.0);
     ui.spacing_mut().item_spacing.x = 2.0;
+    // Alignment and direction show the target paragraph's, as Photoshop's bar follows the text
+    // being edited or the selected type layer; the tool defaults otherwise. A justified paragraph
+    // lights none of the three.
+    let para = styles_at(app).map(|(_, p)| p);
+    let shown_align = match &para {
+        Some(p) => match p.align {
+            photocraft_doc::text::TextAlign::Left => "left",
+            photocraft_doc::text::TextAlign::Center => "center",
+            photocraft_doc::text::TextAlign::Right => "right",
+            _ => "",
+        },
+        None => o.type_align.as_str(),
+    };
     for (align, icon, tip) in
         [("left", "align-left", tl!("Left align text")), ("center", "align-center", tl!("Center text")), ("right", "align-right", tl!("Right align text"))]
     {
-        if crate::icons::button(ui, icon, 24.0, o.type_align == align, tip).clicked() {
+        if crate::icons::button(ui, icon, 24.0, shown_align == align, tip).clicked() {
             app.ui.tool_options.type_align = align.into();
             apply(app, ui.ctx(), json!({"align": align}));
         }
@@ -2339,7 +3347,8 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     crate::widgets::vline(ui, 22.0);
     ui.spacing_mut().item_spacing.x = 2.0;
     for (key, tip, d) in direction_items() {
-        if direction_button(ui, d, o.type_direction == key, tip).clicked() {
+        let on = para.as_ref().map_or(o.type_direction == key, |p| p.direction == d);
+        if direction_button(ui, d, on, tip).clicked() {
             app.ui.tool_options.type_direction = key.into();
             apply(app, ui.ctx(), json!({"direction": key}));
         }
@@ -2360,7 +3369,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     ui.painter().rect_filled(rect, 2.0, Color32::from_rgb(q(c[0]), q(c[1]), q(c[2])));
     ui.painter().rect_stroke(rect, 2.0, Stroke::new(1.0, t.field_border), egui::StrokeKind::Outside);
     let resp = resp.on_hover_text(tl!("Set the text color"));
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Set the text color")));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Set the text color")));
     if resp.clicked() {
         open_color_picker(app, [c[0], c[1], c[2]]);
     }
@@ -2394,12 +3403,17 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
 }
 
 /// Character and paragraph style at the target (selection start, else the layer's first run).
+/// The paragraph at a collapsed caret is the caret's, as Photoshop's options bar and Paragraph
+/// panel show it.
 pub(crate) fn styles_at(app: &PhotocraftApp) -> Option<(photocraft_doc::text::CharStyle, photocraft_doc::text::ParagraphStyle)> {
     let (layer, range) = target(app)?;
-    let st = app.session.active()?;
-    let t = text_layer(&st.doc, LayerId(layer))?;
+    let t = text_layer(&target_doc(app)?.doc, LayerId(layer))?;
     let at = range.map_or(0, |r| byte_of(&t.text, r[0]));
-    let pick = |lens: Vec<usize>| -> usize {
+    let para_at = match (range, &app.ui.text_edit) {
+        (None, Some(ed)) => byte_of(&t.text, ed.caret),
+        _ => at,
+    };
+    let pick_at = |at: usize, lens: Vec<usize>| -> usize {
         let mut acc = 0;
         for (i, len) in lens.iter().enumerate() {
             acc += len;
@@ -2411,8 +3425,8 @@ pub(crate) fn styles_at(app: &PhotocraftApp) -> Option<(photocraft_doc::text::Ch
     };
     let runs = t.char_runs();
     let paras = t.paragraph_runs();
-    let c = runs.get(pick(runs.iter().map(|r| r.len).collect())).map(|r| r.style.clone())?;
-    let p = paras.get(pick(paras.iter().map(|r| r.len).collect())).map(|r| r.style.clone()).unwrap_or_default();
+    let c = runs.get(pick_at(at, runs.iter().map(|r| r.len).collect())).map(|r| r.style.clone())?;
+    let p = paras.get(pick_at(para_at, paras.iter().map(|r| r.len).collect())).map(|r| r.style.clone()).unwrap_or_default();
     Some((c, p))
 }
 
@@ -2462,7 +3476,7 @@ fn kerning_field(ui: &mut egui::Ui, shown: &str, width: f32) -> Option<serde_jso
     let mut out = None;
     ui.horizontal(|ui| {
         ui.spacing_mut().item_spacing.x = 0.0;
-        let resp = ui.add(egui::TextEdit::singleline(&mut buf).desired_width((width - 40.0).max(24.0)).id(id.with("edit")));
+        let resp = ui.add(egui::TextEdit::singleline(&mut buf).desired_width((width - 40.0).max(24.0)).id(id.with("edit"))).accessible_name(tl!("Kerning"));
         if resp.has_focus() {
             ui.data_mut(|d| d.insert_temp(id, buf.clone()));
         } else {
@@ -2488,6 +3502,7 @@ fn kerning_field(ui: &mut egui::Ui, shown: &str, width: f32) -> Option<serde_jso
                 }
             });
         press.after(&combo.response);
+        let _ = combo.response.accessible_name(tl!("Kerning"));
     });
     out
 }
@@ -2508,6 +3523,7 @@ fn icon_label(ui: &mut egui::Ui, icon: &str, tip: &str) {
     let t = crate::theme::Tokens::get(ui.ctx());
     let (r, resp) = ui.allocate_exact_size(egui::vec2(crate::props_layout::LABEL_W, 22.0), egui::Sense::hover());
     crate::icons::paint(ui, r, icon, 12.0, t.text_dim);
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Label, ui.is_enabled(), tl!(tip)));
     // Photoshop's Character panel icons scrub the field beside them.
     crate::widgets::scrub_label(ui, &resp.on_hover_text(tl!(tip)));
 }
@@ -2521,6 +3537,7 @@ fn num_field(ui: &mut egui::Ui, label: &str, tip: &str, v: f32, range: std::ops:
         ui.spacing_mut().item_spacing.x = 4.0;
         let (r, resp) = ui.allocate_exact_size(egui::vec2(22.0, 22.0), egui::Sense::hover());
         ui.painter().text(r.center(), egui::Align2::CENTER_CENTER, label, crate::theme::semibold(10.0), t.text_dim);
+        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Label, ui.is_enabled(), tl!(tip)));
         crate::widgets::scrub_label(ui, &resp.on_hover_text(tl!(tip)));
         let response = crate::widgets::value_field(ui, &mut v, range, unit, width);
         response.widget_info(|| {
@@ -2594,7 +3611,7 @@ fn direction_button(ui: &mut egui::Ui, d: photocraft_doc::text::TextDirection, s
     let tint = crate::icons::button_chrome(ui, r, selected, resp.hovered());
     direction_glyph(ui.painter(), egui::Rect::from_center_size(r.center(), egui::vec2(14.0, 16.0)), d, tint);
     let tip = tip.to_string();
-    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, true, selected, &tip));
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, selected, &tip));
     resp.on_hover_text(tip)
 }
 
@@ -2626,7 +3643,7 @@ fn toggle_cell(ui: &mut egui::Ui, w: f32, on: bool, tip: &str, paint: impl FnOnc
         },
     );
     let tip = tip.to_string();
-    resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Button, enabled, on, &tip));
+    resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, enabled, on, &tip));
     resp.on_hover_text(tl!(&tip)).clicked()
 }
 
@@ -2791,7 +3808,7 @@ fn type_sections(app: &mut PhotocraftApp, ui: &mut egui::Ui, character: bool, pa
             let mut style = selected_style(&c);
             let opts: Vec<(String, String)> = styles(&fam).into_iter().map(|s| (s.clone(), style_label(&s))).collect();
             let opts_ref: Vec<(String, &str)> = opts.iter().map(|(a, b)| (a.clone(), b.as_str())).collect();
-            if crate::widgets::dropdown(ui, "props-type-style", &mut style, &opts_ref, full) {
+            if crate::widgets::dropdown(ui, "props-type-style", tl!("Style"), &mut style, &opts_ref, full) {
                 apply(app, ui.ctx(), json!({"fontStyle": style}));
             }
         });
@@ -2848,7 +3865,7 @@ fn type_sections(app: &mut PhotocraftApp, ui: &mut egui::Ui, character: bool, pa
                 ui.painter().rect_filled(rect, t.radius_sm, Color32::from_rgb(q(rgb[0]), q(rgb[1]), q(rgb[2])));
                 ui.painter().rect_stroke(rect, t.radius_sm, Stroke::new(1.0, t.field_border), egui::StrokeKind::Inside);
                 let resp = resp.on_hover_text(tl!("Text color"));
-                resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!("Text color")));
+                resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Text color")));
                 if resp.clicked() {
                     open_color_picker(app, rgb);
                 }
@@ -3031,7 +4048,7 @@ fn type_options(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 .into_iter()
                 .filter_map(|k| photocraft_engine::commands::find(&format!("type.antiAlias.{k}")).map(|c| (k.to_string(), c.label)))
                 .collect();
-            if crate::widgets::dropdown(ui, "props-type-aa", &mut cur, &opts, dd_w) {
+            if crate::widgets::dropdown(ui, "props-type-aa", tl!("Anti-aliasing method"), &mut cur, &opts, dd_w) {
                 run = Some(format!("type.antiAlias.{cur}"));
             }
         });
@@ -3069,6 +4086,7 @@ fn type_options(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
 pub fn cancel(app: &mut PhotocraftApp) {
     crate::type_transform::reset(app);
     let Some(ed) = app.ui.text_edit.take() else { return };
+    app.type_ime.clear_preedit();
     if let Some(tool) = app.ui.text_edit_return_tool.take()
         && app.ui.tool.is_type()
     {
@@ -3437,10 +4455,12 @@ mod tests {
         ime_update(&mut app, "", false);
         assert_eq!(layer_text(&app), "日本語");
         assert_eq!(app.ui.text_edit.as_ref().unwrap().preedit, None);
-        // A stale preedit range (text shortened by undo) must not panic.
+        // A stale preedit range (text shortened by undo) must not replace committed text; the
+        // composition is invalidated and its pending commit is dropped.
         app.ui.text_edit.as_mut().unwrap().preedit = Some((10, 5));
         ime_update(&mut app, "x", true);
-        assert_eq!(layer_text(&app), "日本語x");
+        assert_eq!(layer_text(&app), "日本語");
+        assert_eq!(app.ui.text_edit.as_ref().unwrap().preedit, None);
     }
 
     #[test]
@@ -3550,3 +4570,1350 @@ mod tests {
 #[cfg(test)]
 #[path = "type_commit_tests.rs"]
 mod commit_tests;
+
+#[cfg(test)]
+mod ime_tests {
+    use super::*;
+    use egui::output::{IMEOutput, ImeChangeCause};
+
+    fn context() -> egui::Context {
+        let ctx = egui::Context::default();
+        crate::theme::install_fonts(&ctx);
+        install_reset_hooks(&ctx);
+        ctx
+    }
+
+    fn app() -> PhotocraftApp {
+        let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), crate::Services::default());
+        app.session.execute("file.new", json!({"width": 400, "height": 200})).unwrap();
+        app.sync_views();
+        app.ui.tool = crate::state::Tool::Type;
+        pointer_up(&mut app, [50.0, 100.0], [50.0, 100.0]);
+        insert(&mut app, "abc");
+        app
+    }
+
+    fn run(app: &mut PhotocraftApp, ctx: &egui::Context, events: Vec<egui::Event>) -> Option<IMEOutput> {
+        let raw = egui::RawInput { focused: true, events, ..Default::default() };
+        let mut out = ctx.run_ui(raw, |ui| {
+            let rect = egui::Rect::from_min_size(Pos2::ZERO, egui::vec2(400.0, 300.0));
+            let xf = ViewXform { rect, zoom: 1.0, center: [100.0, 100.0], flip: false, rotation: 0.0, aspect: 1.0 };
+            handle_keys(app, ui.ctx());
+            draw_overlay(app, ui.painter(), &xf);
+            sync_ime(app, ui.ctx());
+            finish_reset_pass(app, ui.ctx());
+        });
+        out.textures_delta.clear(); // This protocol harness does not paint.
+        out.platform_output.ime
+    }
+
+    fn layer_text(app: &PhotocraftApp) -> String {
+        let ed = app.ui.text_edit.as_ref().expect("editing");
+        current_text(app, LayerId(ed.layer)).expect("text layer")
+    }
+
+    fn completed(request_id: egui::ImeResetId) -> egui::Event {
+        egui::Event::ImeResetCompleted { request_id }
+    }
+
+    fn payload(ime: &IMEOutput) -> &egui::output::IMESurroundingTextPayload {
+        ime.surrounding_text.available().expect("a bounded committed snapshot")
+    }
+
+    fn preedit(text: &str) -> egui::Event {
+        egui::Event::Ime(egui::ImeEvent::Preedit { text: text.to_owned(), active_range_chars: None })
+    }
+
+    #[test]
+    fn successive_ime_commits_are_input_method_and_keep_directional_offsets() {
+        let ctx = context();
+        let mut app = app();
+        let baseline = run(&mut app, &ctx, Vec::new()).expect("a focused editor descriptor");
+        assert_eq!(payload(&baseline).text, "abc");
+        assert_eq!(baseline.change_cause, ImeChangeCause::Other);
+
+        // The pre-edit is laid out in the layer but is not committed surrounding text.
+        let composing = run(&mut app, &ctx, vec![preedit("に")]).expect("descriptor while composing");
+        assert_eq!(payload(&composing).text, "abc");
+        assert_eq!((payload(&composing).cursor, payload(&composing).anchor), (3, 3));
+
+        let first = run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("日本".into()))]).expect("commit descriptor");
+        assert_eq!(first.change_cause, ImeChangeCause::InputMethod);
+        assert_eq!(payload(&first).text, "abc日本");
+
+        let composing = run(&mut app, &ctx, vec![preedit("ご")]).expect("second composition");
+        assert_eq!(payload(&composing).text, "abc日本");
+        let second = run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("語".into()))]).expect("second commit");
+        assert_eq!(second.change_cause, ImeChangeCause::InputMethod);
+        assert_eq!(payload(&second).text, "abc日本語");
+        assert_eq!(payload(&second).cursor, payload(&second).text.len());
+    }
+
+    #[test]
+    fn reversed_selection_keeps_its_direction_in_byte_offsets() {
+        let ctx = context();
+        let mut app = app();
+        if let Some(ed) = app.ui.text_edit.as_mut() {
+            ed.caret = 1;
+            ed.anchor = 3;
+        }
+        let selected = run(&mut app, &ctx, Vec::new()).expect("descriptor");
+        assert_eq!(payload(&selected).text, "abc");
+        assert_eq!((payload(&selected).cursor, payload(&selected).anchor), (1, 3));
+    }
+
+    #[test]
+    fn mixed_application_and_ime_edits_in_one_frame_are_other() {
+        let ctx = context();
+        let mut app = app();
+        run(&mut app, &ctx, Vec::new());
+
+        // An IME commit followed by ordinary typing in the same pass: the application change
+        // dominates even though the commit itself was accepted.
+        let mixed = run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("い".into())), egui::Event::Text("x".into())]).expect("mixed descriptor");
+        assert_eq!(payload(&mixed).text, "abcいx");
+        assert_eq!(mixed.change_cause, ImeChangeCause::Other);
+
+        // The observed mixed state is the next baseline, so a later clean IME commit is once
+        // again an InputMethod change.
+        let next = run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("う".into()))]).expect("next commit");
+        assert_eq!(next.change_cause, ImeChangeCause::InputMethod);
+        assert_eq!(payload(&next).text, "abcいxう");
+
+        // Application text before the commit in the same frame must also prevent InputMethod.
+        let mut app = self::app();
+        run(&mut app, &ctx, Vec::new());
+        let mixed = run(&mut app, &ctx, vec![egui::Event::Text("x".into()), egui::Event::Ime(egui::ImeEvent::Commit("い".into()))]).expect("mixed descriptor");
+        assert_eq!(mixed.change_cause, ImeChangeCause::Other);
+        assert_eq!(payload(&mixed).text, "abcxい");
+    }
+
+    #[test]
+    fn replaced_layer_or_session_bumps_generation_without_changing_owner() {
+        let ctx = context();
+        let mut app = app();
+        let first = run(&mut app, &ctx, Vec::new()).expect("descriptor");
+        let owner = first.owner;
+        let generation = first.context_generation;
+
+        // Same document and layer id, a new edit session: the replacement epoch changes, so the
+        // stale generation cannot be reused by a native IME bridge.
+        app.ui.text_edit.as_mut().unwrap().session = "type-replaced".into();
+        let replaced = run(&mut app, &ctx, Vec::new()).expect("replaced descriptor");
+        assert_eq!(replaced.owner, owner, "the layer identity is immutable");
+        assert_ne!(replaced.context_generation, generation);
+        assert_eq!(replaced.change_cause, ImeChangeCause::Other);
+
+        // Ending the editor ends the context; no descriptor is emitted for an absent owner.
+        app.ui.text_edit = None;
+        assert!(run(&mut app, &ctx, Vec::new()).is_none());
+    }
+
+    #[test]
+    fn unavailable_editor_state_still_carries_owner_and_generation() {
+        let ctx = context();
+        let mut app = app();
+        // A stale composition range cannot be mapped onto the layer: do not silently publish
+        // the composition as committed text.
+        app.ui.text_edit.as_mut().unwrap().preedit = Some((10, 5));
+        let unavailable = run(&mut app, &ctx, Vec::new()).expect("descriptor with an owner");
+        assert!(unavailable.surrounding_text.available().is_none());
+        assert!(unavailable.context_generation > 0);
+        assert_eq!(unavailable.purpose, egui::IMEPurpose::Normal);
+    }
+
+    #[test]
+    fn delete_surrounding_bytes_with_preedit_excludes_the_composition() {
+        let ctx = context();
+        let mut app = app();
+        run(&mut app, &ctx, Vec::new());
+        run(&mut app, &ctx, vec![preedit("x")]);
+        assert_eq!(layer_text(&app), "abcx");
+        assert_eq!(app.ui.text_edit.as_ref().unwrap().preedit, Some((3, 1)));
+
+        // `c` is the byte immediately before the pre-edit; deleting it must not delete or
+        // report the composing `x`.
+        let deleted = run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 })])
+            .expect("deletion descriptor");
+        assert_eq!(deleted.change_cause, ImeChangeCause::InputMethod);
+        assert_eq!(payload(&deleted).text, "ab");
+        assert_eq!((payload(&deleted).cursor, payload(&deleted).anchor), (2, 2));
+        assert_eq!(layer_text(&app), "abx");
+        assert_eq!(app.ui.text_edit.as_ref().unwrap().preedit, Some((2, 1)));
+    }
+
+    #[test]
+    fn external_edit_invalidates_the_preedit_and_rejects_its_late_commit() {
+        for bytes in [false, true] {
+            for split in [false, true] {
+                for discard in [false, true] {
+                    let ctx = context();
+                    let mut app = app();
+                    run(&mut app, &ctx, Vec::new());
+                    // Compose in the middle of committed text, so an application edit before it
+                    // moves a still-in-range (but wrong) character range.
+                    insert(&mut app, "def");
+                    if let Some(ed) = app.ui.text_edit.as_mut() {
+                        ed.caret = 3;
+                        ed.anchor = 3;
+                    }
+                    let composing = run(&mut app, &ctx, vec![preedit("に")]).expect("composing descriptor");
+                    assert_eq!(layer_text(&app), "abcにdef");
+                    assert_eq!(payload(&composing).text, "abcdef", "the preview is not committed text");
+                    let layer = app.ui.text_edit.as_ref().unwrap().layer;
+                    let session = app.ui.text_edit.as_ref().unwrap().session.clone();
+                    // The control channel edits the same layer without passing through `insert`.
+                    app.run("type.edit", json!({"layer": layer, "replace": {"start": 0, "end": 1, "text": ""}, "coalesce": session})).unwrap();
+                    assert_eq!(layer_text(&app), "bcにdef");
+                    let revision = app.session.active().unwrap().revision;
+                    let history = app.session.active().unwrap().history.entries();
+                    let selection = app.ui.text_edit.as_ref().map(|ed| (ed.anchor, ed.caret));
+                    let unchanged = |app: &PhotocraftApp| {
+                        assert_eq!(layer_text(app), "bcにdef");
+                        assert_eq!(app.session.active().unwrap().revision, revision);
+                        assert_eq!(app.session.active().unwrap().history.entries(), history);
+                        assert_eq!(app.ui.text_edit.as_ref().map(|ed| (ed.anchor, ed.caret)), selection);
+                    };
+
+                    // The old range (3,1) now covers `d`: report unavailable, cancel the
+                    // composition and do not present `d` as the composition. A discarded pass
+                    // must retain both latches until a descriptor is actually delivered.
+                    let invalidated = if discard {
+                        ctx.options_mut(|o| o.max_passes = std::num::NonZeroUsize::new(4).expect("four passes"));
+                        let mut passes = Vec::new();
+                        let mut out = ctx.run_ui(egui::RawInput { focused: true, ..Default::default() }, |ui| {
+                            handle_keys(&mut app, ui.ctx());
+                            let rect = egui::Rect::from_min_size(Pos2::ZERO, egui::vec2(400.0, 300.0));
+                            let xf = ViewXform { rect, zoom: 1.0, center: [100.0, 100.0], flip: false, rotation: 0.0, aspect: 1.0 };
+                            draw_overlay(&mut app, ui.painter(), &xf);
+                            if passes.is_empty() {
+                                ui.ctx().request_discard("invalidated preedit descriptor regression");
+                            }
+                            let discarded = ui.ctx().will_discard();
+                            let before = (app.type_ime.stale, app.type_ime.interrupt);
+                            sync_ime(&mut app, ui.ctx());
+                            finish_reset_pass(&mut app, ui.ctx());
+                            let unavailable = ui.ctx().output(|out| out.ime.as_ref().expect("pass descriptor").surrounding_text.available().is_none());
+                            passes.push((discarded, before, (app.type_ime.stale, app.type_ime.interrupt), unavailable));
+                        });
+                        out.textures_delta.clear();
+                        assert_eq!(passes.first(), Some(&(true, (true, true), (true, true), true)), "discard cannot consume invalidation");
+                        assert_eq!(passes.last(), Some(&(false, (true, true), (false, false), true)), "the accepted pass delivers it once");
+                        out.platform_output.ime.expect("descriptor")
+                    } else {
+                        run(&mut app, &ctx, Vec::new()).expect("descriptor")
+                    };
+                    assert!(invalidated.surrounding_text.available().is_none());
+                    assert!(invalidated.should_interrupt_composition);
+                    assert_eq!(
+                        (invalidated.owner, invalidated.context_generation, invalidated.purpose),
+                        (composing.owner, composing.context_generation, composing.purpose)
+                    );
+                    assert_eq!(invalidated.change_cause, ImeChangeCause::Other);
+                    assert_eq!(app.ui.text_edit.as_ref().unwrap().preedit, None);
+                    assert!(app.type_ime.preedit.is_none());
+                    unchanged(&app);
+
+                    let recovered = run(&mut app, &ctx, Vec::new()).expect("idle descriptor");
+                    assert_eq!(payload(&recovered).text, "bcにdef");
+                    assert_eq!((payload(&recovered).cursor, payload(&recovered).anchor), (6, 6));
+                    assert!(!recovered.should_interrupt_composition, "a delivered reset is not replayed");
+                    assert!(matches!(app.type_ime.incoming, Some(IncomingComposition::Stale)), "idle availability does not accept an old terminal");
+                    unchanged(&app);
+
+                    // The pending deletion and commit belonged to the cancelled composition:
+                    // neither combined nor split delivery may replace `d` or grow undo history.
+                    let mut events = vec![terminal_delete(bytes)];
+                    if split {
+                        run(&mut app, &ctx, events).expect("rejected deletion descriptor");
+                        unchanged(&app);
+                        for _ in 0..3 {
+                            run(&mut app, &ctx, Vec::new());
+                        }
+                        assert!(matches!(app.type_ime.incoming, Some(IncomingComposition::Stale)));
+                        events = Vec::new();
+                    }
+                    events.push(egui::Event::Ime(egui::ImeEvent::Commit("に".into())));
+                    let late = run(&mut app, &ctx, events).expect("descriptor");
+                    assert_eq!(layer_text(&app), "bcにdef");
+                    assert_eq!(late.change_cause, ImeChangeCause::Other);
+                    assert_eq!(payload(&late).text, "bcにdef");
+                    unchanged(&app);
+                    assert!(matches!(app.type_ime.incoming, Some(IncomingComposition::Stale)), "terminal input cannot acknowledge cancellation");
+
+                    let fresh = run(&mut app, &ctx, vec![completed(invalidated.reset_request.expect("reset request")), preedit("Q")])
+                        .expect("fresh preview descriptor");
+                    assert_eq!(layer_text(&app), "bcにdQef");
+                    assert_eq!(payload(&fresh).text, "bcにdef", "fresh preview is excluded from committed text");
+                    assert!(!fresh.should_interrupt_composition);
+                    let committed = run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("Q".into()))]).expect("fresh commit descriptor");
+                    assert_eq!(layer_text(&app), "bcにdQef");
+                    assert_eq!(payload(&committed).text, "bcにdQef");
+                    assert_eq!(committed.change_cause, ImeChangeCause::InputMethod);
+                    let direct = run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("R".into()))]).expect("direct commit descriptor");
+                    assert_eq!(layer_text(&app), "bcにdQRef");
+                    assert_eq!(payload(&direct).text, "bcにdQRef");
+                    assert_eq!(direct.change_cause, ImeChangeCause::InputMethod);
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn target_change_interrupts_and_rejects_the_late_commit() {
+        let ctx = context();
+        let mut app = app();
+        run(&mut app, &ctx, Vec::new());
+        run(&mut app, &ctx, vec![preedit("に")]);
+        assert_eq!(layer_text(&app), "abcに");
+
+        let created = app.run("type.create", json!({"text": "two", "x": 150, "y": 60})).unwrap();
+        let second = created.get("layer").and_then(serde_json::Value::as_u64).expect("new layer");
+        app.session.select_layer(LayerId(second)).expect("select the second type layer");
+        app.ui.text_edit = Some(TextEdit {
+            layer: second,
+            document: active_doc_id(&app),
+            caret: 3,
+            anchor: 3,
+            session: "type-second".into(),
+            created: false,
+            mask: false,
+            dragging: false,
+            resize: None,
+            preedit: None,
+        });
+        // The platform only cancels composition on this flag (X11, macOS, Windows and the web).
+        let switched = run(&mut app, &ctx, Vec::new()).expect("transition descriptor");
+        assert!(switched.should_interrupt_composition);
+
+        let late = run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("日本".into()))]).expect("descriptor");
+        assert_eq!(current_text(&app, LayerId(second)).unwrap(), "two");
+        assert_eq!(late.change_cause, ImeChangeCause::Other);
+        run(&mut app, &ctx, vec![completed(switched.reset_request.expect("replacement layer reset")), preedit("が")]);
+        assert_eq!(layer_text(&app), "twoが");
+    }
+
+    #[test]
+    fn type_mask_session_has_a_distinct_owner() {
+        let ctx = context();
+        let mut app = app();
+        let normal = run(&mut app, &ctx, Vec::new()).expect("descriptor");
+        app.ui.text_edit.as_mut().unwrap().mask = true;
+        let masked = run(&mut app, &ctx, Vec::new()).expect("mask descriptor");
+        assert_ne!(masked.owner, normal.owner, "the Type Mask session is its own owner");
+        assert_ne!(masked.context_generation, normal.context_generation);
+    }
+
+    #[test]
+    fn reentering_the_same_session_cancels_the_preedit() {
+        let ctx = context();
+        let mut app = app();
+        run(&mut app, &ctx, vec![preedit("に")]);
+        assert_eq!(app.ui.text_edit.as_ref().unwrap().preedit, Some((3, 1)));
+        edit_active(&mut app).unwrap();
+        assert_eq!(app.ui.text_edit.as_ref().unwrap().preedit, None);
+        assert!(app.type_ime.interrupt, "the native composition is cancelled");
+        assert!(app.type_ime.preedit.is_none());
+    }
+
+    #[test]
+    fn a_discarded_transition_pass_still_interrupts_the_next_descriptor() {
+        let ctx = context();
+        ctx.options_mut(|o| o.max_passes = std::num::NonZeroUsize::new(4).expect("four passes"));
+        let mut app = app();
+        run(&mut app, &ctx, Vec::new()).expect("baseline descriptor");
+        app.ui.text_edit.as_mut().unwrap().session = "type-discarded".into();
+        let mut passes = Vec::new();
+        let mut out = ctx.run_ui(egui::RawInput { focused: true, ..Default::default() }, |ui| {
+            handle_keys(&mut app, ui.ctx());
+            let rect = egui::Rect::from_min_size(Pos2::ZERO, egui::vec2(400.0, 300.0));
+            let xf = ViewXform { rect, zoom: 1.0, center: [100.0, 100.0], flip: false, rotation: 0.0, aspect: 1.0 };
+            draw_overlay(&mut app, ui.painter(), &xf);
+            if passes.is_empty() {
+                ui.ctx().request_discard("IME transition regression");
+            }
+            let discarded = ui.ctx().will_discard();
+            let pending_before = app.type_ime.interrupt;
+            sync_ime(&mut app, ui.ctx());
+            finish_reset_pass(&mut app, ui.ctx());
+            passes.push((discarded, pending_before, app.type_ime.interrupt));
+        });
+        out.textures_delta.clear();
+        assert_eq!(passes.first(), Some(&(true, true, true)), "discard retains the interrupt latch");
+        assert_eq!(passes.last(), Some(&(false, true, false)), "the accepted pass delivers it once");
+        assert!(out.platform_output.ime.expect("final descriptor").should_interrupt_composition);
+        let next = run(&mut app, &ctx, Vec::new()).expect("next descriptor");
+        assert!(!next.should_interrupt_composition, "a delivered interrupt is not replayed");
+    }
+
+    #[test]
+    fn delete_surrounding_characters_is_one_undo_step() {
+        let ctx = context();
+        let mut app = app();
+        commit(&mut app);
+        edit_active(&mut app).unwrap();
+        if let Some(ed) = app.ui.text_edit.as_mut() {
+            ed.caret = 3;
+            ed.anchor = 3;
+        }
+        run(&mut app, &ctx, Vec::new()).expect("baseline descriptor");
+        let deleted =
+            run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::DeleteSurrounding { before_chars: 1, after_chars: 0 })]).expect("deletion descriptor");
+        assert_eq!(deleted.change_cause, ImeChangeCause::InputMethod);
+        assert_eq!(layer_text(&app), "ab");
+        app.run("edit.undo", json!({})).unwrap();
+        assert_eq!(layer_text(&app), "abc", "the delete and its session coalesce into one step");
+    }
+
+    #[test]
+    fn an_empty_point_text_reports_an_available_empty_snapshot() {
+        let ctx = context();
+        let mut app = app();
+        if let Some(ed) = app.ui.text_edit.as_mut() {
+            ed.anchor = 0;
+            ed.caret = 3;
+        }
+        insert(&mut app, "");
+        assert_eq!(layer_text(&app), "");
+        let empty = run(&mut app, &ctx, Vec::new()).expect("descriptor");
+        let available = payload(&empty);
+        assert_eq!(available.text, "");
+        assert_eq!((available.cursor, available.anchor), (0, 0));
+    }
+
+    #[test]
+    fn a_long_line_reports_a_bounded_snapshot() {
+        let ctx = context();
+        let mut app = app();
+        if let Some(ed) = app.ui.text_edit.as_mut() {
+            ed.anchor = 0;
+            ed.caret = 3;
+        }
+        insert(&mut app, &"a".repeat(4500));
+        let long = run(&mut app, &ctx, Vec::new()).expect("descriptor");
+        let available = payload(&long);
+        assert!(available.text.len() <= egui::output::MAX_IME_SURROUNDING_TEXT_BYTES);
+        assert!(available.text.is_char_boundary(available.cursor));
+        assert!(available.text.is_char_boundary(available.anchor));
+    }
+
+    #[test]
+    fn the_real_app_logic_and_ui_publish_the_descriptor() {
+        use eframe::App as _;
+        let ctx = context();
+        let mut app = app();
+        let mut frame = eframe::Frame::_new_kittest();
+        let mut descriptors = Vec::new();
+        // The first pass registers fonts; the next passes run the real logic → ui orchestration
+        // (where `handle_keys` and the final `sync_ime` live).
+        for _ in 0..3 {
+            let raw =
+                egui::RawInput { focused: true, screen_rect: Some(egui::Rect::from_min_size(Pos2::ZERO, egui::vec2(1200.0, 800.0))), ..Default::default() };
+            let mut out = ctx.run_ui(raw, |ui| {
+                app.logic(ui.ctx(), &mut frame);
+                app.ui(ui, &mut frame);
+            });
+            out.textures_delta.clear(); // No renderer consumes this harness output.
+            descriptors.push(out.platform_output.ime);
+        }
+        let ime = descriptors.iter().flatten().last().expect("a descriptor from App::ui");
+        assert!(ime.surrounding_text.available().is_some());
+        assert!(ime.context_generation > 0);
+    }
+
+    fn terminal_delete(bytes: bool) -> egui::Event {
+        egui::Event::Ime(if bytes {
+            egui::ImeEvent::DeleteSurroundingBytes { before_bytes: 1, after_bytes: 0 }
+        } else {
+            egui::ImeEvent::DeleteSurrounding { before_chars: 1, after_chars: 0 }
+        })
+    }
+
+    fn raw_key(key: egui::Key, command: bool, shift: bool) -> egui::Event {
+        egui::Event::Key {
+            key,
+            physical_key: Some(key),
+            pressed: true,
+            repeat: false,
+            modifiers: egui::Modifiers {
+                command,
+                ctrl: command && !cfg!(target_os = "macos"),
+                mac_cmd: command && cfg!(target_os = "macos"),
+                shift,
+                ..Default::default()
+            },
+        }
+    }
+
+    #[test]
+    fn stale_owner_terminal_survives_idle_and_split_delete_commit_but_fresh_input_works() {
+        for empty in [false, true] {
+            for bytes in [false, true] {
+                let ctx = context();
+                let mut app = app();
+                run(&mut app, &ctx, vec![]);
+                run(&mut app, &ctx, vec![preedit("P")]);
+                if empty {
+                    run(&mut app, &ctx, vec![preedit("")]);
+                }
+                let old_layer = app.ui.text_edit.as_ref().unwrap().layer;
+                let created = app.run("type.create", json!({"text": "two", "x": 150, "y": 60})).unwrap();
+                let second = created["layer"].as_u64().unwrap();
+                app.session.select_layer(LayerId(second)).unwrap();
+                edit_active(&mut app).unwrap();
+                let transition = run(&mut app, &ctx, vec![]).unwrap();
+                assert!(transition.should_interrupt_composition);
+                for _ in 0..5 {
+                    run(&mut app, &ctx, vec![]);
+                }
+                let revision = app.session.active().unwrap().revision;
+                let undo = app.session.active().unwrap().history.entries().len();
+                let before = layer_text(&app);
+                run(&mut app, &ctx, vec![terminal_delete(bytes)]);
+                for _ in 0..3 {
+                    run(&mut app, &ctx, vec![]);
+                }
+                run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+                assert_eq!(layer_text(&app), before, "an old split terminal cannot edit a replacement owner");
+                assert_eq!(app.session.active().unwrap().revision, revision);
+                assert_eq!(app.session.active().unwrap().history.entries().len(), undo);
+                assert_eq!(current_text(&app, LayerId(old_layer)).unwrap(), if empty { "abc" } else { "abcP" });
+                let selection = app.ui.text_edit.as_ref().unwrap().clone();
+                let (a, b) = (selection.anchor.min(selection.caret), selection.anchor.max(selection.caret));
+                let expected = before.chars().take(a).chain("Q".chars()).chain(before.chars().skip(b)).collect::<String>();
+                run(
+                    &mut app,
+                    &ctx,
+                    vec![completed(transition.reset_request.expect("reset request")), preedit("Q"), egui::Event::Ime(egui::ImeEvent::Commit("Q".into()))],
+                );
+                assert_eq!(layer_text(&app), expected, "the exact completion permits fresh input");
+                run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("R".into()))]);
+                assert!(layer_text(&app).contains("QR"), "a later direct commit remains valid");
+                app.run("edit.undo", json!({})).unwrap();
+                assert_eq!(current_text(&app, LayerId(second)).unwrap(), before, "the new session is undoable");
+            }
+        }
+    }
+
+    #[test]
+    fn raw_application_selection_changes_reject_old_terminal_input_and_allow_later_fresh_input() {
+        for empty in [false, true] {
+            for bytes in [false, true] {
+                for (key, command, shift) in [(egui::Key::A, true, false), (egui::Key::ArrowLeft, false, false), (egui::Key::Home, false, true)] {
+                    let ctx = context();
+                    let mut app = app();
+                    run(&mut app, &ctx, vec![]);
+                    run(&mut app, &ctx, vec![preedit("P")]);
+                    if empty {
+                        run(&mut app, &ctx, vec![preedit("")]);
+                    }
+                    let before = layer_text(&app);
+                    let revision = app.session.active().unwrap().revision;
+                    let transition = run(&mut app, &ctx, vec![raw_key(key, command, shift)]).expect("selection reset");
+                    let selected = app.ui.text_edit.as_ref().unwrap().clone();
+                    assert!(
+                        (selected.anchor, selected.caret) != (before.chars().count(), before.chars().count()),
+                        "actual raw selection key changed the caret"
+                    );
+                    for _ in 0..3 {
+                        run(&mut app, &ctx, vec![]);
+                    }
+                    let undo = app.session.active().unwrap().history.entries().len();
+                    run(&mut app, &ctx, vec![terminal_delete(bytes), egui::Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+                    assert_eq!(layer_text(&app), before);
+                    assert_eq!(app.session.active().unwrap().revision, revision);
+                    assert_eq!(app.session.active().unwrap().history.entries().len(), undo);
+                    assert_eq!(app.ui.text_edit.as_ref().map(|e| (e.anchor, e.caret)), Some((selected.anchor, selected.caret)));
+                    let (a, b) = (selected.anchor.min(selected.caret), selected.anchor.max(selected.caret));
+                    let expected = before.chars().take(a).chain("Q".chars()).chain(before.chars().skip(b)).collect::<String>();
+                    // The completion opens admission at its exact position in the batch.
+                    run(
+                        &mut app,
+                        &ctx,
+                        vec![completed(transition.reset_request.expect("reset request")), preedit("Q"), egui::Event::Ime(egui::ImeEvent::Commit("Q".into()))],
+                    );
+                    assert_eq!(layer_text(&app), expected);
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn uninterrupted_live_and_empty_preedit_delete_commit_and_direct_commit_stay_valid() {
+        for empty in [false, true] {
+            for bytes in [false, true] {
+                let ctx = context();
+                let mut app = app();
+                run(&mut app, &ctx, vec![]);
+                run(&mut app, &ctx, vec![preedit("P")]);
+                if empty {
+                    run(&mut app, &ctx, vec![preedit("")]);
+                }
+                run(&mut app, &ctx, vec![terminal_delete(bytes)]);
+                for _ in 0..3 {
+                    run(&mut app, &ctx, vec![]);
+                }
+                run(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+                assert_eq!(layer_text(&app), "abX", "accepted deletion refreshes its composing caret");
+            }
+        }
+        let ctx = context();
+        let mut app = app();
+        run(&mut app, &ctx, vec![]);
+        run(&mut app, &ctx, vec![raw_key(egui::Key::A, true, false), egui::Event::Ime(egui::ImeEvent::Commit("D".into()))]);
+        assert_eq!(layer_text(&app), "D", "without known preedit the direct commit replaces the selection");
+    }
+
+    fn actual_app_frame(app: &mut PhotocraftApp, ctx: &egui::Context, events: Vec<egui::Event>) -> egui::FullOutput {
+        use eframe::App as _;
+        let mut frame = eframe::Frame::_new_kittest();
+        let mut raw =
+            egui::RawInput { focused: true, events, screen_rect: Some(egui::Rect::from_min_size(Pos2::ZERO, egui::vec2(1200.0, 800.0))), ..Default::default() };
+        app.raw_input_hook(ctx, &mut raw);
+        let mut output = ctx.run_ui(raw, |ui| {
+            app.logic(ui.ctx(), &mut frame);
+            app.ui(ui, &mut frame);
+        });
+        output.textures_delta.clear();
+        output
+    }
+
+    #[test]
+    fn the_real_app_pointer_interruption_rejects_idle_delayed_terminal_then_accepts_fresh_input() {
+        for empty in [false, true] {
+            for bytes in [false, true] {
+                let ctx = context();
+                let mut app = app();
+                for _ in 0..4 {
+                    actual_app_frame(&mut app, &ctx, vec![]);
+                }
+                app.ui.text_edit.as_mut().unwrap().caret = 1;
+                app.ui.text_edit.as_mut().unwrap().anchor = 1;
+                let point = actual_app_frame(&mut app, &ctx, vec![]).platform_output.ime.expect("real caret1 descriptor").cursor_rect.center();
+                app.ui.text_edit.as_mut().unwrap().caret = 3;
+                app.ui.text_edit.as_mut().unwrap().anchor = 3;
+                actual_app_frame(&mut app, &ctx, vec![]);
+                actual_app_frame(&mut app, &ctx, vec![preedit("P")]);
+                if empty {
+                    actual_app_frame(&mut app, &ctx, vec![preedit("")]);
+                }
+                let before = layer_text(&app);
+                let button = |pressed| egui::Event::PointerButton { pos: point, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() };
+                let press =
+                    actual_app_frame(&mut app, &ctx, vec![egui::Event::PointerMoved(point), button(true)]).platform_output.ime.expect("press descriptor");
+                let release = actual_app_frame(&mut app, &ctx, vec![button(false)]).platform_output.ime.expect("release descriptor");
+                let request = release.reset_request.or(press.reset_request).expect("pointer reset");
+                assert_eq!(app.ui.text_edit.as_ref().unwrap().caret, 1, "actual canvas pointer moved the caret");
+                for _ in 0..4 {
+                    actual_app_frame(&mut app, &ctx, vec![]);
+                }
+                let revision = app.session.active().unwrap().revision;
+                actual_app_frame(&mut app, &ctx, vec![terminal_delete(bytes), egui::Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+                assert_eq!(layer_text(&app), before);
+                assert_eq!(app.session.active().unwrap().revision, revision);
+                actual_app_frame(&mut app, &ctx, vec![completed(request), preedit("Q"), egui::Event::Ime(egui::ImeEvent::Commit("Q".into()))]);
+                let expected = before.chars().take(1).chain("Q".chars()).chain(before.chars().skip(1)).collect::<String>();
+                assert_eq!(layer_text(&app), expected);
+            }
+        }
+    }
+
+    #[test]
+    fn only_a_matching_completion_allows_a_new_composition_in_the_same_raw_batch() {
+        for bytes in [false, true] {
+            let ctx = context();
+            let mut app = app();
+            run(&mut app, &ctx, vec![]);
+            run(&mut app, &ctx, vec![preedit("P")]);
+            let transition = run(&mut app, &ctx, vec![raw_key(egui::Key::A, true, false)]).expect("selection reset");
+            run(
+                &mut app,
+                &ctx,
+                vec![
+                    terminal_delete(bytes),
+                    egui::Event::Ime(egui::ImeEvent::Commit("old".into())),
+                    completed(transition.reset_request.expect("reset request")),
+                    preedit("Q"),
+                    egui::Event::Ime(egui::ImeEvent::Commit("Q".into())),
+                ],
+            );
+            assert_eq!(layer_text(&app), "Q", "the old terminal is rejected before the completion opens admission");
+        }
+    }
+
+    #[test]
+    fn an_actual_same_batch_selection_requires_completion_before_the_new_live_preedit() {
+        for empty in [false, true] {
+            for bytes in [false, true] {
+                for terminal in [false, true] {
+                    let ctx = context();
+                    let mut app = app();
+                    for _ in 0..4 {
+                        actual_app_frame(&mut app, &ctx, vec![]);
+                    }
+                    actual_app_frame(&mut app, &ctx, vec![preedit("P")]);
+                    if empty {
+                        actual_app_frame(&mut app, &ctx, vec![preedit("")]);
+                    }
+                    let before = layer_text(&app);
+                    let revision = app.session.active().unwrap().revision;
+                    let mut events = vec![raw_key(egui::Key::A, true, false), terminal_delete(bytes)];
+                    if terminal {
+                        events.push(egui::Event::Ime(egui::ImeEvent::Commit("old".into())));
+                    }
+                    events.push(preedit("Q"));
+                    let out = actual_app_frame(&mut app, &ctx, events);
+                    assert_eq!(layer_text(&app), before, "all unacknowledged payloads remain stale, even after Commit");
+                    assert_eq!(app.session.active().unwrap().revision, revision);
+                    assert!(matches!(app.type_ime.incoming, Some(IncomingComposition::Stale)));
+                    let selected = app.ui.text_edit.as_ref().unwrap();
+                    assert_eq!((selected.anchor, selected.caret), (0, before.chars().count()), "the actual selection key ran");
+                    let request = out.platform_output.ime.expect("interrupted descriptor").reset_request.expect("reset request");
+                    actual_app_frame(&mut app, &ctx, vec![completed(request), preedit("Q")]);
+                    assert_eq!(layer_text(&app), "Q", "only the new preedit replaced the selected text");
+                    assert_eq!(app.session.active().unwrap().revision, revision + 1, "neither old deletion nor old commit mutated the document");
+                    let editing = app.ui.text_edit.as_ref().unwrap();
+                    assert_eq!((editing.anchor, editing.caret, editing.preedit), (1, 1, Some((0, 1))));
+                    assert!(matches!(app.type_ime.incoming, Some(IncomingComposition::Active(_))));
+                    // Keep Q live across a real idle pass before its separately delivered commit.
+                    let idle = actual_app_frame(&mut app, &ctx, vec![]);
+                    assert!(!idle.platform_output.ime.expect("the live preview keeps its descriptor").should_interrupt_composition);
+                    actual_app_frame(&mut app, &ctx, vec![egui::Event::Ime(egui::ImeEvent::Commit("Q".into()))]);
+                    assert_eq!(layer_text(&app), "Q");
+                    assert!(app.ui.text_edit.as_ref().unwrap().preedit.is_none());
+                    assert!(app.type_ime.incoming.is_none());
+                }
+            }
+        }
+    }
+
+    fn pending(app: &PhotocraftApp) -> Option<egui::ImeResetId> {
+        match app.type_ime.resets.get(&egui::ViewportId::ROOT) {
+            Some(ResetPhase::Awaiting { id, .. }) => Some(*id),
+            _ => None,
+        }
+    }
+
+    fn interrupt_with_selection(app: &mut PhotocraftApp, ctx: &egui::Context) -> egui::ImeResetId {
+        run(app, ctx, vec![preedit("P")]);
+        run(app, ctx, vec![raw_key(egui::Key::A, true, false)]).expect("custom output").reset_request.expect("published reset")
+    }
+
+    #[test]
+    fn newest_published_request_alone_opens_the_ordered_suffix() {
+        let ctx = context();
+        let mut app = app();
+        let first = interrupt_with_selection(&mut app, &ctx);
+        let second = run(&mut app, &ctx, vec![raw_key(egui::Key::ArrowLeft, false, false), completed(first), preedit("old")])
+            .expect("moved selection")
+            .reset_request
+            .expect("replacement request");
+        assert_ne!(first, second);
+        let before = layer_text(&app);
+        let revision = app.session.active().unwrap().revision;
+        let history = app.session.active().unwrap().history.entries().len();
+        run(&mut app, &ctx, vec![terminal_delete(true), completed(first), egui::Event::Ime(egui::ImeEvent::Commit("old".into()))]);
+        assert_eq!(layer_text(&app), before);
+        assert_eq!(app.session.active().unwrap().revision, revision);
+        assert_eq!(app.session.active().unwrap().history.entries().len(), history);
+        assert_eq!(pending(&app), Some(second));
+        let selection = app.ui.text_edit.as_ref().map(|e| (e.anchor, e.caret));
+        run(&mut app, &ctx, vec![completed(second), completed(second)]);
+        assert_eq!(layer_text(&app), before, "controls alone never edit text");
+        assert_eq!(app.ui.text_edit.as_ref().map(|e| (e.anchor, e.caret)), selection);
+        assert_eq!(app.session.active().unwrap().revision, revision);
+        assert_eq!(app.session.active().unwrap().history.entries().len(), history);
+        assert_eq!(pending(&app), None);
+        run(&mut app, &ctx, vec![preedit("が"), egui::Event::Ime(egui::ImeEvent::Commit("が".into()))]);
+        assert!(layer_text(&app).starts_with("が"));
+    }
+
+    #[test]
+    fn foreign_viewport_and_context_completions_cannot_release_root() {
+        let ctx = context();
+        let mut app = app();
+        let root = interrupt_with_selection(&mut app, &ctx);
+        let other = context();
+        let viewport = egui::ViewportId::from_hash_of("photo-reset-foreign");
+        let foreign_input = || {
+            let rect = egui::Rect::from_min_size(Pos2::ZERO, egui::vec2(400.0, 300.0));
+            let mut raw = egui::RawInput { viewport_id: viewport, screen_rect: Some(rect), focused: true, ..Default::default() };
+            raw.viewports.insert(
+                viewport,
+                egui::ViewportInfo { inner_rect: Some(rect), native_pixels_per_point: Some(1.0), minimized: Some(false), ..Default::default() },
+            );
+            raw
+        };
+        let mut text = String::new();
+        let mut output = other.run_ui(foreign_input(), |ui| {
+            ui.add(egui::TextEdit::singleline(&mut text)).request_focus();
+            let _ = ui.ctx().request_ime_reset(viewport);
+        });
+        output.textures_delta.clear();
+        // Draw once more if egui has not yet reported the newly focused stock editor.
+        if output.platform_output.ime.is_none() {
+            output = other.run_ui(foreign_input(), |ui| {
+                ui.add(egui::TextEdit::singleline(&mut text));
+            });
+            output.textures_delta.clear();
+        }
+        let foreign = output.platform_output.ime.expect("foreign stock output").reset_request.expect("foreign published request");
+        assert_ne!(foreign.viewport_id(), root.viewport_id());
+        let before = layer_text(&app);
+        run(&mut app, &ctx, vec![completed(foreign), preedit("bad"), completed(root), preedit("が")]);
+        assert_eq!(layer_text(&app), "が", "foreign marker cannot open admission before the root marker");
+        assert_ne!(layer_text(&app), before);
+    }
+
+    #[test]
+    fn standalone_logic_suspends_once_without_replaying_input_and_return_rearms_once() {
+        use eframe::App as _;
+        let ctx = context();
+        let mut app = app();
+        for _ in 0..4 {
+            actual_app_frame(&mut app, &ctx, vec![]);
+        }
+        actual_app_frame(&mut app, &ctx, vec![preedit("P")]);
+        let first = actual_app_frame(&mut app, &ctx, vec![raw_key(egui::Key::A, true, false)])
+            .platform_output
+            .ime
+            .expect("custom output")
+            .reset_request
+            .expect("first request");
+        let before = layer_text(&app);
+        for _ in 0..3 {
+            let mut frame = eframe::Frame::_new_kittest();
+            let _ = ctx.run_logic(&egui::RawInput { focused: true, ..Default::default() }, |ctx| app.logic(ctx, &mut frame));
+            assert_eq!(layer_text(&app), before, "hidden logic does not replay the previous raw selection batch");
+            assert_eq!(pending(&app), None);
+            assert!(matches!(app.type_ime.resets.get(&egui::ViewportId::ROOT), Some(ResetPhase::Suspended)));
+        }
+        let second = actual_app_frame(&mut app, &ctx, vec![completed(first), preedit("bad")])
+            .platform_output
+            .ime
+            .expect("returned custom output")
+            .reset_request
+            .expect("fresh request after hidden logic");
+        assert_ne!(first, second);
+        assert_eq!(layer_text(&app), before);
+        for _ in 0..3 {
+            let idle = actual_app_frame(&mut app, &ctx, vec![]).platform_output.ime.expect("idle custom output");
+            assert_eq!(idle.reset_request, None, "logic inside a full UI pass cannot suspend and rearm the stable guard");
+            assert_eq!(pending(&app), Some(second));
+        }
+        actual_app_frame(&mut app, &ctx, vec![completed(second), preedit("が"), egui::Event::Ime(egui::ImeEvent::Commit("が".into()))]);
+        assert_eq!(layer_text(&app), "が");
+    }
+
+    #[test]
+    fn standalone_logic_does_not_guard_an_uninterrupted_terminal_pending_composition() {
+        use eframe::App as _;
+        let ctx = context();
+        let mut app = app();
+        for _ in 0..4 {
+            actual_app_frame(&mut app, &ctx, vec![]);
+        }
+        actual_app_frame(&mut app, &ctx, vec![preedit("P"), preedit("")]);
+        let mut frame = eframe::Frame::_new_kittest();
+        let _ = ctx.run_logic(&egui::RawInput { focused: true, ..Default::default() }, |ctx| app.logic(ctx, &mut frame));
+        assert!(app.type_ime.resets.is_empty());
+        assert!(matches!(app.type_ime.incoming, Some(IncomingComposition::TerminalPending(_))));
+        actual_app_frame(&mut app, &ctx, vec![terminal_delete(false), egui::Event::Ime(egui::ImeEvent::Commit("X".into()))]);
+        assert_eq!(layer_text(&app), "abX");
+    }
+
+    #[test]
+    fn fonts_not_ready_and_no_editor_early_returns_retire_the_old_request() {
+        use eframe::App as _;
+        for no_editor in [false, true] {
+            let ctx = context();
+            let mut app = app();
+            for _ in 0..4 {
+                actual_app_frame(&mut app, &ctx, vec![]);
+            }
+            actual_app_frame(&mut app, &ctx, vec![preedit("P")]);
+            let first = actual_app_frame(&mut app, &ctx, vec![raw_key(egui::Key::A, true, false)])
+                .platform_output
+                .ime
+                .expect("custom output")
+                .reset_request
+                .expect("first request");
+            let editor = app.ui.text_edit.clone();
+            let before = layer_text(&app);
+            let mut frame = eframe::Frame::_new_kittest();
+            let mut output = ctx.run_ui(egui::RawInput { focused: true, events: vec![completed(first), preedit("bad")], ..Default::default() }, |ui| {
+                if no_editor {
+                    app.ui.text_edit = None;
+                } else {
+                    app.fonts_ready = false;
+                }
+                app.ui(ui, &mut frame);
+            });
+            output.textures_delta.clear();
+            assert!(output.platform_output.ime.is_none());
+            assert_eq!(pending(&app), None);
+            app.ui.text_edit = editor;
+            app.fonts_ready = true;
+            let second = actual_app_frame(&mut app, &ctx, vec![completed(first), preedit("bad")])
+                .platform_output
+                .ime
+                .expect("same editor returned")
+                .reset_request
+                .expect("rearmed request");
+            assert_ne!(first, second);
+            assert_eq!(layer_text(&app), before);
+            actual_app_frame(&mut app, &ctx, vec![completed(second), preedit("が")]);
+            assert_eq!(layer_text(&app), "が");
+        }
+    }
+
+    #[test]
+    fn pointer_deferred_suffix_cannot_edit_the_old_caret_or_complete_its_old_request() {
+        let ctx = context();
+        let mut app = app();
+        for _ in 0..4 {
+            actual_app_frame(&mut app, &ctx, vec![]);
+        }
+        app.ui.text_edit.as_mut().unwrap().caret = 1;
+        app.ui.text_edit.as_mut().unwrap().anchor = 1;
+        let point = actual_app_frame(&mut app, &ctx, vec![]).platform_output.ime.expect("caret geometry").cursor_rect.center();
+        app.ui.text_edit.as_mut().unwrap().caret = 3;
+        app.ui.text_edit.as_mut().unwrap().anchor = 3;
+        actual_app_frame(&mut app, &ctx, vec![preedit("P")]);
+        let first = actual_app_frame(&mut app, &ctx, vec![raw_key(egui::Key::A, true, false)])
+            .platform_output
+            .ime
+            .expect("selection output")
+            .reset_request
+            .expect("first request");
+        let before = layer_text(&app);
+        let revision = app.session.active().unwrap().revision;
+        let event = |pressed| egui::Event::PointerButton { pos: point, button: egui::PointerButton::Primary, pressed, modifiers: Default::default() };
+        let out = actual_app_frame(
+            &mut app,
+            &ctx,
+            vec![
+                egui::Event::PointerMoved(point),
+                event(true),
+                completed(first),
+                egui::Event::Text("bad".into()),
+                egui::Event::Paste("bad".into()),
+                egui::Event::Cut,
+                preedit("bad"),
+            ],
+        );
+        let first_after_pointer = out.platform_output.ime.expect("pointer output").reset_request;
+        let out = actual_app_frame(&mut app, &ctx, vec![event(false)]);
+        let second = out.platform_output.ime.expect("release output").reset_request.or(first_after_pointer).expect("actual pointer destination reset");
+        assert_ne!(first, second);
+        assert_eq!(layer_text(&app), before);
+        assert_eq!(app.session.active().unwrap().revision, revision);
+        assert_eq!(app.ui.text_edit.as_ref().unwrap().caret, 1);
+        actual_app_frame(&mut app, &ctx, vec![completed(second), preedit("が")]);
+        assert!(layer_text(&app).contains("が"));
+    }
+
+    #[test]
+    fn completion_without_current_geometry_is_suspended_before_the_following_preedit() {
+        let ctx = context();
+        let mut app = app();
+        let first = interrupt_with_selection(&mut app, &ctx);
+        let before = layer_text(&app);
+        // No canvas view for this input batch: the completion cannot be attributed to a visible
+        // custom descriptor yet. This is the pre-descriptor check, not a wait on final output.
+        app.type_ime.view = None;
+        let output = run(&mut app, &ctx, vec![completed(first), preedit("bad")]).expect("custom output");
+        let second = output.reset_request.expect("the final custom output rearms");
+        assert_ne!(first, second);
+        assert_eq!(layer_text(&app), before, "the preedit after a geometry-less completion stays blocked");
+        assert!(matches!(app.type_ime.resets.get(&egui::ViewportId::ROOT), Some(ResetPhase::Awaiting { id, .. }) if *id == second));
+        run(&mut app, &ctx, vec![completed(second), preedit("が")]);
+        assert_eq!(layer_text(&app), "が");
+    }
+
+    #[test]
+    fn pointer_press_without_a_guard_defers_the_same_batch_custom_suffix() {
+        let ctx = context();
+        let mut app = app();
+        let before = layer_text(&app);
+        let revision = app.session.active().unwrap().revision;
+        let selection = app.ui.text_edit.as_ref().map(|ed| (ed.anchor, ed.caret));
+        let press =
+            egui::Event::PointerButton { pos: Pos2::new(20.0, 20.0), button: egui::PointerButton::Primary, pressed: true, modifiers: Default::default() };
+        let output = run(
+            &mut app,
+            &ctx,
+            vec![
+                egui::Event::PointerMoved(Pos2::new(20.0, 20.0)),
+                press,
+                egui::Event::Text("bad".into()),
+                egui::Event::Paste("bad".into()),
+                egui::Event::Cut,
+                preedit("bad"),
+            ],
+        )
+        .expect("descriptor");
+        assert_eq!(layer_text(&app), before, "the deferred canvas handler never lets a suffix edit the old caret");
+        assert_eq!(app.session.active().unwrap().revision, revision);
+        assert_eq!(app.ui.text_edit.as_ref().map(|ed| (ed.anchor, ed.caret)), selection);
+        assert_eq!(output.reset_request, None, "no prior guard means no speculative reset yet");
+    }
+
+    #[test]
+    fn synchronous_select_all_accepts_fresh_text_but_still_blocks_stale_ime() {
+        let ctx = context();
+        // With no guard, the synchronously selected destination is a real destination: Text is
+        // an application edit, not an old IME suffix.
+        let mut app = app();
+        run(&mut app, &ctx, vec![raw_key(egui::Key::A, true, false), egui::Event::Text("x".into())]);
+        assert_eq!(layer_text(&app), "x");
+
+        // The same holds when Cmd+A interrupted a known composition: Text is still fresh input.
+        let mut app = self::app();
+        run(&mut app, &ctx, vec![preedit("P")]);
+        let out = run(&mut app, &ctx, vec![raw_key(egui::Key::A, true, false), egui::Event::Text("x".into())]).expect("custom output");
+        assert_eq!(layer_text(&app), "x");
+        assert!(out.reset_request.is_some(), "the stale composition still needs its ordered reset");
+
+        // An IME payload in that same batch is not fresh Text: it remains blocked until its
+        // replacement request is actually completed.
+        let mut app = self::app();
+        run(&mut app, &ctx, vec![preedit("P")]);
+        let before = layer_text(&app);
+        let out = run(&mut app, &ctx, vec![raw_key(egui::Key::A, true, false), preedit("bad")]).expect("custom output");
+        assert_eq!(layer_text(&app), before);
+        let request = out.reset_request.expect("selection reset request");
+        run(&mut app, &ctx, vec![completed(request), preedit("が")]);
+        assert_eq!(layer_text(&app), "が");
+    }
+
+    struct ResetHarness {
+        app: PhotocraftApp,
+        stock: bool,
+        picker_button: bool,
+        search: String,
+        search_input: Option<egui::Id>,
+        search_focused: bool,
+        search_height: Option<f32>,
+    }
+
+    fn reset_harness(app: PhotocraftApp) -> egui_kittest::Harness<'static, ResetHarness> {
+        let mut h = egui_kittest::Harness::builder()
+            .with_size(egui::vec2(1200.0, 800.0))
+            .with_context_setup(|ctx| {
+                install_reset_hooks(ctx);
+                crate::theme::install_fonts(ctx);
+            })
+            .build_ui_state(
+                |ui, state: &mut ResetHarness| {
+                    let mut frame = eframe::Frame::_new_kittest();
+                    state.app.logic_frame(ui.ctx(), &mut frame);
+                    state.app.ui_frame(ui, &mut frame);
+                    if state.stock {
+                        egui::Window::new("Reset font fixture").show(ui.ctx(), |ui| {
+                            let button = ui.make_persistent_id(egui::IdSalt::new("reset-font"));
+                            egui::Popup::open_id(ui.ctx(), button.with("popup"));
+                            let mut current = "Family 00".to_owned();
+                            family_picker_in(
+                                ui,
+                                "reset-font",
+                                &mut current,
+                                170.0,
+                                &["Family 00".into(), "Family 01".into()],
+                                photocraft_engine::prefs::FontPreview::Medium,
+                                &[],
+                            );
+                            let search = ui.scope_id().with(("font-search", "reset-font"));
+                            state.search = ui.data(|d| d.get_temp::<String>(search)).unwrap_or_default();
+                            let input = search.with("input");
+                            state.search_input = Some(input);
+                            state.search_focused = ui.memory(|m| m.has_focus(input));
+                            state.search_height = ui.data(|d| d.get_temp::<f32>(search.with("height")));
+                        });
+                    }
+                    if state.picker_button {
+                        egui::Window::new("Reset screen fixture").show(ui.ctx(), |ui| {
+                            crate::screen_picker::button(ui, egui::Id::unique("reset-screen"));
+                        });
+                    }
+                    state.app.finish_type_reset_pass(ui.ctx());
+                },
+                ResetHarness { app, stock: false, picker_button: false, search: String::new(), search_input: None, search_focused: false, search_height: None },
+            );
+        h.run_steps(4);
+        h
+    }
+
+    fn harness_request(h: &egui_kittest::Harness<'_, ResetHarness>) -> egui::ImeResetId {
+        h.output().platform_output.ime.as_ref().expect("actual harness output").reset_request.expect("published harness reset")
+    }
+
+    #[test]
+    fn actual_font_search_owns_stock_input_without_a_speculative_custom_request() {
+        let mut h = reset_harness(app());
+        h.event(preedit("P"));
+        h.step();
+        h.event(raw_key(egui::Key::A, true, false));
+        h.step();
+        let first = harness_request(&h);
+        let before = layer_text(&h.state().app);
+        let custom_owner = h.output().platform_output.ime.as_ref().unwrap().owner;
+        h.state_mut().stock = true;
+        h.run_steps(3);
+        let stock_owner = h.output().platform_output.ime.as_ref().expect("real font search descriptor").owner;
+        assert_ne!(stock_owner, custom_owner);
+        let search_input = h.state().search_input.expect("font search field id");
+        assert!(h.state().search_focused, "the real font search field, not another stock field, owns focus");
+        assert_eq!(h.ctx.memory(|m| m.focused()), Some(search_input), "the stock IME owner is the focused font search input");
+        assert!(
+            h.state().search_height.is_some_and(|height| height > 0.0 && height <= FONT_MENU_HEIGHT),
+            "the real font list measured within its bounded popup height"
+        );
+        h.input_mut().events = vec![completed(first), egui::Event::Text("Family".into())];
+        h.step();
+        assert_eq!(h.state().search, "Family", "the actual font picker keeps its text event");
+        assert_eq!(layer_text(&h.state().app), before);
+        assert_eq!(pending(&h.state().app), None);
+        let stock = h.output().platform_output.ime.as_ref().expect("stock output survives finalization");
+        assert_eq!(stock.owner, stock_owner);
+        assert_eq!(stock.reset_request, None, "an already-ineligible route cannot allocate a custom request");
+        h.state_mut().stock = false;
+        egui::Popup::close_all(&h.ctx);
+        h.ctx.memory_mut(|m| m.stop_text_input());
+        h.input_mut().events = vec![completed(first), preedit("bad")];
+        h.step();
+        let second = harness_request(&h);
+        assert_ne!(first, second);
+        assert_eq!(layer_text(&h.state().app), before);
+        h.step();
+        assert_eq!(h.output().platform_output.ime.as_ref().unwrap().reset_request, None);
+        h.input_mut().events = vec![completed(second), preedit("が")];
+        h.step();
+        assert_eq!(layer_text(&h.state().app), "が");
+    }
+
+    type ImmediateViewportRecord = (egui::ViewportId, egui::ViewportId, Option<egui::Vec2>, Option<bool>);
+
+    fn record_immediate_viewports() -> Arc<std::sync::Mutex<Vec<ImmediateViewportRecord>>> {
+        let seen = Arc::new(std::sync::Mutex::new(Vec::new()));
+        let recorded = seen.clone();
+        egui::Context::set_immediate_viewport_renderer(move |ctx, immediate| {
+            let ids = immediate.ids;
+            if let Ok(mut seen) = recorded.lock() {
+                seen.push((ids.this, ids.parent, immediate.builder.inner_size, immediate.builder.visible));
+            }
+            let mut callback = immediate.viewport_ui_cb;
+            let mut output = ctx.run_ui(
+                egui::RawInput {
+                    viewport_id: ids.this,
+                    viewports: std::iter::once((ids.this, egui::ViewportInfo::default())).collect(),
+                    screen_rect: Some(egui::Rect::from_min_size(Pos2::ZERO, egui::vec2(2.0, 2.0))),
+                    ..Default::default()
+                },
+                |ui| callback(ui),
+            );
+            output.textures_delta.clear();
+        });
+        seen
+    }
+
+    #[test]
+    fn actual_screen_picker_modal_retires_the_type_fence_and_return_rearms_it() {
+        use egui_kittest::kittest::Queryable as _;
+        let mut app = app();
+        app.services.screen_pick = Some(Box::new(|_| {
+            let (sender, receiver) = std::sync::mpsc::channel();
+            sender
+                .send(Ok(crate::screen_picker::Capture::Images(vec![crate::screen_picker::ScreenImage {
+                    monitor: None,
+                    position: Pos2::ZERO,
+                    size: egui::vec2(2.0, 2.0),
+                    width: 2,
+                    height: 2,
+                    rgba: vec![0; 16],
+                    profile: None,
+                }])))
+                .unwrap();
+            crate::screen_picker::Pending { receiver, cancelled: Arc::new(std::sync::atomic::AtomicBool::new(false)) }
+        }));
+        let mut h = reset_harness(app);
+        h.event(preedit("P"));
+        h.step();
+        h.event(raw_key(egui::Key::A, true, false));
+        h.step();
+        let first = harness_request(&h);
+        let before = layer_text(&h.state().app);
+        let immediate = record_immediate_viewports();
+        h.ctx.set_embed_viewports(false);
+        h.state_mut().picker_button = true;
+        h.run_steps(2);
+        h.get_by_label("Pick screen color").click();
+        h.run_steps(3);
+        assert!(crate::screen_picker::busy(&h.ctx));
+        assert!(crate::screen_picker::showing(&h.ctx), "the actual UI takes its screen-picker modal early return");
+        let seen = immediate.lock().expect("recorded viewports");
+        assert!(!seen.is_empty(), "the native immediate-viewport renderer received the picker");
+        assert!(
+            seen.iter().all(|(child, parent, size, visible)| *child != egui::ViewportId::ROOT
+                && *parent == egui::ViewportId::ROOT
+                && *size == Some(egui::vec2(2.0, 2.0))
+                && *visible == Some(false)),
+            "each picker viewport is a hidden 2x2 child of the root"
+        );
+        drop(seen);
+        h.input_mut().events = vec![completed(first), preedit("bad")];
+        h.step();
+        assert!(h.output().platform_output.ime.is_none());
+        assert_eq!(pending(&h.state().app), None);
+        assert_eq!(layer_text(&h.state().app), before);
+        crate::screen_picker::cancel(&h.ctx);
+        h.state_mut().picker_button = false;
+        h.ctx.memory_mut(|m| m.stop_text_input());
+        h.input_mut().events = vec![completed(first), preedit("bad")];
+        h.step();
+        let second = harness_request(&h);
+        assert_ne!(first, second);
+        assert_eq!(layer_text(&h.state().app), before);
+        h.input_mut().events = vec![completed(second), preedit("が")];
+        h.step();
+        assert_eq!(layer_text(&h.state().app), "が");
+    }
+
+    #[test]
+    fn a_discarded_custom_output_allocates_no_new_id_and_final_absence_retires_then_rearms() {
+        let ctx = context();
+        ctx.options_mut(|o| o.max_passes = std::num::NonZeroUsize::new(4).unwrap());
+        let mut app = app();
+        // A prior queued R1 is deliberately present: the discard must preserve it, not allocate
+        // a speculative replacement for output egui will throw away.
+        let first = interrupt_with_selection(&mut app, &ctx);
+        let mut passes = 0;
+        let mut discarded_pending = None;
+        let mut output = ctx.run_ui(egui::RawInput { focused: true, ..Default::default() }, |ui| {
+            handle_keys(&mut app, ui.ctx());
+            if passes == 0 {
+                let xf = ViewXform {
+                    rect: egui::Rect::from_min_size(Pos2::ZERO, egui::vec2(400.0, 300.0)),
+                    zoom: 1.0,
+                    center: [100.0, 100.0],
+                    flip: false,
+                    rotation: 0.0,
+                    aspect: 1.0,
+                };
+                draw_overlay(&mut app, ui.painter(), &xf);
+                ui.ctx().request_discard("reset custom output disappears on final pass");
+            }
+            sync_ime(&mut app, ui.ctx());
+            finish_reset_pass(&mut app, ui.ctx());
+            if passes == 0 {
+                discarded_pending = pending(&app);
+            }
+            passes += 1;
+        });
+        output.textures_delta.clear();
+        assert!(passes > 1);
+        assert!(output.platform_output.ime.is_none());
+        assert_eq!(discarded_pending, Some(first), "discard keeps the queued R1 and allocates no NEW id");
+        assert_eq!(pending(&app), None, "the final ineligible pass retires the prior R1");
+        let before = layer_text(&app);
+        let returned = run(&mut app, &ctx, vec![completed(first), preedit("bad")]).expect("same model returns");
+        let second = returned.reset_request.expect("new published request");
+        assert_ne!(first, second);
+        assert_eq!(layer_text(&app), before);
+        run(&mut app, &ctx, vec![completed(second), preedit("が")]);
+        assert_eq!(layer_text(&app), "が");
+    }
+
+    #[test]
+    fn a_recreated_context_installed_before_run_ui_rejects_the_old_completion_and_rearms() {
+        use eframe::App as _;
+        let old = context();
+        let mut app = app();
+        for _ in 0..4 {
+            actual_app_frame(&mut app, &old, vec![]);
+        }
+        let first = interrupt_with_selection(&mut app, &old);
+        let before = layer_text(&app);
+        // The host replaces its Context and must run the same supported setup before `run_ui`;
+        // a begin-pass hook registered later could not mark the first pass.
+        let next = egui::Context::default();
+        PhotocraftApp::setup_context(&next, app.ui.theme);
+        let mut frame = eframe::Frame::_new_kittest();
+        let mut saw_ui_pass = false;
+        let mut output = next.run_ui(
+            egui::RawInput {
+                focused: true,
+                events: vec![completed(first), preedit("bad")],
+                screen_rect: Some(egui::Rect::from_min_size(Pos2::ZERO, egui::vec2(1200.0, 800.0))),
+                ..Default::default()
+            },
+            |ui| {
+                app.logic(ui.ctx(), &mut frame);
+                saw_ui_pass = in_ui_pass(ui.ctx());
+                app.ui(ui, &mut frame);
+            },
+        );
+        output.textures_delta.clear();
+        assert!(saw_ui_pass, "the supported creator setup marks the first replacement Context pass");
+        let second = output.platform_output.ime.expect("replacement Context custom output").reset_request.expect("replacement Context request");
+        assert_ne!(first, second);
+        assert_eq!(layer_text(&app), before);
+        run(&mut app, &next, vec![completed(second), preedit("が")]);
+        assert_eq!(layer_text(&app), "が");
+    }
+
+    #[test]
+    fn type_mask_and_same_owner_session_replacement_supersede_the_full_request() {
+        for mask in [false, true] {
+            let ctx = context();
+            let mut app = app();
+            let first = interrupt_with_selection(&mut app, &ctx);
+            let original = run(&mut app, &ctx, vec![]).expect("original context");
+            if mask {
+                app.ui.text_edit.as_mut().unwrap().mask = true;
+            } else {
+                app.ui.text_edit.as_mut().unwrap().session = "replacement-reset-session".into();
+            }
+            let before = layer_text(&app);
+            let changed = run(&mut app, &ctx, vec![completed(first), preedit("bad")]).expect("replacement output");
+            let second = changed.reset_request.expect("replacement request");
+            assert_ne!(first, second);
+            if mask {
+                assert_ne!(changed.owner, original.owner);
+            } else {
+                assert_eq!(changed.owner, original.owner);
+            }
+            assert_ne!(changed.context_generation, original.context_generation);
+            assert_eq!(layer_text(&app), before);
+            run(&mut app, &ctx, vec![completed(first), terminal_delete(false), egui::Event::Ime(egui::ImeEvent::Commit("bad".into()))]);
+            assert_eq!(layer_text(&app), before);
+            run(&mut app, &ctx, vec![completed(second), preedit("が")]);
+            assert_eq!(layer_text(&app), "が");
+        }
+    }
+
+    #[test]
+    fn document_replacement_cannot_reuse_the_previous_documents_reset() {
+        let ctx = context();
+        let mut app = app();
+        let first = interrupt_with_selection(&mut app, &ctx);
+        let old_document = active_doc_id(&app);
+        app.run("file.new", json!({"width": 400, "height": 200})).unwrap();
+        app.sync_views();
+        // The host runs this before handling input: a new active document ends the old edit in
+        // its own document, so the next canvas click starts an editor for the new one.
+        end_if_left(&mut app);
+        assert!(app.ui.text_edit.is_none(), "the new document starts without the previous edit target");
+        app.ui.tool = crate::state::Tool::Type;
+        pointer_up(&mut app, [50.0, 100.0], [50.0, 100.0]);
+        insert(&mut app, "new");
+        assert_ne!(active_doc_id(&app), old_document);
+        let before = layer_text(&app);
+        let changed = run(&mut app, &ctx, vec![completed(first), preedit("bad")]).expect("new document output");
+        let second = changed.reset_request.expect("new document reset");
+        assert_ne!(first, second);
+        assert_eq!(layer_text(&app), before);
+        run(&mut app, &ctx, vec![completed(second), preedit("が")]);
+        assert!(layer_text(&app).contains("が"));
+    }
+}
diff --git a/crates/ui-egui/src/type_tool_tests.rs b/crates/ui-egui/src/type_tool_tests.rs
index bbb0d0679c..cf0aeb4970 100644
--- a/crates/ui-egui/src/type_tool_tests.rs
+++ b/crates/ui-egui/src/type_tool_tests.rs
@@ -32,9 +32,10 @@ fn focused_font_search_does_not_type_into_the_canvas_layer() {
     });
     let mut h = Harness::builder().build_ui_state(
         |ui, app: &mut PhotocraftApp| {
-            let search_id = egui::Id::new("font-search-regression");
+            let search_id = egui::Id::unique("font-search-regression");
             let mut query = ui.data(|d| d.get_temp::<String>(search_id)).unwrap_or_default();
-            ui.add(egui::TextEdit::singleline(&mut query).id(search_id)).request_focus();
+            // Match the production font-search field: its hint is the field's accessible name.
+            ui.add(egui::TextEdit::singleline(&mut query).id(search_id).hint_text("Search fonts")).request_focus();
             ui.data_mut(|d| d.insert_temp(search_id, query));
             super::handle_keys(app, ui.ctx());
         },
@@ -43,7 +44,7 @@ fn focused_font_search_does_not_type_into_the_canvas_layer() {
     h.run_steps(2);
     h.event(egui::Event::Text("Ins".into()));
     h.run();
-    assert_eq!(h.ctx.data(|d| d.get_temp::<String>(egui::Id::new("font-search-regression"))).as_deref(), Some("Ins"));
+    assert_eq!(h.ctx.data(|d| d.get_temp::<String>(egui::Id::unique("font-search-regression"))).as_deref(), Some("Ins"));
     assert_eq!(super::current_text(h.state_mut(), LayerId(id)).as_deref(), Some("Sample"));
 }
 
@@ -703,7 +704,7 @@ fn options_harness(app: PhotocraftApp) -> Harness<'static, PhotocraftApp> {
 
 /// Drags the options bar's "T" icon `dx` points to the right with `mods` held.
 fn scrub_size_icon(h: &mut Harness<'static, PhotocraftApp>, dx: f32, mods: Modifiers) {
-    let icon = h.get_by_label("Font size").rect().center();
+    let icon = h.get_by_role_and_label(egui::accesskit::Role::Label, "Font size").rect().center();
     h.hover_at(icon);
     h.run_steps(1);
     press(h, icon, true);
@@ -773,8 +774,8 @@ fn options_bar_t_icon_scrub_stops_at_the_size_limits() {
 
 /// Rests the pointer on the widget named `label` past the tooltip delay; true when its tooltip
 /// (a second node with the same name) shows.
-fn tooltip_shows(h: &mut Harness<'static, PhotocraftApp>, label: &str) -> bool {
-    let at = h.get_by_label(label).rect().center();
+fn tooltip_shows(h: &mut Harness<'static, PhotocraftApp>, role: egui::accesskit::Role, label: &str) -> bool {
+    let at = h.get_by_role_and_label(role, label).rect().center();
     h.hover_at(at);
     h.run_steps(8);
     h.query_all_by_label(label).count() == 2
@@ -787,10 +788,10 @@ fn options_bar_t_icon_shows_its_tooltip() {
     let mut app = new_app();
     app.run("type.create", json!({"text": "Hello", "size": 20, "x": 300, "y": 420})).unwrap();
     let mut h = options_harness(app);
-    assert!(tooltip_shows(&mut h, "Set the text color"), "the probe sees an ordinary tooltip");
+    assert!(tooltip_shows(&mut h, egui::accesskit::Role::Button, "Set the text color"), "the probe sees an ordinary tooltip");
     h.hover_at(egui::pos2(890.0, 55.0));
     h.run_steps(4);
-    assert!(tooltip_shows(&mut h, "Font size"), "hovering the \"T\" icon shows \"Font size\"");
+    assert!(tooltip_shows(&mut h, egui::accesskit::Role::Label, "Font size"), "hovering the \"T\" icon shows \"Font size\"");
 }
 
 /// A point inside glyph `i` of vertical type: `f` of the way down its advance, right of the
@@ -1585,18 +1586,23 @@ fn temporary_type_transform_preserves_paragraph_resize_pivot_ime_and_shortcuts()
     h.key_press_modifiers(Modifiers::COMMAND, egui::Key::A);
     h.run_steps(2);
     assert_eq!(selection(&h), (0, after.text.chars().count()));
-    h.event(egui::Event::Ime(egui::ImeEvent::Preedit { text: "候補".into(), active_range_chars: None }));
-    h.run_steps(2);
     let f = crate::type_transform::frame(h.state_mut()).unwrap();
     let a = f.quad[2];
     tool_event(h.state_mut(), ToolEvent::Down { x: a[0], y: a[1], pressure: 1.0 }, type_command());
     tool_event(h.state_mut(), ToolEvent::Up { x: a[0] + 20.0, y: a[1] + 10.0 }, type_command());
+    // Complete the application edit before starting this composition: a completed transform
+    // changes the document revision and must cancel an older composition through the reset guard.
+    h.run_steps(2);
+    h.event(egui::Event::Ime(egui::ImeEvent::Preedit { text: "候補".into(), active_range_chars: None }));
+    h.run_steps(2);
     assert_eq!(h.state().ui.text_edit.as_ref().unwrap().preedit, Some((0, 2)));
     let f = crate::type_transform::frame(h.state_mut()).unwrap();
     let a = f.quad[2];
     tool_event(h.state_mut(), ToolEvent::Down { x: a[0], y: a[1], pressure: 1.0 }, type_command());
     tool_event(h.state_mut(), ToolEvent::Move { x: a[0] + 15.0, y: a[1] + 10.0, pressure: 1.0 }, type_command());
     let composed_transform = crate::type_transform::current_transform(h.state(), id).unwrap();
+    // A pending transform has not changed the revision yet. Keep the real raw-input route so
+    // the accepted commit must finish that transform before replacing its current preedit.
     h.event(egui::Event::Ime(egui::ImeEvent::Commit("確定".into())));
     h.run_steps(2);
     assert_eq!(text(h.state(), id).text, "確定");
@@ -1914,7 +1920,10 @@ mod multi_layer_formatting {
     }
 
     fn controls(app: PhotocraftApp, properties: bool) -> Harness<'static, PhotocraftApp> {
-        let mut h = Harness::builder().with_size(vec2(1100.0, 800.0)).build_ui_state(
+        // The lazily populated font popup introduces widgets in successive passes. egui 0.37
+        // styles each new widget on its following pass; keep a bounded settle assertion while
+        // allowing those additional passes (the loaded menu requires six under parallel tests).
+        let mut h = Harness::builder().with_size(vec2(1100.0, 800.0)).with_max_steps(8).build_ui_state(
             move |ui, app| {
                 if ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
                     if properties {
@@ -2080,8 +2089,9 @@ mod multi_layer_formatting {
         PhotocraftApp::setup_context(&h.ctx, Default::default());
         h.run_steps(4);
         h.get_all_by_role(Role::ComboBox).next().unwrap().click();
-        h.run();
-        h.run();
+        // The font menu's search caret repaints every pass; step a bounded number of times.
+        h.run_steps(2);
+        h.run_steps(2);
     }
 
     #[test]
@@ -2301,7 +2311,8 @@ mod multi_layer_formatting {
             );
             PhotocraftApp::setup_context(&h.ctx, Default::default());
             h.run_steps(4);
-            assert!(h.query_by_label("Bend").is_some(), "the actual Warp form is visible");
+            h.get_by_role_and_label(egui::accesskit::Role::SpinButton, "Bend");
+            assert!(h.query_all_by_label("Bend").count() >= 1, "the actual Warp form is visible");
             for label in ["Layer", "Layers", "Range", "Coalesce"] {
                 assert!(h.query_by_label(label).is_none(), "target metadata must not become a form field: {label}");
             }
@@ -3118,3 +3129,80 @@ fn alt_mirrors_side_and_corner_drags_and_clamps_at_the_minimum() {
     drag(&mut app, [540.0, 480.0], [590.0, 530.0], Modifiers::ALT);
     assert_eq!(box_doc_rect(&app, id), [250.0, 250.0, 340.0, 280.0]);
 }
+
+/// The options bar's alignment and direction buttons show the type layer's paragraph, as
+/// Photoshop's bar follows the text, and the tool defaults again without a type target.
+#[test]
+fn options_bar_alignment_follows_the_target_paragraph() {
+    use egui::accesskit::Toggled;
+    use egui_kittest::kittest::NodeT;
+    let mut app = new_app();
+    let id = app.run("type.create", json!({"text": "Middle", "size": 20, "x": 300, "y": 420})).unwrap()["layer"].as_u64().unwrap();
+    app.run("type.setStyle", json!({"layer": id, "align": "center", "direction": "rtl"})).unwrap();
+    assert_eq!(app.ui.tool_options.type_align, "left", "the tool default stays Left");
+    let mut h = options_harness(app);
+    let on = |h: &Harness<'static, PhotocraftApp>, label: &str| h.get_by_label(label).accesskit_node().toggled() == Some(Toggled::True);
+    assert!(on(&h, "Center text") && !on(&h, "Left align text"), "the layer's centred paragraph");
+    assert!(on(&h, "Right-to-left paragraph direction") && !on(&h, "Automatic paragraph direction"));
+    h.state_mut().run("layer.new.layer", json!({})).unwrap();
+    h.run_steps(2);
+    assert!(on(&h, "Left align text") && !on(&h, "Center text"), "no type target: the tool default");
+}
+
+/// #9179 review: a text edit left in a background document shows its own paragraph, not that of
+/// a same-id layer in the active document (layer ids repeat across documents).
+#[test]
+fn styles_at_follows_the_text_edit_document() {
+    let mut app = new_app();
+    let a = app.session.active().unwrap().doc.id.0;
+    let id = app.run("type.create", json!({"text": "Edited", "size": 20, "x": 300, "y": 420})).unwrap()["layer"].as_u64().unwrap();
+    app.run("type.setStyle", json!({"layer": id, "align": "center"})).unwrap();
+    app.ui.text_edit = Some(crate::state::TextEdit {
+        layer: id,
+        document: Some(a),
+        caret: 2,
+        anchor: 2,
+        session: "s".into(),
+        created: false,
+        mask: false,
+        dragging: false,
+        resize: None,
+        preedit: None,
+    });
+    // The same file opened twice: a second document whose layers have the same ids.
+    let twin = app.session.active().unwrap().doc.as_ref().clone();
+    app.session.open_document(twin, None);
+    app.run("type.setStyle", json!({"layer": id, "align": "right"})).unwrap();
+    assert_ne!(app.session.active().unwrap().doc.id.0, a, "the other document is active");
+    let (_, p) = super::styles_at(&app).unwrap();
+    assert_eq!(p.align, photocraft_doc::text::TextAlign::Center, "the edited document's paragraph");
+}
+
+/// A collapsed caret shows the paragraph it is in, as Photoshop's options bar and Paragraph panel
+/// do; it read the first paragraph's (byte 0) wherever the caret was.
+#[test]
+fn styles_at_a_collapsed_caret_shows_the_caret_s_paragraph() {
+    let mut app = new_app();
+    let id = app.run("type.create", json!({"text": "First\rSecond", "size": 20, "x": 300, "y": 420})).unwrap()["layer"].as_u64().unwrap();
+    app.run("type.setStyle", json!({"layer": id, "range": [6, 12], "align": "right"})).unwrap();
+    let edit = |caret: usize| crate::state::TextEdit {
+        layer: id,
+        document: None,
+        caret,
+        anchor: caret,
+        session: "s".into(),
+        created: false,
+        mask: false,
+        dragging: false,
+        resize: None,
+        preedit: None,
+    };
+    use photocraft_doc::text::TextAlign;
+    for (caret, want) in
+        [(0, TextAlign::Left), (3, TextAlign::Left), (5, TextAlign::Left), (6, TextAlign::Right), (9, TextAlign::Right), (12, TextAlign::Right)]
+    {
+        app.ui.text_edit = Some(edit(caret));
+        let (_, p) = super::styles_at(&app).unwrap();
+        assert_eq!(p.align, want, "caret {caret}");
+    }
+}
diff --git a/crates/ui-egui/src/type_transform.rs b/crates/ui-egui/src/type_transform.rs
index e388eef848..5c8a148eea 100644
--- a/crates/ui-egui/src/type_transform.rs
+++ b/crates/ui-egui/src/type_transform.rs
@@ -423,7 +423,7 @@ pub(crate) fn draw_box(painter: &egui::Painter, xf: &ViewXform, t: &TransformSes
 
 pub(crate) fn rotation_cursor(ctx: &egui::Context, p: Pos2) {
     let tokens = crate::theme::Tokens::get(ctx);
-    let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("type-rotate-cursor")));
+    let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("type-rotate-cursor")));
     let first = -std::f32::consts::FRAC_PI_4;
     let last = std::f32::consts::PI + std::f32::consts::FRAC_PI_4;
     let points: Vec<Pos2> = (0..=24)
@@ -469,7 +469,7 @@ pub(crate) fn cursor(app: &mut PhotocraftApp, ctx: &egui::Context, xf: &ViewXfor
         Some(Hit::Edge(_)) => {
             // Original arrowhead indicator, above the canvas, without a proprietary cursor asset.
             let tokens = crate::theme::Tokens::get(ctx);
-            let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("type-skew-cursor")));
+            let painter = ctx.layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::unique("type-skew-cursor")));
             painter.add(egui::Shape::convex_polygon(vec![p, p + vec2(14.0, 6.0), p + vec2(6.0, 14.0)], tokens.accent_text, Stroke::new(1.0, tokens.shadow)));
             CursorIcon::None
         }
diff --git a/crates/ui-egui/src/updates_ui.rs b/crates/ui-egui/src/updates_ui.rs
index e8f79b53af..77e0f43b04 100644
--- a/crates/ui-egui/src/updates_ui.rs
+++ b/crates/ui-egui/src/updates_ui.rs
@@ -5,10 +5,35 @@ use serde_json::Value;
 
 use crate::PhotocraftApp;
 
-#[derive(Default)]
 pub(crate) struct Runtime {
     startup_checked: bool,
     notified_version: Option<String>,
+    /// The startup prompt and the self-update behind it (desktop).
+    #[cfg(not(target_arch = "wasm32"))]
+    updater: craft_update::updater::Updater,
+}
+
+impl Default for Runtime {
+    fn default() -> Self {
+        Self {
+            startup_checked: false,
+            notified_version: None,
+            #[cfg(not(target_arch = "wasm32"))]
+            updater: craft_update::updater::Updater::new(&craft_update::suite::PHOTOCRAFT, photocraft_engine::build_info::VERSION),
+        }
+    }
+}
+
+/// The release the engine found, as `craft-update` knows it.
+#[cfg(not(target_arch = "wasm32"))]
+fn release_of(found: &photocraft_engine::updates_cmds::Release) -> craft_update::Release {
+    craft_update::Release {
+        tag: format!("v{}", found.version),
+        version: craft_update::parse_version(&found.version),
+        name: format!("PhotoCraft {}", found.version),
+        html_url: found.url.clone(),
+        ..Default::default()
+    }
 }
 
 pub(crate) fn check(app: &mut PhotocraftApp, _ctx: &egui::Context, params: Value) -> Result<Value, String> {
@@ -36,6 +61,8 @@ pub(crate) fn tick(app: &mut PhotocraftApp, ctx: &egui::Context) {
     {
         app.updates_rt.notified_version = Some(release.version.clone());
         app.ui.updates_open = true;
+        #[cfg(not(target_arch = "wasm32"))]
+        app.updates_rt.updater.offer(release_of(release));
     }
     if app.session.updates.check.is_none() {
         return;
@@ -52,15 +79,40 @@ pub(crate) fn tick(app: &mut PhotocraftApp, ctx: &egui::Context) {
 }
 
 pub(crate) fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
+    let mut download: Option<String> = None;
+
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let was_open = app.updates_rt.updater.prompt_open();
+        app.updates_rt.updater.tick(ctx);
+        // The restart helper is scheduled before the app closes, so no update starts over unsaved work.
+        let clean = !app.has_unsaved_work();
+        match app.updates_rt.updater.show_if(ctx, clean) {
+            craft_update::updater::Action::None => {}
+            craft_update::updater::Action::OpenUrl(url) => download = Some(url),
+            // The guarded close path asks about unsaved work and waits for saves; the restart helper
+            // relaunches once the process exits.
+            craft_update::updater::Action::Close => ctx.send_viewport_cmd(egui::ViewportCommand::Close),
+        }
+        if was_open && !app.updates_rt.updater.prompt_open() {
+            app.ui.updates_open = false;
+        }
+        if app.updates_rt.updater.prompt_open() {
+            return;
+        }
+    }
+
     if !app.ui.updates_open {
+        if let Some(url) = download {
+            crate::links::open(app, ctx, &url);
+        }
         return;
     }
     let mut open = true;
     let status = app.session.updates.status.clone();
     let mut retry = false;
-    let mut download = None;
     egui::Window::new(tl!("PhotoCraft Updates"))
-        .id(egui::Id::new("photocraft_updates"))
+        .id(egui::Id::unique("photocraft_updates"))
         .open(&mut open)
         .collapsible(false)
         .resizable(false)
@@ -78,7 +130,16 @@ pub(crate) fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 }
                 Status::Available { release } => {
                     ui.label(crate::i18n::fmt(crate::i18n::t("PhotoCraft {version} is available."), &[("version", &release.version)]));
-                    ui.label(tl!("Open the release page to choose an installer for your system."));
+                    #[cfg(not(target_arch = "wasm32"))]
+                    {
+                        if crate::widgets::primary_button(ui, tl!("Update and Restart"), 180.0).clicked() {
+                            app.updates_rt.updater.offer(release_of(release));
+                        }
+                        if ui.button(tl!("Release Notes")).clicked() {
+                            download = Some(release.url.clone());
+                        }
+                    }
+                    #[cfg(target_arch = "wasm32")]
                     if crate::widgets::primary_button(ui, tl!("Open Download Page"), 160.0).clicked() {
                         download = Some(release.url.clone());
                     }
@@ -220,6 +281,30 @@ mod tests {
         assert!(!app.ui.updates_open);
     }
 
+    #[test]
+    #[cfg(not(target_arch = "wasm32"))]
+    fn startup_update_prompt_appears_and_can_be_dismissed() {
+        let (mut app, _, sender) = app();
+        let ctx = egui::Context::default();
+        at(&mut app, &ctx, 0.0);
+        sender
+            .lock()
+            .unwrap()
+            .as_ref()
+            .unwrap()
+            .send(Ok(Some(Release { version: "99.0.0".into(), url: "https://github.com/storytold/photocraft/releases/tag/v99.0.0".into() })))
+            .unwrap();
+        at(&mut app, &ctx, 1.0);
+        assert!(app.updates_rt.updater.prompt_open(), "startup prompt initialized on available release");
+
+        // Rendering show() renders the prompt modal
+        let mut output = ctx.run_ui(egui::RawInput::default(), |ui| {
+            show(&mut app, ui.ctx());
+        });
+        output.textures_delta.clear();
+        assert!(app.updates_rt.updater.prompt_open());
+    }
+
     #[test]
     fn a_manual_check_that_fails_to_start_opens_the_status_window() {
         let mut app =
diff --git a/crates/ui-egui/src/variables_ui.rs b/crates/ui-egui/src/variables_ui.rs
index a4700cddad..853d55b6ce 100644
--- a/crates/ui-egui/src/variables_ui.rs
+++ b/crates/ui-egui/src/variables_ui.rs
@@ -181,19 +181,33 @@ fn define_page(ui: &mut egui::Ui, _t: &Tokens, layers: &[(u64, String, bool)], s
             // layer
             let mut layer = d.get("layer").and_then(Value::as_u64).unwrap_or(layers[0].0);
             let opts: Vec<(u64, &str)> = layers.iter().map(|(id, n, _)| (*id, n.as_str())).collect();
-            if crate::widgets::dropdown(ui, &format!("vl{i}"), &mut layer, &opts, 120.0) {
+            if crate::widgets::dropdown(ui, &format!("vl{i}"), tl!("Layer"), &mut layer, &opts, 120.0) {
                 d["layer"] = json!(layer);
             }
             // type
             let mut ty = d.get("type").and_then(Value::as_str).unwrap_or("visibility").to_string();
             let mut tsel = ty.clone();
-            if crate::widgets::dropdown(ui, &format!("vt{i}"), &mut tsel, &TYPES.iter().map(|(a, b)| (a.to_string(), *b)).collect::<Vec<_>>(), 150.0) {
+            if crate::widgets::dropdown(
+                ui,
+                &format!("vt{i}"),
+                tl!("Type"),
+                &mut tsel,
+                &TYPES.iter().map(|(a, b)| (a.to_string(), *b)).collect::<Vec<_>>(),
+                150.0,
+            ) {
                 ty = tsel.clone();
                 d["type"] = json!(ty);
             }
             if ty == "pixelReplacement" {
                 let mut m = d.get("method").and_then(Value::as_str).unwrap_or("fit").to_string();
-                if crate::widgets::dropdown(ui, &format!("vm{i}"), &mut m, &METHODS.iter().map(|(a, b)| (a.to_string(), *b)).collect::<Vec<_>>(), 80.0) {
+                if crate::widgets::dropdown(
+                    ui,
+                    &format!("vm{i}"),
+                    tl!("Method"),
+                    &mut m,
+                    &METHODS.iter().map(|(a, b)| (a.to_string(), *b)).collect::<Vec<_>>(),
+                    80.0,
+                ) {
                     d["method"] = json!(m);
                 }
             }
@@ -277,8 +291,8 @@ fn data_sets_page(ui: &mut egui::Ui, _t: &Tokens, state: &mut Value, fields: &mu
         // name
         let mut sname = set.get("name").and_then(Value::as_str).unwrap_or("").to_string();
         ui.horizontal(|ui| {
-            ui.label(tl!("Name:"));
-            if ui.add(egui::TextEdit::singleline(&mut sname).desired_width(200.0)).changed() {
+            let name_label = ui.label(tl!("Name:"));
+            if ui.add(egui::TextEdit::singleline(&mut sname).desired_width(200.0)).labelled_by(name_label.id).changed() {
                 set["name"] = json!(sname);
             }
         });
@@ -316,7 +330,7 @@ fn data_sets_page(ui: &mut egui::Ui, _t: &Tokens, state: &mut Value, fields: &mu
                     }
                     _ => {
                         let mut txt = values[i].get("value").and_then(Value::as_str).unwrap_or("").to_string();
-                        if ui.add(egui::TextEdit::singleline(&mut txt).desired_width(240.0)).changed() {
+                        if ui.add(egui::TextEdit::singleline(&mut txt).desired_width(240.0)).accessible_name(vname.clone()).changed() {
                             values[i]["value"] = json!(txt);
                         }
                     }
diff --git a/crates/ui-egui/src/vector_paint_tests.rs b/crates/ui-egui/src/vector_paint_tests.rs
index 4c1fc45de4..d71a8fca78 100644
--- a/crates/ui-egui/src/vector_paint_tests.rs
+++ b/crates/ui-egui/src/vector_paint_tests.rs
@@ -37,7 +37,14 @@ fn assert_saved_path(saved: &Path, original: &Path) {
 }
 
 fn harness(app: PhotocraftApp, properties: bool) -> Harness<'static, PhotocraftApp> {
-    let mut h = Harness::builder().with_size(vec2(1000.0, 700.0)).build_ui_state(
+    // kittest's default step: 0.25 s a frame.
+    harness_stepped(app, properties, 0.25)
+}
+
+/// [`harness`] advancing `step_dt` seconds a frame (1/60 lets two clicks fall within egui's
+/// 0.3 s double-click window, as they do in the app).
+fn harness_stepped(app: PhotocraftApp, properties: bool, step_dt: f32) -> Harness<'static, PhotocraftApp> {
+    let mut h = Harness::builder().with_size(vec2(1000.0, 700.0)).with_step_dt(step_dt).build_ui_state(
         move |ui, app: &mut PhotocraftApp| {
             crate::screen_picker::tick(app, ui.ctx());
             if !ui.ctx().fonts(|f| f.families().contains(&egui::FontFamily::Name("medium".into()))) {
@@ -492,6 +499,310 @@ fn options_bar_fill_swatch_recolours_the_shape_just_drawn() {
     assert_eq!(shape(h.state()).fill, original.fill);
 }
 
+fn test_gradient() -> photocraft_doc::Fill {
+    photocraft_doc::Fill::Gradient {
+        stops: vec![(0.0, photocraft_doc::Color::rgba(0.123456, 0.5, 0.75, 1.0)), (1.0, photocraft_doc::Color::rgba(0.9, 0.2, 0.1, 0.6))],
+        angle: 30.0,
+        scale: 0.5,
+        style: photocraft_doc::GradientStyle::Radial,
+        reverse: true,
+        opacity_stops: vec![(0.0, 1.0), (1.0, 0.25)],
+        midpoints: vec![0.3],
+        offset: (0.125, -0.25),
+        dither: true,
+        align: false,
+    }
+}
+
+/// A gradient picked for the next shape's stroke and fill (the swatches' Gradient tab) reaches
+/// the drag preview and the committed shape exactly, every gradient field kept; a colour picked
+/// afterwards replaces it.
+#[test]
+fn tool_gradient_paints_reach_the_preview_and_the_next_shape() {
+    for (mode, depth) in [("rgb", 8), ("rgb", 32), ("gray", 16)] {
+        let mut app = app(mode, depth);
+        set_tool_paint(&mut app, true, PaintChange::Gradient(test_gradient())).unwrap();
+        set_tool_paint(&mut app, false, PaintChange::Gradient(test_gradient())).unwrap();
+        assert_eq!(app.ui.tool_options.stroke_width, 3.0, "a gradient enables the stroke");
+        assert!(app.ui.tool_options.shape_fill);
+        let preview = shape_preview(&app, Tool::Rectangle, [20.0, 20.0], [100.0, 80.0], Modifiers::NONE).unwrap();
+        finish_shape(&mut app, Tool::Rectangle, [20.0, 20.0], [100.0, 80.0], Modifiers::NONE);
+        let committed = shape(&app).clone();
+        assert_eq!(preview.fill, committed.fill);
+        assert_eq!(preview.stroke, committed.stroke);
+        assert_eq!(committed.stroke.as_ref().unwrap().paint, test_gradient(), "{mode}/{depth}");
+        assert_eq!(committed.fill, Some(test_gradient()));
+        let doc = &app.session.active().unwrap().doc;
+        let rendered = photocraft_vector::render_shape(&preview, doc.pixel_format(), doc.bounds());
+        assert_eq!(committed.cache.as_ref().unwrap(), &rendered, "{mode}/{depth}");
+        set_tool_paint(&mut app, true, PaintChange::Color([0.0, 1.0, 0.0, 1.0])).unwrap();
+        assert!(app.ui.tool_options.shape_stroke_gradient.is_none());
+        finish_shape(&mut app, Tool::Rectangle, [20.0, 20.0], [100.0, 80.0], Modifiers::NONE);
+        assert_eq!(shape(&app).stroke.as_ref().unwrap().paint, solid_paint([0.0, 1.0, 0.0, 1.0]));
+        assert_eq!(shape(&app).fill, Some(test_gradient()), "the fill keeps its gradient");
+    }
+}
+
+/// Options bar › Stroke › Gradient: the Rectangle tool's next stroke takes the current gradient,
+/// a preset's colours and a style, without editing the document.
+#[test]
+fn stroke_swatch_gradient_tab_sets_the_next_shapes_stroke() {
+    let mut h = harness(app("rgb", 8), false);
+    h.get_by_label("Stroke color").click();
+    h.run_steps(3);
+    h.get_by_label("Gradient").click();
+    h.run_steps(3);
+    let stroke_gradient = |h: &Harness<'_, PhotocraftApp>| match h.state().ui.tool_options.shape_stroke_gradient.clone() {
+        Some(photocraft_doc::Fill::Gradient { stops, style, angle, .. }) => (stops, style, angle),
+        other => panic!("a stroke gradient, not {other:?}"),
+    };
+    let (_, style, angle) = stroke_gradient(&h);
+    assert_eq!((style, angle), (photocraft_doc::GradientStyle::Linear, 90.0));
+    assert_eq!(h.state().ui.tool_options.stroke_width, 3.0, "choosing a gradient enables the stroke");
+    h.get_by_label("Blue 01").click();
+    h.run_steps(2);
+    let presets = h.state().session.presets.gradients.clone();
+    let blue = presets.iter().flat_map(|g| &g.items).find(|p| p.name == "Blue 01").unwrap();
+    let (fg, bg) = (h.state().session.tools.foreground, h.state().session.tools.background);
+    let blue_stops = blue.fill_stops(fg, bg).0;
+    assert_eq!(stroke_gradient(&h).0, blue_stops);
+    h.get_by_label("Radial Gradient").click();
+    h.run_steps(2);
+    let (stops, style, _) = stroke_gradient(&h);
+    assert_eq!((stops, style), (blue_stops, photocraft_doc::GradientStyle::Radial), "the style keeps the colours");
+    assert_eq!(h.state().session.active().unwrap().history.past_len(), 0, "tool defaults do not edit the document");
+    h.get_by_label("Solid").click();
+    h.run_steps(2);
+    assert!(h.state().ui.tool_options.shape_stroke_gradient.is_none(), "Solid goes back to the colour");
+}
+
+/// Properties › Stroke › Gradient gives the selected shape a gradient stroke in one undoable
+/// step, keeping its width; a style change keeps its colours.
+#[test]
+fn properties_stroke_swatch_gives_the_selected_shape_a_gradient_stroke() {
+    let mut app = app("rgb", 16);
+    app.run("shape.create", json!({"rect": [20, 20, 60, 40], "stroke": {"width": 4, "color": [1.0, 0.0, 0.0, 1.0]}})).unwrap();
+    let history = app.session.active().unwrap().history.past_len();
+    let mut h = harness(app, true);
+    h.get_by_label("Set shape stroke type").click();
+    h.run_steps(3);
+    h.get_by_label("Gradient").click();
+    h.run_steps(3);
+    let stroke = shape(h.state()).stroke.clone().unwrap();
+    let photocraft_doc::Fill::Gradient { stops, .. } = &stroke.paint else { panic!("a gradient stroke, not {:?}", stroke.paint) };
+    assert_eq!(stroke.width, 4.0);
+    assert_eq!(h.state().session.active().unwrap().history.past_len(), history + 1);
+    h.get_by_label("Reflected Gradient").click();
+    h.run_steps(3);
+    let photocraft_doc::Fill::Gradient { stops: after, style, .. } = shape(h.state()).stroke.clone().unwrap().paint else { panic!("still a gradient stroke") };
+    assert_eq!((&after, style), (stops, photocraft_doc::GradientStyle::Reflected));
+    while h.state().session.active().unwrap().history.past_len() > history {
+        h.state_mut().run("edit.undo", json!({})).unwrap();
+    }
+    assert_eq!(shape(h.state()).stroke.as_ref().unwrap().paint, solid_paint([1.0, 0.0, 0.0, 1.0]));
+}
+
+fn tool_stroke_gradient(h: &Harness<'_, PhotocraftApp>) -> photocraft_doc::Fill {
+    h.state().ui.tool_options.shape_stroke_gradient.clone().expect("a stroke gradient")
+}
+
+fn gradient_stops(f: &photocraft_doc::Fill) -> photocraft_engine::presets::gradients::FillStops {
+    match f {
+        photocraft_doc::Fill::Gradient { stops, opacity_stops, .. } => (stops.clone(), opacity_stops.clone()),
+        other => panic!("a gradient, not {other:?}"),
+    }
+}
+
+/// Opens Options bar › Stroke › Gradient and returns the stops strip's rect.
+fn open_stroke_gradient(h: &mut Harness<'_, PhotocraftApp>) -> Rect {
+    h.get_by_label("Stroke color").click();
+    h.run_steps(3);
+    if h.state().ui.tool_options.shape_stroke_gradient.is_none() || h.state().ui.tool_options.stroke_width <= 0.0 {
+        h.get_by_label("Gradient").click();
+        h.run_steps(3);
+    }
+    h.get_by_label("Gradient stops").rect()
+}
+
+fn click(h: &mut Harness<'_, PhotocraftApp>, pos: Pos2) {
+    h.hover_at(pos);
+    h.step();
+    pointer(h, pos, true);
+    pointer(h, pos, false);
+    h.run_steps(2);
+}
+
+/// The Gradient tab's strip edits the stops as Photoshop's popover does: a click below the ramp
+/// adds a colour stop, above it an opacity stop; Delete removes the selected one; dragging a stop
+/// moves it; the selected colour stop's swatch opens an inline picker that recolours only it.
+#[test]
+fn gradient_tab_strip_adds_moves_recolours_and_deletes_stops() {
+    let mut h = harness(app("rgb", 16), false);
+    let strip = open_stroke_gradient(&mut h);
+    let (bar_left, bar_right, bar_top, bar_bottom) = (strip.left() + 8.0, strip.right() - 8.0, strip.top() + 16.0, strip.top() + 40.0);
+    let x_at = |loc: f32| bar_left + (bar_right - bar_left) * loc;
+    let (stops, opacity) = gradient_stops(&tool_stroke_gradient(&h));
+    assert_eq!((stops.len(), opacity.len()), (2, 0));
+    // A colour stop added in the middle takes the colour the gradient has there.
+    click(&mut h, pos2(x_at(0.5), bar_bottom - 4.0));
+    let (stops, _) = gradient_stops(&tool_stroke_gradient(&h));
+    assert_eq!(stops.len(), 3, "{stops:?}");
+    assert!(stops.iter().any(|(l, _)| (l - 0.5).abs() < 0.02), "{stops:?}");
+    // It is selected: Delete removes it again.
+    h.get_by_label("Delete").click();
+    h.run_steps(2);
+    assert_eq!(gradient_stops(&tool_stroke_gradient(&h)).0.len(), 2);
+    // An opacity stop above the ramp (the two implicit opaque ends become real stops).
+    click(&mut h, pos2(x_at(0.25), bar_top + 4.0));
+    let (_, opacity) = gradient_stops(&tool_stroke_gradient(&h));
+    assert_eq!(opacity.len(), 3, "{opacity:?}");
+    // Drag the first colour stop to 30 %.
+    let from = pos2(x_at(0.0), bar_bottom + 10.0);
+    let to = pos2(x_at(0.3), bar_bottom + 10.0);
+    h.hover_at(from);
+    h.step();
+    pointer(&mut h, from, true);
+    for k in 1..=4 {
+        h.event(Event::PointerMoved(from + (to - from) * (k as f32 / 4.0)));
+        h.step();
+    }
+    pointer(&mut h, to, false);
+    h.run_steps(2);
+    let (stops, _) = gradient_stops(&tool_stroke_gradient(&h));
+    let mut locations: Vec<f32> = stops.iter().map(|s| s.0).collect();
+    locations.sort_by(f32::total_cmp);
+    assert!((locations[0] - 0.3).abs() < 0.03 && locations[1] == 1.0, "{locations:?}");
+    // The selected stop's colour: its swatch opens the picker; a drag in it recolours that stop.
+    let before = gradient_stops(&tool_stroke_gradient(&h)).0;
+    let swatch = h.get(egui_kittest::kittest::by().label("Color").role(egui::accesskit::Role::ColorWell)).rect();
+    click(&mut h, swatch.center());
+    h.run_steps(2);
+    // The inline picker opens under the stop's rows (readouts, preview, then the saturation /
+    // value field); a click in that field.
+    let field = pos2(swatch.left() + 30.0, h.get_by_label("Location").rect().bottom() + 120.0);
+    click(&mut h, field);
+    let after = gradient_stops(&tool_stroke_gradient(&h)).0;
+    assert_eq!(after.len(), before.len());
+    let changed: Vec<_> = before.iter().zip(&after).filter(|(a, b)| a != b).collect();
+    assert_eq!(changed.len(), 1, "only the selected stop changes colour: {before:?} → {after:?}");
+    assert_eq!(h.state().session.active().unwrap().history.past_len(), 0, "tool defaults do not edit the document");
+}
+
+/// Align with layer is a checkbox of the tab, and the gradient a popup closes on is offered again
+/// in its Recent row.
+#[test]
+fn gradient_tab_align_with_layer_and_recent_row() {
+    let mut h = harness(app("rgb", 8), false);
+    open_stroke_gradient(&mut h);
+    let align = |h: &Harness<'_, PhotocraftApp>| matches!(tool_stroke_gradient(h), photocraft_doc::Fill::Gradient { align: true, .. });
+    assert!(align(&h));
+    h.get_by_label("Align with layer").click();
+    h.run_steps(2);
+    assert!(!align(&h));
+    h.get_by_label("Blue 01").click();
+    h.run_steps(2);
+    let blue = gradient_stops(&tool_stroke_gradient(&h));
+    assert!(h.query_by_label("Recent 1").is_none(), "nothing is recent yet");
+    h.key_press(Key::Escape);
+    h.run_steps(3);
+    assert_eq!(h.state().ui.recent_gradients.len(), 1, "closing the popup remembers its gradient");
+    open_stroke_gradient(&mut h);
+    h.get_by_label("Black, White").click();
+    h.run_steps(2);
+    assert_ne!(gradient_stops(&tool_stroke_gradient(&h)), blue);
+    h.get_by_label("Recent 1").click();
+    h.run_steps(2);
+    assert_eq!(gradient_stops(&tool_stroke_gradient(&h)), blue, "a Recent pick restores its stops");
+    h.key_press(Key::Escape);
+    h.run_steps(3);
+    assert_eq!(h.state().ui.recent_gradients.len(), 1, "the same stops are remembered once");
+}
+
+/// #7176 review: the selected stop is an index; after taking a preset with fewer stops it pointed
+/// past them and the Color / Location rows vanished, leaving no way to recolour a stop. They stay,
+/// and double-clicking a colour stop opens its colour, as Photoshop's opens the Color Picker.
+#[test]
+fn gradient_tab_keeps_the_stop_colour_after_a_preset_with_fewer_stops() {
+    let mut h = harness_stepped(app("rgb", 8), false, 1.0 / 60.0);
+    let strip = open_stroke_gradient(&mut h);
+    let (bar_left, bar_right, bar_bottom) = (strip.left() + 8.0, strip.right() - 8.0, strip.top() + 40.0);
+    let x_at = |loc: f32| bar_left + (bar_right - bar_left) * loc;
+    // Three colour stops, the last one selected.
+    click(&mut h, pos2(x_at(0.5), bar_bottom - 4.0));
+    click(&mut h, pos2(x_at(1.0), bar_bottom + 10.0));
+    assert_eq!(gradient_stops(&tool_stroke_gradient(&h)).0.len(), 3);
+    h.get_by_label("Blue 01").click();
+    h.run_steps(3);
+    assert_eq!(gradient_stops(&tool_stroke_gradient(&h)).0.len(), 2);
+    assert!(h.query_by_label("Location").is_some(), "the selected stop's rows stay after a preset with fewer stops");
+    let color_well = egui_kittest::kittest::by().label("Color").role(egui::accesskit::Role::ColorWell);
+    assert!(h.query(color_well).is_some());
+    // Double-click the right colour stop: its picker opens, and a click in it recolours only that stop.
+    let stop = pos2(x_at(1.0), bar_bottom + 10.0);
+    h.hover_at(stop);
+    // A second later, so the two clicks are a double click and not a triple with the preset pick.
+    h.run_steps(60);
+    for _ in 0..2 {
+        pointer(&mut h, stop, true);
+        pointer(&mut h, stop, false);
+    }
+    h.run_steps(2);
+    let before = gradient_stops(&tool_stroke_gradient(&h)).0;
+    let swatch = h.get(egui_kittest::kittest::by().label("Color").role(egui::accesskit::Role::ColorWell)).rect();
+    let field = pos2(swatch.left() + 30.0, h.get_by_label("Location").rect().bottom() + 120.0);
+    click(&mut h, field);
+    let after = gradient_stops(&tool_stroke_gradient(&h)).0;
+    assert_eq!(after[0], before[0], "the left stop keeps its colour");
+    assert_ne!(after[1].1, before[1].1, "the double-clicked right stop is recoloured");
+    assert_eq!(after[1].0, before[1].0);
+}
+
+/// A swatch edit that only changes the gradient's settings (Reverse) keeps a CMYK document's
+/// stops as they are: before, every stop went out as sRGB RGBA and came back in the RGB model.
+#[test]
+fn gradient_tab_edit_keeps_cmyk_stops_in_their_model() {
+    let cmyk = |c: [f32; 4]| photocraft_doc::Color { mode: photocraft_doc::ColorMode::Cmyk, c, alpha: 1.0 };
+    let stops = vec![(0.0, cmyk([0.1, 0.2, 0.3, 0.9])), (1.0, cmyk([0.75, 0.0, 0.5, 0.0]))];
+    for (properties, label) in [(true, "Set shape stroke type"), (false, "Stroke color")] {
+        let mut app = app("cmyk", 8);
+        let stroke = json!({"width": 4, "color": {"gradient": {"stops": [[0.0, stops[0].1], [1.0, stops[1].1]]}}});
+        app.run("shape.create", json!({"rect": [20, 20, 60, 40], "stroke": stroke})).unwrap();
+        assert_eq!(gradient_stops(&shape(&app).stroke.as_ref().unwrap().paint).0, stops);
+        let mut h = harness(app, properties);
+        h.get_by_label(label).click();
+        h.run_steps(3);
+        h.get_by_label("Reverse").click();
+        h.run_steps(3);
+        let paint = shape(h.state()).stroke.clone().unwrap().paint;
+        assert!(matches!(paint, photocraft_doc::Fill::Gradient { reverse: true, .. }), "Properties={properties}: Reverse applied");
+        assert_eq!(gradient_stops(&paint).0, stops, "Properties={properties}: the stops keep their CMYK model and values");
+    }
+}
+
+/// Options bar with a strokeless shape selected and the stroke swatch's gradient chosen: giving
+/// the shape a stroke through the width field or the stroke type takes that gradient, as the next
+/// shape does, not a solid background colour.
+#[test]
+fn width_and_stroke_type_give_a_strokeless_shape_the_tool_stroke_gradient() {
+    for via_width in [true, false] {
+        let mut app = app("rgb", 8);
+        app.run("shape.create", json!({"rect": [20, 20, 80, 60], "fill": "#336699", "stroke": null})).unwrap();
+        set_tool_paint(&mut app, true, PaintChange::Gradient(test_gradient())).unwrap();
+        let mut h = harness(app, false);
+        if via_width {
+            stroke_width(&mut h, "5");
+        } else {
+            h.get_by_label("Stroke Options").click();
+            h.run_steps(3);
+            h.get_by_role_and_label(egui::accesskit::Role::RadioButton, "Dotted").click();
+            h.run_steps(3);
+        }
+        let stroke = shape(h.state()).stroke.clone().expect("a stroke");
+        assert_eq!(stroke.paint, test_gradient(), "via_width={via_width}");
+        assert_eq!(stroke.width, if via_width { 5.0 } else { 3.0 });
+    }
+}
+
 /// An arrow-key step at 0 px on a strokeless shape must not add an invisible stroke.
 #[test]
 fn arrow_down_at_zero_width_keeps_a_strokeless_shape_strokeless() {
diff --git a/crates/ui-egui/src/vector_ui.rs b/crates/ui-egui/src/vector_ui.rs
index 81426ccb5e..e139a80163 100644
--- a/crates/ui-egui/src/vector_ui.rs
+++ b/crates/ui-egui/src/vector_ui.rs
@@ -11,7 +11,8 @@ use serde_json::{Value, json};
 
 use crate::PhotocraftApp;
 use crate::canvas::ViewXform;
-use crate::shape_paint_ui::{PaintChange, swatch};
+use crate::shape_gradient_ui::GradientChoices;
+use crate::shape_paint_ui::{PaintChange, paint_param, swatch};
 use crate::state::{Tool, ToolOptions};
 use crate::theme::Tokens;
 
@@ -82,10 +83,28 @@ fn stroke_param(app: &PhotocraftApp) -> Value {
     }
     let mut p = o.shape_stroke.params();
     p["width"] = json!(o.stroke_width);
-    p["color"] = json!(app.session.tools.background);
+    p["color"] = tool_paint_param(app, true);
     p
 }
 
+/// The paint the next shape's fill (`stroke` false) or stroke takes: the options bar's gradient,
+/// else the foreground / background colour.
+fn tool_paint(app: &PhotocraftApp, stroke: bool) -> photocraft_doc::Fill {
+    let (gradient, color) = tool_paint_source(app, stroke);
+    gradient.clone().unwrap_or_else(|| solid_paint(color))
+}
+
+/// [`tool_paint`] as `shape.create` takes it.
+fn tool_paint_param(app: &PhotocraftApp, stroke: bool) -> Value {
+    let (gradient, color) = tool_paint_source(app, stroke);
+    gradient.as_ref().map_or_else(|| json!(color), paint_param)
+}
+
+fn tool_paint_source(app: &PhotocraftApp, stroke: bool) -> (&Option<photocraft_doc::Fill>, [f32; 4]) {
+    let o = &app.ui.tool_options;
+    if stroke { (&o.shape_stroke_gradient, app.session.tools.background) } else { (&o.shape_fill_gradient, app.session.tools.foreground) }
+}
+
 /// Geometry of a Shape-tool drag as `shape.create` params, without fill and stroke (None when too
 /// small): ⇧ constrains proportions, ⌥ draws from the centre. Custom shapes give their box as a `rect`.
 fn shape_geometry(o: &ToolOptions, tool: Tool, start: [f64; 2], end: [f64; 2], mods: egui::Modifiers) -> Option<Value> {
@@ -154,7 +173,7 @@ pub fn finish_shape(app: &mut PhotocraftApp, tool: Tool, start: [f64; 2], end: [
 }
 
 fn fill_param(app: &PhotocraftApp) -> Value {
-    if app.ui.tool_options.shape_fill { json!(app.session.tools.foreground) } else { Value::Null }
+    if app.ui.tool_options.shape_fill { tool_paint_param(app, false) } else { Value::Null }
 }
 
 /// Create a shape layer from `shape.create` geometry with the options bar's fill and stroke: the
@@ -179,8 +198,8 @@ fn shape_preview(app: &PhotocraftApp, tool: Tool, start: [f64; 2], end: [f64; 2]
     };
     Some(photocraft_doc::ShapeLayer {
         path,
-        fill: o.shape_fill.then(|| solid_paint(app.session.tools.foreground)),
-        stroke: (o.stroke_width > 0.0).then(|| o.shape_stroke.stroke(o.stroke_width, solid_paint(app.session.tools.background))),
+        fill: o.shape_fill.then(|| tool_paint(app, false)),
+        stroke: (o.stroke_width > 0.0).then(|| o.shape_stroke.stroke(o.stroke_width, tool_paint(app, true))),
         ..Default::default()
     })
 }
@@ -1306,7 +1325,9 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
     }
     let t = Tokens::get(ui.ctx());
     let lbl = |ui: &mut egui::Ui, s: &str| {
-        ui.label(egui::RichText::new(s).color(t.text_dim).size(12.0));
+        let label = ui.label(egui::RichText::new(s).color(t.text_dim).size(12.0));
+        // The caption scrubs and names the control drawn right after it.
+        crate::widgets::scrub_option_label(ui, &label);
     };
     let o = &mut app.ui.tool_options;
     let target = selected_shape(&app.session);
@@ -1336,10 +1357,10 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
     }
     if matches!(tool, Tool::Pen | Tool::FreeformPen | Tool::CurvaturePen) {
         let opts = [("path".to_string(), tl!("Path")), ("shape".to_string(), tl!("Shape"))];
-        crate::widgets::dropdown(ui, "pen-mode", &mut o.vector_mode, &opts, 80.0);
+        crate::widgets::dropdown(ui, "pen-mode", tl!("Mode"), &mut o.vector_mode, &opts, 80.0);
         crate::widgets::vline(ui, 22.0);
         if o.vector_mode == "shape" {
-            crate::widgets::value_field(ui, &mut o.stroke_width, 0.0..=288.0, "px", 58.0);
+            crate::widgets::value_field(ui, &mut o.stroke_width, 0.0..=288.0, "px", 58.0).accessible_name(tl!("Stroke:"));
             if let Some(change) =
                 crate::shape_stroke_ui::button(ui, "pen-stroke", &o.shape_stroke, &mut app.ui.stroke_editor, false, true, None, o.stroke_width > 0.0)
             {
@@ -1390,7 +1411,7 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui, tool: Tool) -> bo
         return true;
     }
     let mut mode = "shape".to_string();
-    crate::widgets::dropdown(ui, "shape-mode", &mut mode, &[("shape".to_string(), tl!("Shape"))], 80.0);
+    crate::widgets::dropdown(ui, "shape-mode", tl!("Mode"), &mut mode, &[("shape".to_string(), tl!("Shape"))], 80.0);
     crate::widgets::vline(ui, 22.0);
     crate::shape_options::options_bar(app, ui, tool);
     true
@@ -1457,7 +1478,7 @@ pub fn shape_properties(app: &mut PhotocraftApp, ui: &mut egui::Ui, id: photocra
     let mut edit: Option<Value> = None;
     let doc_id = app.session.active().map(|st| st.doc.id);
     let key = |k: &str| format!("shape-{doc_id:?}-{}-{k}", id.0);
-    let gesture_key = ui.id().with(key("paint-gesture"));
+    let gesture_key = ui.scope_id().with(key("paint-gesture"));
     let gesture = paint_gesture(ui, gesture_key);
     let coalesce = |field: &str| format!("{}:{}:{gesture}", key(field), gesture_key.value());
     // The shared collapsible section headers (#155).
@@ -1465,24 +1486,35 @@ pub fn shape_properties(app: &mut PhotocraftApp, ui: &mut egui::Ui, id: photocra
     if crate::props_layout::section(ui, "appearance", crate::i18n::tr_ctx(crate::i18n::current(), "shape", "Appearance")) {
         ui.horizontal(|ui| {
             ui.label(egui::RichText::new(tl!("Fill")).color(t.text_dim).size(12.0));
-            if let Some(change) = swatch(ui, sh.fill.as_ref(), app.session.tools.foreground, tl!("Set shape fill type")) {
+            let (fg, bg) = (app.session.tools.foreground, app.session.tools.background);
+            let mut gradients = GradientChoices {
+                presets: &app.session.presets.gradients,
+                current: &app.session.presets.gradient,
+                recent: &mut app.ui.recent_gradients,
+                fg,
+                bg,
+            };
+            if let Some(change) = swatch(ui, sh.fill.as_ref(), fg, tl!("Set shape fill type"), &mut gradients) {
                 let fill = match change {
                     PaintChange::None => Value::Null,
                     PaintChange::Color(color) => json!(color),
+                    PaintChange::Gradient(g) => paint_param(&g),
                 };
                 edit = Some(json!({"fill": fill, "coalesce": coalesce("fill")}));
             }
             ui.add_space(12.0);
             ui.label(egui::RichText::new(tl!("Stroke")).color(t.text_dim).size(12.0));
-            if let Some(change) = swatch(ui, sh.stroke.as_ref().map(|s| &s.paint), app.session.tools.foreground, tl!("Set shape stroke type")) {
+            if let Some(change) = swatch(ui, sh.stroke.as_ref().map(|s| &s.paint), fg, tl!("Set shape stroke type"), &mut gradients) {
+                let width = enabled_stroke_width(sh.stroke.as_ref().map_or(0.0, |s| s.width));
                 let stroke = match change {
                     PaintChange::None => Value::Null,
-                    PaintChange::Color(color) => json!({"color": color, "width": enabled_stroke_width(sh.stroke.as_ref().map_or(0.0, |s| s.width))}),
+                    PaintChange::Color(color) => json!({"color": color, "width": width}),
+                    PaintChange::Gradient(g) => json!({"color": paint_param(&g), "width": width}),
                 };
                 edit = Some(json!({"stroke": stroke, "coalesce": coalesce("stroke")}));
             }
             let mut w = sh.stroke.as_ref().map_or(0.0, |s| s.width);
-            if crate::widgets::value_field(ui, &mut w, 0.0..=288.0, "px", 60.0).changed() && (sh.stroke.is_some() || w > 0.0) {
+            if crate::widgets::value_field(ui, &mut w, 0.0..=288.0, "px", 60.0).accessible_name(tl!("Stroke:")).changed() && (sh.stroke.is_some() || w > 0.0) {
                 edit = Some(json!({"stroke": {"width": w}, "coalesce": coalesce("stroke-w")}));
             }
         });
@@ -1510,7 +1542,7 @@ pub fn shape_properties(app: &mut PhotocraftApp, ui: &mut egui::Ui, id: photocra
     {
         let num = |ui: &mut egui::Ui, label: &str, v: &mut f32, range: std::ops::RangeInclusive<f32>, unit: &str| -> bool {
             ui.label(egui::RichText::new(tl!(&label)).color(t.text_dim).size(12.0));
-            crate::widgets::value_field(ui, v, range, unit, 64.0).changed()
+            crate::widgets::value_field(ui, v, range, unit, 64.0).accessible_name(tl!(&label)).changed()
         };
         match live {
             photocraft_doc::vector::LiveShape::Rect { rect, .. }
@@ -1654,7 +1686,7 @@ pub fn path_rows(doc: &Document, active: Option<photocraft_doc::LayerId>) -> Vec
 }
 
 fn footer_id() -> egui::Id {
-    egui::Id::new("paths-footer")
+    egui::Id::unique("paths-footer")
 }
 
 /// A Paths panel row being dragged, for a drop on the trash (#6553): its name and the command
@@ -1667,7 +1699,7 @@ struct PathDrag {
 }
 
 fn path_drag_key() -> egui::Id {
-    egui::Id::new("paths-drag")
+    egui::Id::unique("paths-drag")
 }
 
 fn ctx_data_footer(ctx: &egui::Context, r: Rect) {
@@ -1702,7 +1734,7 @@ struct PathRename {
 }
 
 fn rename_id(doc: &Document) -> egui::Id {
-    egui::Id::new(("path-rename", doc.id.0))
+    egui::Id::unique(("path-rename", doc.id.0))
 }
 
 /// Commands offered by a Paths row's context menu. The row's path is passed explicitly so a
@@ -1799,7 +1831,7 @@ pub fn paths_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                     ui.ctx().data_mut(|d| d.insert_temp(path_drag_key(), PathDrag { name, cmd, params }));
                 }
                 // Rows are painted: name them for screen readers and UI tests.
-                resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::SelectableLabel, true, name));
+                resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, name));
                 let sel = app.ui.selected_path.as_deref() == Some(key.as_str());
                 if sel {
                     ui.painter().rect_filled(r, 0.0, t.row_selected);
@@ -1820,7 +1852,8 @@ pub fn paths_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
                 if let Some(mut edit) = renaming {
                     let field = Rect::from_min_max(pos2(r.left() + 43.0, r.center().y - 11.0), pos2(r.right() - 8.0, r.center().y + 11.0));
                     let id = rename_id.with("field");
-                    let te = ui.put(field, egui::TextEdit::singleline(&mut edit.text).id(id).font(egui::FontId::proportional(12.0)));
+                    let te =
+                        ui.put(field, egui::TextEdit::singleline(&mut edit.text).id(id).font(egui::FontId::proportional(12.0))).accessible_name(tl!("Name"));
                     let (enter, esc) = ui.input(|i| (i.key_pressed(egui::Key::Enter), i.key_pressed(egui::Key::Escape)));
                     if !edit.focused {
                         te.request_focus();
@@ -1901,7 +1934,7 @@ pub fn paths_panel(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
             // adjustment layers then take the selection as their mask instead (#1419).
             let rest = ui.available_rect_before_wrap();
             let rest = rest.intersect(Rect::from_min_size(rest.min, vec2(rest.width(), rest.height().min(4000.0))));
-            if rest.is_positive() && ui.interact(rest, ui.id().with("paths-empty"), Sense::click()).clicked() {
+            if rest.is_positive() && ui.interact(rest, ui.scope_id().with("paths-empty"), Sense::click()).clicked() {
                 app.ui.selected_path = None;
             }
         },
diff --git a/crates/ui-egui/src/view_cmds.rs b/crates/ui-egui/src/view_cmds.rs
index 9fdc456569..4eb811b290 100644
--- a/crates/ui-egui/src/view_cmds.rs
+++ b/crates/ui-egui/src/view_cmds.rs
@@ -173,7 +173,7 @@ const LAYOUTS: [&str; 10] = [
 
 /// Whether the window was maximized when a screen mode took it full screen (egui temp data).
 fn was_maximized_id() -> egui::Id {
-    egui::Id::new("pc-full-screen-was-maximized")
+    egui::Id::unique("pc-full-screen-was-maximized")
 }
 
 /// The window commands for switching to screen mode `next`, and whether the window should be
@@ -1141,7 +1141,7 @@ pub fn form_body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
                 let mut quality = v.as_f64().or_else(|| f.get("__batchQuality").and_then(Value::as_f64)).unwrap_or(8.0).clamp(0.0, 12.0) as f32;
                 ui.horizontal(|ui| {
                     crate::widgets::checkbox(ui, &mut custom, tl!("Custom"));
-                    ui.add_enabled_ui(custom, |ui| crate::widgets::value_field(ui, &mut quality, 0.0..=12.0, "", 74.0));
+                    ui.add_enabled_ui(custom, |ui| crate::widgets::value_field(ui, &mut quality, 0.0..=12.0, "", 74.0).accessible_name(tl!("Quality")));
                 });
                 // None preserves the command's existing JPEG and lossless WebP defaults.
                 // The inactive custom value is shell state, never a command parameter.
@@ -1165,13 +1165,13 @@ pub fn form_body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
                         Some(opts) => {
                             let opts: Vec<(String, String)> = opts.iter().filter_map(Value::as_str).map(|o| (o.to_string(), label(o))).collect();
                             let refs: Vec<(String, &str)> = opts.iter().map(|(a, b)| (a.clone(), b.as_str())).collect();
-                            crate::widgets::dropdown(ui, &format!("form-{k}"), &mut s, &refs, 200.0);
+                            crate::widgets::dropdown(ui, &format!("form-{k}"), &label(&k), &mut s, &refs, 200.0);
                         }
                         None => {
                             ui.horizontal(|ui| {
-                                ui.add(egui::TextEdit::singleline(&mut s).desired_width(260.0));
-                                // A folder field gets the system folder picker (#7942).
-                                if k == "dir" && crate::widgets::secondary_button(ui, tl!("Browse…"), 0.0).clicked() {
+                                ui.add(egui::TextEdit::singleline(&mut s).desired_width(260.0)).accessible_name(label(&k));
+                                // A folder field gets the system folder picker (#7942, #9357).
+                                if crate::dialogs::is_folder_field(&k) && crate::widgets::secondary_button(ui, tl!("Browse…"), 0.0).clicked() {
                                     browse = Some(k.clone());
                                 }
                             });
@@ -1182,11 +1182,11 @@ pub fn form_body(ui: &mut egui::Ui, f: &mut Map<String, Value>) {
                 Value::Number(n) => {
                     ui.label(label(&k));
                     if let Some(mut i) = n.as_i64() {
-                        ui.add(egui::DragValue::new(&mut i).custom_parser(crate::widgets::parse_num));
+                        ui.add(egui::DragValue::new(&mut i).custom_parser(crate::widgets::parse_num)).accessible_name(label(&k));
                         json!(i)
                     } else {
                         let mut x = n.as_f64().unwrap_or(0.0);
-                        ui.add(egui::DragValue::new(&mut x).speed(0.5).custom_parser(crate::widgets::parse_num));
+                        ui.add(egui::DragValue::new(&mut x).speed(0.5).custom_parser(crate::widgets::parse_num)).accessible_name(label(&k));
                         json!(x)
                     }
                 }
diff --git a/crates/ui-egui/src/vp_ui.rs b/crates/ui-egui/src/vp_ui.rs
index 61ad0a4425..e1e1f8e449 100644
--- a/crates/ui-egui/src/vp_ui.rs
+++ b/crates/ui-egui/src/vp_ui.rs
@@ -2,19 +2,27 @@
 //!
 //! **Create Plane** (C): four clicks set a plane's corners, in any order. **Edit Plane** (V):
 //! drag a corner node, or an edge node to slide that edge along the plane's own perspective;
-//! click a plane to select it, Delete removes it. The plane's grid is drawn at the Grid Size and,
+//! click a plane to select it, Delete removes it. Ctrl/Cmd-dragging an edge node tears off a
+//! perpendicular plane; dragging the torn plane's far edge node sets its depth and Alt-dragging
+//! it its angle (it stays a torn-off plane, so it follows its parent). The plane's grid is drawn
+//! at the Grid Size and,
 //! like Photoshop's, in the accent colour when the plane is valid, yellow when its perspective is
 //! doubtful and red when it is invalid ([`VpPlane::check`]). With an image on the clipboard the
-//! selected plane shows it pasted in perspective; drag it to move it on the plane. ↩ / OK runs
-//! `filter.vanishingPoint` with the planes and the paste, so it is one history step and an
-//! action or agent can replay it exactly.
+//! selected plane shows it pasted in perspective; drag it to move it on the plane. **Stamp** (S):
+//! Alt-click a plane to set the source, then paint to clone in perspective (Diameter, Hardness,
+//! Opacity, Aligned); the canvas shows the strokes as they are painted. ↩ / OK runs
+//! `filter.vanishingPoint` with the planes, the paste and the strokes, so the whole session is
+//! one history step and an action or agent can replay it exactly.
+
+use std::sync::Arc;
 
 use egui::{Color32, Pos2, Stroke, TextureHandle, pos2};
 use photocraft_algo::transform::Homography;
-use photocraft_algo::vanishing::{PlaneCheck, Scene, VpPlane};
-use photocraft_doc::{DocId, LayerContent, LayerId};
-use photocraft_engine::vp_cmds::VP;
+use photocraft_algo::vanishing::{Edge, PlaneCheck, Scene, VpPlane, clone_dabs_from, clone_source};
+use photocraft_doc::{DocId, Document, Layer, LayerContent, LayerId};
+use photocraft_engine::vp_cmds::{CloneSpec, MAX_CLONE_DABS, MAX_CLONE_STROKES, VP, copy_changed, over, paste_onto, visible_image};
 use photocraft_geom::Rect;
+use photocraft_raster::Surface;
 use serde_json::{Value, json};
 
 use crate::PhotocraftApp;
@@ -26,6 +34,45 @@ use crate::edit_history::{EditHistory, Step};
 pub enum VpTool {
     EditPlane,
     CreatePlane,
+    Stamp,
+}
+
+/// A plane torn off an edge of an earlier plane: the engine's
+/// `{"from", "edge", "angle", "depth"}`, so it follows its parent when that is edited.
+#[derive(Clone, Copy, Debug, PartialEq, serde::Serialize)]
+pub struct Torn {
+    pub from: usize,
+    pub edge: Edge,
+    /// Degrees between the planes (90 = perpendicular).
+    pub angle: f64,
+    /// Extent as a multiple of the parent's adjacent side.
+    pub depth: f64,
+}
+
+/// The Stamp tool's options.
+#[derive(Clone, Copy, Debug, PartialEq, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct StampOptions {
+    /// Brush diameter in px where a stroke starts.
+    pub diameter: f64,
+    /// 0..=100.
+    pub hardness: f64,
+    /// 0..=100.
+    pub opacity: f64,
+    /// Later strokes keep the first stroke's source offset instead of restarting at the source.
+    pub aligned: bool,
+}
+
+/// Edge node `i` (0 top, 1 right, 2 bottom, 3 left) as the engine's edge.
+const EDGES: [Edge; 4] = [Edge::Top, Edge::Right, Edge::Bottom, Edge::Left];
+
+fn edge_index(e: Edge) -> usize {
+    match e {
+        Edge::Top => 0,
+        Edge::Right => 1,
+        Edge::Bottom => 2,
+        Edge::Left => 3,
+    }
 }
 
 enum Drag {
@@ -36,10 +83,41 @@ enum Drag {
     Edge { plane: usize, edge: usize, h: Homography, inv: Homography },
     /// The pasted image, and the pointer offset from its top-left in plane coordinates.
     Paste { offset: [f64; 2] },
+    /// The far edge node of torn-off plane `plane` (or of one being torn off): the drag sets
+    /// its depth, or with `rotate` (Alt) its angle, once it has left `start`.
+    Torn { plane: usize, rotate: bool, start: [f64; 2], moved: bool },
+    /// Painting the last of the clone strokes.
+    Stamp,
+}
+
+/// The clone strokes painted onto the target layer, shown on the canvas while stamping.
+struct StampPreview {
+    /// The session's `rev`, New Layer and paste it was painted with (any changing repaints it).
+    rev: u64,
+    new_layer: bool,
+    /// The paste (plane, top-left, width) baked in under the strokes, as OK pastes before it clones.
+    paste: Option<(usize, [f64; 2], f64)>,
+    /// The paste landed in `out` (it can fail, or miss the plane).
+    baked: bool,
+    /// On a new layer: the visible image the strokes sample, with the strokes so far.
+    work: Option<Surface>,
+    /// The sampled image before the current stroke, retained across frame batches.
+    source: Option<(usize, Surface)>,
+    /// The target layer's pixels as painted so far.
+    out: Surface,
+    /// Strokes painted: those before `.0`, and the first `.1` points of stroke `.0`.
+    done: (usize, usize),
+    /// Preview keys shown, each with the area changed since the previous one (the first since
+    /// the document).
+    keys: Vec<(u64, Rect)>,
+    shown: Arc<Document>,
 }
 
 /// The clipboard image shown pasted onto the plane.
 struct Clip {
+    /// The clipboard pixels and their content bounds, which the preview pastes like OK does.
+    surface: Surface,
+    rect: Rect,
     texture: TextureHandle,
     width: f64,
     height: f64,
@@ -50,7 +128,10 @@ pub struct VpSession {
     pub document: DocId,
     pub layer: LayerId,
     canvas: Rect,
+    /// The planes' corners; torn-off planes' are derived from their parents ([`Self::resolve`]).
     pub planes: Vec<VpPlane>,
+    /// Per plane: how it was torn off, or `None` for a drawn plane (always the first one).
+    pub torn: Vec<Option<Torn>>,
     pub tool: VpTool,
     /// Corners clicked so far with Create Plane.
     pending: Vec<[f64; 2]>,
@@ -66,26 +147,76 @@ pub struct VpSession {
     pub new_layer: bool,
     clip: Option<Clip>,
     drag: Option<Drag>,
+    pub stamp: StampOptions,
+    /// Stamp source (Alt-click), image px.
+    pub source: Option<[f64; 2]>,
+    /// Clone strokes painted so far, sent as `"clone"` on OK.
+    pub strokes: Vec<CloneSpec>,
+    /// The first stroke's (source, start) since the source was set: Aligned strokes keep its offset.
+    aligned_ref: Option<([f64; 2], [f64; 2])>,
+    /// Bumped whenever the planes or the strokes change other than by painting on.
+    rev: u64,
+    /// The document as the session began (the preview paints over it).
+    base: Arc<Document>,
+    doc_revision: u64,
+    preview: Option<StampPreview>,
     history: EditHistory<VpEdit>,
 }
 
-/// What ⌘Z steps through: the planes and where the paste sits on them.
-type VpEdit = (Vec<VpPlane>, [f64; 2], f64);
+/// What ⌘Z steps through: the planes (and how they were torn off), where the paste sits on
+/// them, and the clone source and strokes.
+#[derive(Clone, PartialEq)]
+struct VpEdit {
+    planes: Vec<VpPlane>,
+    torn: Vec<Option<Torn>>,
+    paste_at: [f64; 2],
+    paste_width: f64,
+    source: Option<[f64; 2]>,
+    strokes: Vec<CloneSpec>,
+    aligned_ref: Option<([f64; 2], [f64; 2])>,
+}
 
 /// Most planes a session holds (the control channel can't make it allocate without bound).
 const MAX_PLANES: usize = 64;
 /// Most grid lines drawn per direction.
 const MAX_LINES: usize = 200;
+/// Preview keys of the stamp preview: `PREVIEW_KEY + id` (see `canvas::display_doc`).
+const PREVIEW_KEY: u64 = 1 << 42;
+
+fn union(a: Rect, b: Rect) -> Rect {
+    if a.is_empty() {
+        b
+    } else if b.is_empty() {
+        a
+    } else {
+        a.union(&b)
+    }
+}
 
 impl VpSession {
     pub fn describe(&self) -> Value {
         let center = self.center();
-        let planes: Vec<Value> = self.planes.iter().map(|p| json!({"corners": p.corners, "check": p.check(center)})).collect();
+        let planes: Vec<Value> = self
+            .planes
+            .iter()
+            .enumerate()
+            .map(|(i, p)| {
+                let mut v = json!({"corners": p.corners, "check": p.check(center)});
+                if let Some(t) = self.torn.get(i).copied().flatten() {
+                    v["tornOff"] = json!(t);
+                }
+                v
+            })
+            .collect();
         json!({
             "document": self.document.0,
             "layer": self.layer.0,
             "tool": self.tool,
             "planes": planes,
+            "stamp": self.stamp,
+            "source": self.source,
+            "strokes": self.strokes.len(),
+            "dabs": self.dabs(),
             "pending": self.pending,
             "selected": self.selected,
             "gridSize": self.grid_size,
@@ -127,25 +258,98 @@ impl VpSession {
         self.selected.filter(|i| *i < self.planes.len()).or_else(|| (!self.planes.is_empty()).then_some(0))
     }
 
+    /// What OK pastes: the plane, the top-left and the width.
+    fn paste_key(&self) -> Option<(usize, [f64; 2], f64)> {
+        self.paste_plane().map(|i| (i, self.paste_at, self.paste_width))
+    }
+
+    /// The stamp preview is current and already shows the paste under the strokes.
+    fn preview_has_paste(&self) -> bool {
+        self.preview.as_ref().is_some_and(|p| p.baked && p.rev == self.rev && p.paste == self.paste_key())
+    }
+
+    /// The paste is dragged while the stamp preview holds it in its old place.
+    fn moving_baked_paste(&self) -> bool {
+        matches!(self.drag, Some(Drag::Paste { .. })) && self.preview.as_ref().is_some_and(|p| p.baked)
+    }
+
+    /// [`draw_content`] draws the paste overlay: not when the stamp preview shows the paste, and
+    /// not while a plane drag freezes that preview (as it freezes the strokes) until release.
+    fn paste_overlay(&self) -> bool {
+        let frozen = matches!(self.drag, Some(Drag::Corner { .. } | Drag::Edge { .. } | Drag::Torn { .. })) && self.preview.as_ref().is_some_and(|p| p.baked);
+        !self.preview_has_paste() && !frozen
+    }
+
     /// Size of the pasted image in plane coordinates (the engine keeps its metric aspect).
     fn paste_extent(&self, lu: f64, lv: f64) -> Option<[f64; 2]> {
         let c = self.clip.as_ref()?;
         Some([self.paste_width, self.paste_width * lu / lv * c.height / c.width.max(1.0)])
     }
 
-    /// The command's params: the planes, and the paste when there is one.
+    /// The command's params: the planes (torn-off ones as such), the paste and the clone
+    /// strokes when there are any.
     pub fn params(&self) -> Value {
-        let planes: Vec<Value> = self.planes.iter().map(|p| json!({"corners": p.corners})).collect();
+        let planes: Vec<Value> = self
+            .planes
+            .iter()
+            .enumerate()
+            .map(|(i, p)| match self.torn.get(i).copied().flatten() {
+                Some(t) => json!({"from": t.from, "edge": t.edge, "angle": t.angle, "depth": t.depth}),
+                None => json!({"corners": p.corners}),
+            })
+            .collect();
         let mut p = json!({"planes": planes});
         if let Some(i) = self.paste_plane() {
             p["paste"] = json!([{"plane": i, "at": self.paste_at, "width": self.paste_width}]);
         }
+        if !self.strokes.is_empty() {
+            let clone: Vec<Value> = self
+                .strokes
+                .iter()
+                .map(|c| json!({"source": c.source, "points": c.points, "size": c.size, "hardness": c.hardness * 100.0, "opacity": c.opacity * 100.0}))
+                .collect();
+            p["clone"] = json!(clone);
+        }
         if self.new_layer {
             p["newLayer"] = json!(true);
         }
         p
     }
 
+    fn dabs(&self) -> usize {
+        self.strokes.iter().map(|c| c.points.len()).sum()
+    }
+
+    /// Recomputes the torn-off planes' corners from their parents, in order (the way the engine
+    /// builds the scene), so they follow every edit. A plane that can't be torn off any more
+    /// (it would lie behind the camera) collapses to an invalid one.
+    fn resolve(&mut self) {
+        self.rev += 1;
+        self.torn.resize(self.planes.len(), None);
+        let Some(first) = self.planes.first().cloned() else { return };
+        let fallback = f64::from(self.canvas.width().max(self.canvas.height()));
+        let mut sc = Scene::new(first, self.center(), None, fallback);
+        for i in 1..self.planes.len() {
+            match self.torn.get(i).copied().flatten().filter(|t| t.from < i) {
+                Some(t) => {
+                    if sc.tear_off(t.from, t.edge, t.angle, t.depth).is_none() {
+                        sc.planes.push(VpPlane { corners: [[0.0; 2]; 4] });
+                    }
+                }
+                None => sc.planes.push(self.planes[i].clone()),
+            }
+        }
+        self.planes = sc.planes;
+    }
+
+    fn push_plane(&mut self, plane: VpPlane, torn: Option<Torn>) {
+        self.torn.resize(self.planes.len(), None);
+        self.planes.push(plane);
+        self.torn.push(torn);
+        self.selected = Some(self.planes.len() - 1);
+        self.resolve();
+    }
+
     fn add_corner(&mut self, p: [f64; 2]) {
         if self.planes.len() >= MAX_PLANES {
             return;
@@ -153,15 +357,22 @@ impl VpSession {
         self.pending.push(p);
         if let Ok(corners) = <[[f64; 2]; 4]>::try_from(self.pending.as_slice()) {
             self.pending.clear();
-            self.planes.push(VpPlane { corners }.normalized());
-            self.selected = Some(self.planes.len() - 1);
+            self.push_plane(VpPlane { corners }.normalized(), None);
             // Photoshop hands over to Edit Plane once a plane is closed.
             self.tool = VpTool::EditPlane;
         }
     }
 
     fn edit(&self) -> VpEdit {
-        (self.planes.clone(), self.paste_at, self.paste_width)
+        VpEdit {
+            planes: self.planes.clone(),
+            torn: self.torn.clone(),
+            paste_at: self.paste_at,
+            paste_width: self.paste_width,
+            source: self.source,
+            strokes: self.strokes.clone(),
+            aligned_ref: self.aligned_ref,
+        }
     }
 
     fn settle(&mut self, busy: bool) {
@@ -172,19 +383,268 @@ impl VpSession {
     pub(crate) fn step(&mut self, step: Step) {
         let mut now = self.edit();
         if self.history.step(&mut now, step) {
-            (self.planes, self.paste_at, self.paste_width) = now;
+            let VpEdit { planes, torn, paste_at, paste_width, source, strokes, aligned_ref } = now;
+            (self.planes, self.torn, self.paste_at, self.paste_width) = (planes, torn, paste_at, paste_width);
+            (self.source, self.strokes, self.aligned_ref) = (source, strokes, aligned_ref);
             self.drag = None;
+            self.pending.clear();
             self.selected = self.selected.filter(|i| *i < self.planes.len());
+            // The stamp preview repaints from scratch.
+            self.rev += 1;
         }
     }
 
+    /// Deletes the selected plane; planes torn off it keep their place as drawn planes.
     fn delete_selected(&mut self) {
         if let Some(i) = self.selected.take().filter(|i| *i < self.planes.len()) {
+            self.torn.resize(self.planes.len(), None);
             self.planes.remove(i);
+            self.torn.remove(i);
+            for t in self.torn.iter_mut() {
+                match t {
+                    Some(c) if c.from == i => *t = None,
+                    Some(c) if c.from > i => c.from -= 1,
+                    _ => {}
+                }
+            }
             self.drag = None;
+            self.resolve();
         }
     }
 
+    /// Starts tearing a plane off edge `edge` of plane `from` at the press `p`.
+    fn tear_off(&mut self, from: usize, edge: usize, p: [f64; 2]) {
+        if self.planes.len() >= MAX_PLANES {
+            return;
+        }
+        let Some(&e) = EDGES.get(edge) else { return };
+        self.push_plane(VpPlane { corners: [[0.0; 2]; 4] }, Some(Torn { from, edge: e, angle: 90.0, depth: 0.5 }));
+        // As after closing a plane, Edit Plane takes over.
+        self.tool = VpTool::EditPlane;
+        self.pending.clear();
+        self.drag = Some(Drag::Torn { plane: self.planes.len() - 1, rotate: false, start: p, moved: false });
+    }
+
+    /// Fits torn plane `i`'s depth (or with `rotate` its angle) so its far edge's middle is as
+    /// near `p` as it can get.
+    fn fit_torn(&mut self, i: usize, rotate: bool, p: [f64; 2]) {
+        let Some(t) = self.torn.get(i).copied().flatten() else { return };
+        let Some(first) = self.planes.first().cloned() else { return };
+        if t.from >= i || i >= self.planes.len() {
+            return;
+        }
+        let fallback = f64::from(self.canvas.width().max(self.canvas.height()));
+        let mut sc = Scene::new(first, self.center(), None, fallback);
+        sc.planes.extend(self.planes.iter().take(i).skip(1).cloned());
+        let e = edge_index(t.edge);
+        let mut miss = |angle: f64, depth: f64| -> f64 {
+            if sc.tear_off(t.from, t.edge, angle, depth).is_none() {
+                return f64::MAX;
+            }
+            let Some(c) = sc.planes.pop().map(|pl| pl.corners) else { return f64::MAX };
+            let (a, b) = (c[e], c[(e + 1) % 4]);
+            let d = ((a[0] + b[0]) / 2.0 - p[0]).hypot((a[1] + b[1]) / 2.0 - p[1]);
+            if d.is_finite() { d } else { f64::MAX }
+        };
+        let best = |values: &mut dyn Iterator<Item = f64>, miss: &mut dyn FnMut(f64) -> f64| {
+            values.map(|v| (miss(v), v)).filter(|m| m.0 < f64::MAX).min_by(|a, b| a.0.total_cmp(&b.0)).map(|m| m.1)
+        };
+        let (angle, depth) = if rotate {
+            let Some(a) = best(&mut (1..180).map(f64::from), &mut |a| miss(a, t.depth)) else { return };
+            let a = best(&mut (-10..=10).map(|k| a + f64::from(k) / 10.0), &mut |a| miss(a, t.depth)).unwrap_or(a);
+            (a.clamp(1.0, 179.0), t.depth)
+        } else {
+            let Some(d) = best(&mut (0..=160).map(|k| 0.02 * 1.06f64.powi(k)), &mut |d| miss(t.angle, d)) else { return };
+            let d = best(&mut (-10..=10).map(|k| d * (1.0 + f64::from(k) * 0.006)), &mut |d| miss(t.angle, d)).unwrap_or(d);
+            (t.angle, d.clamp(0.02, 1000.0))
+        };
+        if let Some(Some(t)) = self.torn.get_mut(i) {
+            t.angle = angle;
+            t.depth = depth;
+        }
+        self.resolve();
+    }
+
+    /// Stamp press: Alt sets the source, otherwise a stroke starts. Returns a status message.
+    fn stamp_press(&mut self, p: [f64; 2], alt: bool) -> Option<&'static str> {
+        let sc = self.scene()?;
+        let on_plane = |q: [f64; 2]| sc.plane_at(q).is_some();
+        if alt {
+            if !on_plane(p) {
+                return Some(tl!("Alt-click a plane to set the clone source"));
+            }
+            self.source = Some(p);
+            self.aligned_ref = None;
+            return None;
+        }
+        let Some(source) = self.source else { return Some(tl!("Alt-click a plane to set the clone source")) };
+        if !on_plane(p) {
+            return None;
+        }
+        if self.strokes.len() >= MAX_CLONE_STROKES || self.dabs() >= MAX_CLONE_DABS {
+            return Some(tl!("Too many clone strokes: apply Vanishing Point first"));
+        }
+        let src = match self.aligned_ref.filter(|_| self.stamp.aligned) {
+            Some((s0, a0)) => clone_source(&sc, s0, a0, p).filter(|s| on_plane(*s)).unwrap_or(source),
+            None => source,
+        };
+        if self.aligned_ref.is_none() {
+            self.aligned_ref = Some((src, p));
+        }
+        let o = self.stamp;
+        self.strokes.push(CloneSpec { source: src, points: vec![p], size: o.diameter, hardness: o.hardness / 100.0, opacity: o.opacity / 100.0 });
+        self.drag = Some(Drag::Stamp);
+        None
+    }
+
+    /// Extends the current stroke to `p` with dabs a tenth of the brush apart.
+    fn stamp_to(&mut self, p: [f64; 2]) {
+        let room = MAX_CLONE_DABS.saturating_sub(self.dabs());
+        let Some(c) = self.strokes.last_mut() else { return };
+        let Some(last) = c.points.last().copied() else { return };
+        let step = (c.size * 0.1).max(1.0);
+        let d = (p[0] - last[0]).hypot(p[1] - last[1]);
+        if !d.is_finite() || d < step {
+            return;
+        }
+        let n = ((d / step) as usize).min(room);
+        c.points.extend((1..=n).map(|k| {
+            let t = k as f64 * step / d;
+            [last[0] + (p[0] - last[0]) * t, last[1] + (p[1] - last[1]) * t]
+        }));
+    }
+
+    /// Paints what the preview doesn't show yet (all of it after the planes changed). `key`
+    /// names a new preview. False when nothing changed.
+    fn paint_preview(&mut self, key: impl FnOnce() -> u64) -> bool {
+        if self.strokes.is_empty() {
+            let had = self.preview.is_some();
+            self.preview = None;
+            return had;
+        }
+        let Some(sc) = self.scene() else {
+            // No planes left: nothing to show the strokes on.
+            return self.preview.take().is_some();
+        };
+        let paste = self.paste_key();
+        let canvas = self.canvas;
+        let stale = self.preview.as_ref().is_none_or(|p| p.rev != self.rev || p.new_layer != self.new_layer || p.paste != paste);
+        let mut area = Rect::EMPTY;
+        let mut baked = false;
+        if stale {
+            let Some(layer) = self.base.layer(self.layer).and_then(Layer::surface) else {
+                // The layer is gone (or no longer pixels): nothing to show the strokes on.
+                return self.preview.take().is_some();
+            };
+            let mut out = if self.new_layer { Surface::new(layer.format()) } else { layer.clone() };
+            // OK pastes first and the strokes then paint over (and sample) the pasted pixels.
+            if let (Some((i, at, width)), Some(c)) = (paste, self.clip.as_ref())
+                && self.planes.get(i).is_some_and(|p| p.check(self.center()) != PlaneCheck::Invalid)
+                && let Ok(r) = paste_onto(&sc, &mut out, i, &c.surface, c.rect, at, width)
+            {
+                area = r.intersect(&canvas);
+                baked = !r.is_empty();
+            }
+            let work = self.new_layer.then(|| {
+                let mut w = visible_image(&self.base);
+                over(&mut w, &out);
+                w
+            });
+            // The old preview's area changes back too.
+            let keys = self.preview.take().map(|p| p.keys).unwrap_or_default();
+            area = keys.iter().fold(area, |a, k| union(a, k.1));
+            self.preview = Some(StampPreview {
+                rev: self.rev,
+                new_layer: self.new_layer,
+                paste,
+                baked,
+                work,
+                source: None,
+                out,
+                done: (0, 0),
+                keys,
+                shown: self.base.clone(),
+            });
+        }
+        let Some(pv) = self.preview.as_mut() else { return false };
+        let (from_stroke, from_point) = pv.done;
+        for (si, c) in self.strokes.iter().enumerate().skip(from_stroke) {
+            let skip = if si == from_stroke { from_point } else { 0 };
+            let (Some(anchor), Some(points)) = (c.points.first(), c.points.get(skip..)) else { continue };
+            if points.is_empty() {
+                continue;
+            }
+            if pv.source.as_ref().is_none_or(|(stroke, _)| *stroke != si) {
+                pv.source = Some((si, pv.work.as_ref().unwrap_or(&pv.out).clone()));
+            }
+            let Some((_, source)) = pv.source.as_ref() else { continue };
+            let (hard, opacity) = (c.hardness, c.opacity as f32);
+            let changed = match pv.work.as_mut() {
+                Some(work) => {
+                    let before = work.clone();
+                    let (_, a) = clone_dabs_from(&sc, work, source, c.source, *anchor, points, c.size, hard, opacity, Some(canvas));
+                    // As OK does: only the canvas (the dabs' boxes can span far off it).
+                    let a = a.intersect(&canvas);
+                    copy_changed(&mut pv.out, &before, work, a);
+                    a
+                }
+                None => clone_dabs_from(&sc, &mut pv.out, source, c.source, *anchor, points, c.size, hard, opacity, Some(canvas)).1,
+            };
+            area = union(area, changed);
+        }
+        pv.done = (self.strokes.len() - 1, self.strokes.last().map_or(0, |c| c.points.len()));
+        if area.is_empty() && !stale {
+            return false;
+        }
+        let mut d = (*self.base).clone();
+        if self.new_layer {
+            let mut l = Layer::raster(d.next_layer_name("Vanishing Point"), d.pixel_format());
+            l.content = LayerContent::Raster(pv.out.clone());
+            d.insert_above(Some(self.layer), l);
+        } else if let Some(LayerContent::Raster(s)) = d.layer_mut(self.layer).map(|l| &mut l.content) {
+            *s = pv.out.clone();
+        }
+        pv.shown = Arc::new(d);
+        pv.keys.push((key(), area));
+        true
+    }
+
+    /// The document with the strokes painted, and its preview key. Not while the paste is
+    /// dragged out of its baked-in place: the overlay follows the pointer instead, and the
+    /// strokes repaint over it on release.
+    pub(crate) fn shown(&self) -> Option<(Arc<Document>, u64)> {
+        let p = self.preview.as_ref()?;
+        if self.moving_baked_paste() {
+            return None;
+        }
+        Some((p.shown.clone(), PREVIEW_KEY + p.keys.last()?.0))
+    }
+
+    /// [`Self::shown`], only on the document at the revision the strokes were painted on.
+    pub(crate) fn shown_on(&self, doc: DocId, revision: u64) -> Option<(Arc<Document>, u64)> {
+        if self.document != doc || self.doc_revision != revision {
+            return None;
+        }
+        self.shown()
+    }
+
+    /// The document changed under the mode (a menu command, the Layers panel): paint the
+    /// strokes over it as it is now, as OK will.
+    fn rebase(&mut self, doc: &Arc<Document>, revision: u64) {
+        if doc.id != self.document || revision == self.doc_revision {
+            return;
+        }
+        if Arc::ptr_eq(doc, &self.base) {
+            // A view change (layer selection, channel view): the same pixels, keep the preview.
+            self.doc_revision = revision;
+            return;
+        }
+        self.base = doc.clone();
+        self.doc_revision = revision;
+        self.canvas = doc.bounds();
+        self.preview = None;
+    }
+
     /// Image positions of the edge nodes of plane `i`.
     fn edge_nodes(&self, i: usize) -> Option<[[f64; 2]; 4]> {
         let h = self.planes.get(i)?.homography()?;
@@ -195,20 +655,40 @@ impl VpSession {
         Some([at(0.5, 0.0), at(1.0, 0.5), at(0.5, 1.0), at(0.0, 0.5)])
     }
 
-    fn press(&mut self, p: [f64; 2], tol: f64) {
-        if self.tool == VpTool::CreatePlane {
-            self.add_corner(p);
-            return;
+    fn press(&mut self, p: [f64; 2], tol: f64, mods: egui::Modifiers) -> Option<&'static str> {
+        if self.tool == VpTool::Stamp {
+            return self.stamp_press(p, mods.alt);
         }
         let near = |c: [f64; 2]| (c[0] - p[0]).hypot(c[1] - p[1]) <= tol;
         // The selected plane's nodes win over the others'.
         let order: Vec<usize> = self.selected.into_iter().chain((0..self.planes.len()).rev()).filter(|i| *i < self.planes.len()).collect();
+        // Ctrl/Cmd on an edge node tears off a perpendicular plane (with either plane tool).
+        if mods.command
+            && let Some((i, e)) = order.iter().find_map(|&i| Some((i, self.edge_nodes(i)?.iter().position(|c| near(*c))?)))
+        {
+            self.tear_off(i, e, p);
+            return None;
+        }
+        if self.tool == VpTool::CreatePlane {
+            self.add_corner(p);
+            return None;
+        }
         for &i in &order {
+            // A torn-off plane follows its parent: only its far edge node drags (depth, or
+            // with Alt the angle).
+            if let Some(t) = self.torn.get(i).copied().flatten() {
+                if self.edge_nodes(i).and_then(|n| n.get(edge_index(t.edge)).copied()).is_some_and(near) {
+                    self.selected = Some(i);
+                    self.drag = Some(Drag::Torn { plane: i, rotate: mods.alt, start: p, moved: false });
+                    return None;
+                }
+                continue;
+            }
             if let Some(ci) = self.planes[i].corners.iter().position(|c| near(*c)) {
                 let c = self.planes[i].corners[ci];
                 self.selected = Some(i);
                 self.drag = Some(Drag::Corner { plane: i, corner: ci, offset: [c[0] - p[0], c[1] - p[1]] });
-                return;
+                return None;
             }
             if let Some(e) = self.edge_nodes(i).and_then(|n| n.iter().position(|c| near(*c)))
                 && let Some(h) = self.planes[i].homography()
@@ -216,7 +696,7 @@ impl VpSession {
             {
                 self.selected = Some(i);
                 self.drag = Some(Drag::Edge { plane: i, edge: e, h, inv });
-                return;
+                return None;
             }
         }
         if let Some(i) = self.paste_plane()
@@ -228,19 +708,30 @@ impl VpSession {
             let (a, b) = (self.paste_at, [self.paste_at[0] + ext[0], self.paste_at[1] + ext[1]]);
             if (a[0]..=b[0]).contains(&u) && (a[1]..=b[1]).contains(&v) {
                 self.drag = Some(Drag::Paste { offset: [a[0] - u, a[1] - v] });
-                return;
+                return None;
             }
         }
         self.selected = self.scene().and_then(|sc| sc.plane_at(p));
+        None
     }
 
     fn drag_to(&mut self, p: [f64; 2]) {
-        match &self.drag {
+        match &mut self.drag {
             Some(Drag::Corner { plane, corner, offset }) => {
                 if let Some(c) = self.planes.get_mut(*plane).and_then(|pl| pl.corners.get_mut(*corner)) {
                     *c = [p[0] + offset[0], p[1] + offset[1]];
                 }
+                self.resolve();
             }
+            Some(Drag::Torn { plane, rotate, start, moved }) => {
+                // A click without a drag leaves the plane as it is.
+                *moved |= (p[0] - start[0]).hypot(p[1] - start[1]) > 2.0;
+                if *moved {
+                    let (i, r) = (*plane, *rotate);
+                    self.fit_torn(i, r, p);
+                }
+            }
+            Some(Drag::Stamp) => self.stamp_to(p),
             Some(Drag::Edge { plane, edge, h, inv }) => {
                 let (u, v) = inv.apply(p[0], p[1]);
                 // The plane's (u, v) rectangle after the move.
@@ -255,6 +746,7 @@ impl VpSession {
                 {
                     pl.corners = q;
                 }
+                self.resolve();
             }
             Some(Drag::Paste { offset }) => {
                 let offset = *offset;
@@ -303,10 +795,13 @@ pub fn begin(app: &mut PhotocraftApp, ctx: &egui::Context) -> Result<(), String>
         None => return Err("no active layer".into()),
     }
     let canvas = st.doc.bounds();
+    let (base, doc_revision) = (st.doc.clone(), st.revision);
     let key = app.ui.alloc_id();
     let clip = app.session.clipboard.as_ref().and_then(|c| {
         let r = c.surface.content_bounds();
         (!r.is_empty()).then(|| Clip {
+            surface: c.surface.clone(),
+            rect: r,
             texture: ctx.load_texture(format!("vp-paste-{key}"), crate::distort_ui::surface_image(&c.surface, r, 1024), egui::TextureOptions::LINEAR),
             width: f64::from(r.width()),
             height: f64::from(r.height()),
@@ -317,6 +812,7 @@ pub fn begin(app: &mut PhotocraftApp, ctx: &egui::Context) -> Result<(), String>
         layer,
         canvas,
         planes: Vec::new(),
+        torn: Vec::new(),
         tool: VpTool::CreatePlane,
         pending: Vec::new(),
         selected: None,
@@ -327,14 +823,30 @@ pub fn begin(app: &mut PhotocraftApp, ctx: &egui::Context) -> Result<(), String>
         new_layer: false,
         clip,
         drag: None,
-        history: EditHistory::new(&(Vec::new(), [0.25, 0.25], 0.5)),
+        stamp: StampOptions { diameter: 40.0, hardness: 50.0, opacity: 100.0, aligned: true },
+        source: None,
+        strokes: Vec::new(),
+        aligned_ref: None,
+        rev: 0,
+        base,
+        doc_revision,
+        preview: None,
+        history: EditHistory::new(&VpEdit {
+            planes: Vec::new(),
+            torn: Vec::new(),
+            paste_at: [0.25, 0.25],
+            paste_width: 0.5,
+            source: None,
+            strokes: Vec::new(),
+            aligned_ref: None,
+        }),
     });
     app.ui.status = tl!("Vanishing Point: click four corners to create a plane").into();
     Ok(())
 }
 
-/// OK: runs `filter.vanishingPoint` with the planes (and the paste). An invalid plane keeps the
-/// mode open; with nothing to paste the mode just closes.
+/// OK: runs `filter.vanishingPoint` with the planes (and the paste and the clone strokes). An
+/// invalid plane keeps the mode open; with nothing to paste or clone the mode just closes.
 pub fn commit(app: &mut PhotocraftApp) -> Result<Value, String> {
     let Some(s) = app.distort.vanishing.as_ref() else { return Ok(Value::Null) };
     let center = s.center();
@@ -343,12 +855,27 @@ pub fn commit(app: &mut PhotocraftApp) -> Result<Value, String> {
         app.ui.status = msg.into();
         return Err(msg.into());
     }
-    let params = s.params();
-    app.distort.vanishing = None;
-    if params.get("paste").is_none() {
+    let mut params = s.params();
+    // The layer the mode was opened on, when another one was picked meanwhile (the mode isn't
+    // modal). Left out otherwise, so a recorded action stays portable.
+    if let Some(st) = app.session.active()
+        && st.active_layer != Some(s.layer)
+        && st.doc.layer(s.layer).is_some()
+    {
+        params["layer"] = json!(s.layer.0);
+    }
+    let session = app.distort.vanishing.take();
+    if params.get("paste").is_none() && params.get("clone").is_none() {
         return Ok(json!({"committed": false}));
     }
-    app.run(VP, params).map(|r| json!({"committed": true, "result": r}))
+    match app.run(VP, params) {
+        Ok(r) => Ok(json!({"committed": true, "result": r})),
+        Err(e) => {
+            // Keep the planes, source and strokes so the user can fix the cause and retry.
+            app.distort.vanishing = session;
+            Err(e)
+        }
+    }
 }
 
 /// Control channel: `filter.vanishingPoint {"ui": {...}}` while the mode is active.
@@ -365,19 +892,39 @@ pub fn control(app: &mut PhotocraftApp, ui: &Value) -> Result<Value, String> {
         s.tool = match t {
             "edit" | "editPlane" => VpTool::EditPlane,
             "create" | "createPlane" => VpTool::CreatePlane,
-            other => return Err(format!("tool: edit|create, not `{other}`")),
+            "stamp" => VpTool::Stamp,
+            other => return Err(format!("tool: edit|create|stamp, not `{other}`")),
         };
         s.pending.clear();
     }
     if let Some(p) = ui.get("planes") {
-        let planes: Vec<VpPlane> = serde_json::from_value(p.clone()).map_err(|e| format!("bad planes: {e}"))?;
-        if planes.len() > MAX_PLANES {
-            return Err(format!("at most {MAX_PLANES} planes"));
-        }
+        let (planes, torn) = parse_planes(p)?;
         s.planes = planes;
+        s.torn = torn;
         // A drag holds indices into the old list.
         s.drag = None;
         s.selected = (!s.planes.is_empty()).then(|| s.planes.len() - 1);
+        s.resolve();
+    }
+    if let Some(o) = ui.get("stamp") {
+        let num = |k: &str, lo: f64, hi: f64| o.get(k).and_then(Value::as_f64).filter(|v| v.is_finite()).map(|v| v.clamp(lo, hi));
+        let st = &mut s.stamp;
+        st.diameter = num("diameter", 1.0, 2000.0).unwrap_or(st.diameter);
+        st.hardness = num("hardness", 0.0, 100.0).unwrap_or(st.hardness);
+        st.opacity = num("opacity", 0.0, 100.0).unwrap_or(st.opacity);
+        st.aligned = o.get("aligned").and_then(Value::as_bool).unwrap_or(st.aligned);
+    }
+    if let Some(src) = ui.get("source") {
+        s.source = match src {
+            Value::Null => None,
+            v => Some(pt(v).ok_or("source: [x, y]")?),
+        };
+        s.aligned_ref = None;
+    }
+    if let Some(c) = ui.get("clone") {
+        s.strokes = photocraft_engine::vp_cmds::clone_specs(&json!({"clone": c})).map_err(|e| e.to_string())?;
+        s.drag = None;
+        s.rev += 1;
     }
     if let Some(i) = ui.get("select").and_then(Value::as_u64) {
         s.selected = usize::try_from(i).ok().filter(|i| *i < s.planes.len());
@@ -398,14 +945,92 @@ pub fn control(app: &mut PhotocraftApp, ui: &Value) -> Result<Value, String> {
         s.new_layer = b;
     }
     s.settle(false);
-    Ok(s.describe())
+    sync_preview(app);
+    Ok(app.distort.vanishing.as_ref().map(VpSession::describe).unwrap_or(Value::Null))
 }
 
-pub fn pointer(app: &mut PhotocraftApp, ev: ToolEvent, _mods: egui::Modifiers) {
+fn pt(v: &Value) -> Option<[f64; 2]> {
+    let p = [v.get(0)?.as_f64()?, v.get(1)?.as_f64()?];
+    p.iter().all(|x| x.is_finite() && x.abs() < 1e7).then_some(p)
+}
+
+/// The control channel's planes, in the command's form: `{"corners": [[x, y]×4]}` or
+/// `{"from": earlier plane, "edge", "angle": 90, "depth": 1}`.
+fn parse_planes(v: &Value) -> Result<(Vec<VpPlane>, Vec<Option<Torn>>), String> {
+    let list = v.as_array().ok_or("planes: a list")?;
+    if list.len() > MAX_PLANES {
+        return Err(format!("at most {MAX_PLANES} planes"));
+    }
+    let (mut planes, mut torn) = (Vec::new(), Vec::new());
+    for (i, p) in list.iter().enumerate() {
+        if let Some(c) = p.get("corners") {
+            let c = c.as_array().filter(|c| c.len() == 4).ok_or(format!("plane {i}: four corners"))?;
+            let corners = [0, 1, 2, 3].map(|k| c.get(k).and_then(pt));
+            let [Some(a), Some(b), Some(c), Some(d)] = corners else { return Err(format!("plane {i}: corners are [x, y]")) };
+            planes.push(VpPlane { corners: [a, b, c, d] });
+            torn.push(None);
+            continue;
+        }
+        let from = p
+            .get("from")
+            .and_then(Value::as_u64)
+            .and_then(|f| usize::try_from(f).ok())
+            .filter(|f| *f < i)
+            .ok_or(format!("plane {i}: `corners` or `from` (an earlier plane)"))?;
+        let edge = match p.get("edge").and_then(Value::as_str).unwrap_or("top") {
+            "top" => Edge::Top,
+            "right" => Edge::Right,
+            "bottom" => Edge::Bottom,
+            "left" => Edge::Left,
+            e => return Err(format!("plane {i}: unknown edge `{e}`")),
+        };
+        let angle = p.get("angle").and_then(Value::as_f64).unwrap_or(90.0);
+        let depth = p.get("depth").and_then(Value::as_f64).unwrap_or(1.0);
+        if !(0.0..=360.0).contains(&angle) || !(depth > 0.0 && depth <= 1000.0) {
+            return Err(format!("plane {i}: angle 0..360, depth above 0 and at most 1000"));
+        }
+        planes.push(VpPlane { corners: [[0.0; 2]; 4] });
+        torn.push(Some(Torn { from, edge, angle, depth }));
+    }
+    Ok((planes, torn))
+}
+
+/// Brings the stamp preview up to date with the strokes (and repaints it after the planes
+/// changed, once no plane is being dragged).
+pub(crate) fn sync_preview(app: &mut PhotocraftApp) {
+    let Some(s) = app.distort.vanishing.as_mut() else { return };
+    if let Some(st) = app.session.active() {
+        s.rebase(&st.doc, st.revision);
+    }
+    if matches!(s.drag, Some(Drag::Corner { .. } | Drag::Edge { .. } | Drag::Torn { .. } | Drag::Paste { .. })) {
+        return;
+    }
+    let ui = &mut app.ui;
+    s.paint_preview(|| ui.alloc_id());
+}
+
+/// What changed between stamp preview (or document) key `seen` and `now` of document `doc` at
+/// `revision`: the areas the strokes painted. `None` when either key isn't the session's.
+pub(crate) fn damage(app: &PhotocraftApp, doc: DocId, revision: u64, seen: u64, now: u64) -> Option<Rect> {
+    let s = app.distort.vanishing.as_ref().filter(|s| s.base.id == doc && s.doc_revision == revision)?;
+    let keys = &s.preview.as_ref()?.keys;
+    let at = |k: u64| if k == 0 { Some(0) } else { keys.iter().position(|e| PREVIEW_KEY + e.0 == k).map(|i| i + 1) };
+    let (a, b) = (at(seen)?, at(now)?);
+    if a == b {
+        return None;
+    }
+    Some(keys.get(a.min(b)..a.max(b))?.iter().fold(Rect::EMPTY, |r, k| union(r, k.1)))
+}
+
+pub fn pointer(app: &mut PhotocraftApp, ev: ToolEvent, mods: egui::Modifiers) {
     let tol = crate::distort_ui::tolerance(app);
     let Some(s) = app.distort.vanishing.as_mut() else { return };
     match ev {
-        ToolEvent::Down { x, y, .. } => s.press([x, y], tol),
+        ToolEvent::Down { x, y, .. } => {
+            if let Some(msg) = s.press([x, y], tol, mods) {
+                app.ui.status = msg.into();
+            }
+        }
         ToolEvent::Move { x, y, .. } => s.drag_to([x, y]),
         ToolEvent::Up { x, y } => {
             s.drag_to([x, y]);
@@ -413,6 +1038,7 @@ pub fn pointer(app: &mut PhotocraftApp, ev: ToolEvent, _mods: egui::Modifiers) {
         }
     }
     s.settle(false);
+    sync_preview(app);
 }
 
 /// Keys while the mode is active (↩ and Esc are handled by `distort_ui::keys`).
@@ -428,10 +1054,14 @@ pub fn keys(app: &mut PhotocraftApp, ctx: &egui::Context) {
         s.pending.clear();
     } else if key(Key::C) {
         s.tool = VpTool::CreatePlane;
+    } else if key(Key::S) {
+        s.tool = VpTool::Stamp;
+        s.pending.clear();
     } else if key(Key::Delete) || key(Key::Backspace) {
         s.delete_selected();
         s.settle(false);
     }
+    sync_preview(app);
 }
 
 /// Esc: drops a half-clicked plane first, then leaves the mode.
@@ -443,10 +1073,12 @@ pub fn escape(app: &mut PhotocraftApp) {
 }
 
 /// The paste on its plane: image content, drawn under the grid and guides like the document so a
-/// guide stays visible across it (#7781). The planes and their grids are [`draw`].
+/// guide stays visible across it (#7781). The planes and their grids are [`draw`]. A current
+/// stamp preview already shows the paste under its strokes.
 pub fn draw_content(s: &VpSession, painter: &egui::Painter, xf: &ViewXform) {
     let scr = |p: [f64; 2]| xf.to_screen(p[0] as f32, p[1] as f32);
-    if let Some(i) = s.paste_plane()
+    if s.paste_overlay()
+        && let Some(i) = s.paste_plane()
         && s.planes.get(i).is_some_and(|p| p.check(s.center()) != PlaneCheck::Invalid)
         && let (Some((h, lu, lv)), Some(c)) = (s.frame(i), s.clip.as_ref())
         && let Some(ext) = s.paste_extent(lu, lv)
@@ -506,6 +1138,50 @@ pub fn draw(s: &VpSession, painter: &egui::Painter, xf: &ViewXform) {
             painter.rect_filled(egui::Rect::from_center_size(*c, egui::vec2(6.0, 6.0)), 0.0, tokens.accent);
         }
     }
+    if s.tool == VpTool::Stamp {
+        draw_stamp(s, painter, xf, &scr);
+    }
+}
+
+/// Stamp: the source as a crosshair and the brush under the pointer as the circle it paints on
+/// the plane, foreshortened.
+fn draw_stamp(s: &VpSession, painter: &egui::Painter, xf: &ViewXform, scr: &dyn Fn([f64; 2]) -> Pos2) {
+    let outline = |pts: &[Pos2]| {
+        painter.add(egui::Shape::closed_line(pts.to_vec(), Stroke::new(2.5, Color32::from_black_alpha(160))));
+        painter.add(egui::Shape::closed_line(pts.to_vec(), Stroke::new(1.0, Color32::WHITE)));
+    };
+    if let Some(src) = s.source {
+        let c = scr(src);
+        for (a, b) in [(egui::vec2(-7.0, 0.0), egui::vec2(7.0, 0.0)), (egui::vec2(0.0, -7.0), egui::vec2(0.0, 7.0))] {
+            painter.line_segment([c + a, c + b], Stroke::new(2.5, Color32::from_black_alpha(160)));
+            painter.line_segment([c + a, c + b], Stroke::new(1.0, Color32::WHITE));
+        }
+    }
+    let Some(hover) = painter.ctx().pointer_hover_pos() else { return };
+    let p = xf.to_doc(hover);
+    let Some(sc) = s.scene() else { return };
+    let Some(i) = sc.plane_at(p) else { return };
+    let Some((h, lu, lv)) = s.frame(i) else { return };
+    let Some(inv) = h.inverse() else { return };
+    let metric = |q: [f64; 2]| {
+        let (u, v) = inv.apply(q[0], q[1]);
+        [u * lu, v * lv]
+    };
+    let (m, probe) = (metric(p), metric([p[0] + s.stamp.diameter / 2.0, p[1]]));
+    let r = (probe[0] - m[0]).hypot(probe[1] - m[1]);
+    if !r.is_finite() || r <= 0.0 {
+        return;
+    }
+    let ring: Vec<Pos2> = (0..48)
+        .map(|k| {
+            let a = f64::from(k) / 48.0 * std::f64::consts::TAU;
+            let (x, y) = h.apply((m[0] + r * a.cos()) / lu, (m[1] + r * a.sin()) / lv);
+            scr([x, y])
+        })
+        .collect();
+    if ring.iter().all(|q| q.is_finite()) {
+        outline(&ring);
+    }
 }
 
 /// Plane coordinates (0..1, exclusive) of the grid lines across `u` (or `v`) for cells of
@@ -552,6 +1228,8 @@ fn draw_paste(painter: &egui::Painter, scr: &dyn Fn([f64; 2]) -> Pos2, h: &Homog
 }
 
 pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
+    // New Layer toggled last frame repaints the stamp preview.
+    sync_preview(app);
     let Some(s) = app.distort.vanishing.as_mut() else { return };
     if crate::widgets::pill_tab(ui, tl!("Edit Plane"), s.tool == VpTool::EditPlane).on_hover_text("V").clicked() {
         s.tool = VpTool::EditPlane;
@@ -560,10 +1238,30 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     if crate::widgets::pill_tab(ui, tl!("Create Plane"), s.tool == VpTool::CreatePlane).on_hover_text("C").clicked() {
         s.tool = VpTool::CreatePlane;
     }
+    if crate::widgets::pill_tab(ui, tl!("Stamp"), s.tool == VpTool::Stamp).on_hover_text("S").clicked() {
+        s.tool = VpTool::Stamp;
+        s.pending.clear();
+    }
     crate::widgets::vline(ui, 22.0);
+    if s.tool == VpTool::Stamp {
+        let st = &mut s.stamp;
+        for (label, value, range, unit) in [
+            (tl!("Diameter:"), &mut st.diameter, 1.0..=2000.0, "px"),
+            (tl!("Hardness:"), &mut st.hardness, 0.0..=100.0, "%"),
+            (tl!("Opacity:"), &mut st.opacity, 0.0..=100.0, "%"),
+        ] {
+            ui.label(label);
+            let mut v = *value as f32;
+            if crate::widgets::value_field(ui, &mut v, range, unit, 56.0).changed() {
+                *value = f64::from(v);
+            }
+        }
+        crate::widgets::checkbox(ui, &mut st.aligned, tl!("Aligned"));
+        crate::widgets::vline(ui, 22.0);
+    }
     ui.label(tl!("Grid Size:"));
     let mut g = s.grid_size as f32;
-    if crate::widgets::value_field(ui, &mut g, 2.0..=2000.0, "px", 56.0).changed() {
+    if crate::widgets::value_field(ui, &mut g, 2.0..=2000.0, "px", 56.0).accessible_name(tl!("Grid Size:")).changed() {
         s.grid_size = f64::from(g);
     }
     if s.clip.is_some() {
@@ -572,10 +1270,12 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
         if s.paste {
             ui.label(tl!("Width:"));
             let mut w = (s.paste_width * 100.0) as f32;
-            if crate::widgets::value_field(ui, &mut w, 1.0..=1000.0, "%", 56.0).changed() {
+            if crate::widgets::value_field(ui, &mut w, 1.0..=1000.0, "%", 56.0).accessible_name(tl!("Width:")).changed() {
                 s.paste_width = f64::from(w) / 100.0;
             }
         }
+    }
+    if s.clip.is_some() || !s.strokes.is_empty() || s.tool == VpTool::Stamp {
         crate::widgets::checkbox(ui, &mut s.new_layer, tl!("New Layer"));
     }
     ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
@@ -591,6 +1291,8 @@ pub fn options_bar(app: &mut PhotocraftApp, ui: &mut egui::Ui) {
     if let Some(s) = app.distort.vanishing.as_mut() {
         s.settle(ui.input(|i| i.pointer.any_down()));
     }
+    // A paste Width or Paste change shows in this frame's canvas, the paste under the strokes.
+    sync_preview(app);
 }
 
 #[cfg(test)]
@@ -648,4 +1350,365 @@ mod tests {
         assert!(l.rgba(x as i32, y as i32)[0] > 0.9, "{:?}", l.rgba(x as i32, y as i32));
         assert!(l.rgba(230, 20)[0] < 0.5, "outside the plane");
     }
+
+    #[test]
+    fn ctrl_drag_tears_off_a_wall_and_the_stamp_clones_in_one_step() {
+        let (ctx, mut app) = app_with_layer();
+        // A green mark near the floor's front edge to clone.
+        app.session.execute("select.rect", json!({"x": 100, "y": 135, "width": 40, "height": 8})).unwrap();
+        app.session.execute("edit.fill", json!({"color": "#00ff00"})).unwrap();
+        app.session.execute("select.deselect", json!({})).unwrap();
+        crate::distort_ui::menu(&mut app, &ctx, VP, &json!({})).unwrap().unwrap();
+        control(&mut app, &json!({"planes": [{"corners": [[70, 60], [170, 60], [220, 150], [20, 150]]}]})).unwrap();
+        let ev = |app: &mut PhotocraftApp, e: ToolEvent, m: egui::Modifiers| crate::distort_ui::pointer(app, e, m);
+        let drag = |app: &mut PhotocraftApp, a: [f64; 2], b: [f64; 2], m: egui::Modifiers| {
+            ev(app, ToolEvent::Down { x: a[0], y: a[1], pressure: 1.0 }, m);
+            ev(app, ToolEvent::Move { x: (a[0] + b[0]) / 2.0, y: (a[1] + b[1]) / 2.0, pressure: 1.0 }, m);
+            ev(app, ToolEvent::Up { x: b[0], y: b[1] }, m);
+        };
+        fn vp(app: &PhotocraftApp) -> &VpSession {
+            app.distort.vanishing.as_ref().unwrap()
+        }
+
+        // Ctrl/Cmd-drag the top edge node up: a wall torn off the floor's far edge, 90° to it.
+        let top = vp(&app).edge_nodes(0).unwrap()[0];
+        drag(&mut app, top, [top[0], top[1] - 35.0], egui::Modifiers::COMMAND);
+        let s = vp(&app);
+        assert_eq!(s.planes.len(), 2);
+        let t = s.torn[1].unwrap();
+        assert_eq!((t.from, t.edge, t.angle), (0, Edge::Top, 90.0));
+        let c = s.planes[1].corners;
+        assert!((c[0][1] + c[1][1]) / 2.0 < 40.0, "the far edge followed the pointer up: {c:?}");
+        assert_ne!(s.describe()["planes"][1]["check"], "invalid");
+        assert_eq!(s.params()["planes"][1], json!({"from": 0, "edge": "top", "angle": 90.0, "depth": t.depth}));
+        // Alt-dragging its far edge node turns it; editing the floor carries it along.
+        let far = s.edge_nodes(1).unwrap()[0];
+        drag(&mut app, far, [far[0], far[1] + 12.0], egui::Modifiers::ALT);
+        assert_ne!(vp(&app).torn[1].unwrap().angle, 90.0);
+        let before = vp(&app).planes[1].corners;
+        drag(&mut app, [220.0, 150.0], [228.0, 150.0], egui::Modifiers::NONE);
+        assert_ne!(vp(&app).planes[1].corners, before);
+        assert!(vp(&app).torn[1].is_some());
+
+        // Stamp: painting needs a source first; Alt-click sets it on the floor's green mark.
+        control(&mut app, &json!({"tool": "stamp", "stamp": {"diameter": 12, "hardness": 80}})).unwrap();
+        drag(&mut app, [120.0, 100.0], [120.0, 100.0], egui::Modifiers::NONE);
+        assert!(vp(&app).strokes.is_empty() && app.ui.status.contains("Alt-click"), "{}", app.ui.status);
+        drag(&mut app, [120.0, 139.0], [120.0, 139.0], egui::Modifiers::ALT);
+        assert_eq!(vp(&app).source, Some([120.0, 139.0]));
+        drag(&mut app, [118.0, 100.0], [126.0, 100.0], egui::Modifiers::NONE);
+        assert_eq!(vp(&app).strokes.len(), 1);
+        assert!(vp(&app).strokes[0].points.len() >= 3, "dabs along the drag");
+        // The canvas shows the stroke; the document is untouched until OK.
+        let layer = app.session.active().unwrap().active_layer.unwrap();
+        let green = |d: &Document| d.layer(layer).unwrap().surface().unwrap().rgba(122, 100)[1];
+        let (shown, key) = crate::distort_ui::display_doc(&app, 0).expect("a stamp preview");
+        assert!(green(&shown) > 0.8, "{}", green(&shown));
+        let st = app.session.active().unwrap();
+        assert!(green(&st.doc) < 0.6);
+        let area = damage(&app, st.doc.id, st.revision, 0, key).unwrap();
+        assert!(area.contains(122, 100) && !area.contains(20, 20), "only the stroke recomposites: {area:?}");
+
+        let before = app.session.active().unwrap().history.past_len();
+        let r = commit(&mut app).unwrap();
+        assert_eq!(r["committed"], true, "{r}");
+        let st = app.session.active().unwrap();
+        assert_eq!(st.history.past_len(), before + 1, "one history step for the whole session");
+        assert!(green(&st.doc) > 0.8, "{}", green(&st.doc));
+    }
+
+    #[test]
+    fn undo_steps_back_through_clone_strokes_and_tear_offs() {
+        let (ctx, mut app) = app_with_layer();
+        crate::distort_ui::menu(&mut app, &ctx, VP, &json!({})).unwrap().unwrap();
+        control(&mut app, &json!({"planes": [{"corners": [[70, 60], [170, 60], [220, 150], [20, 150]]}]})).unwrap();
+        let drag = |app: &mut PhotocraftApp, a: [f64; 2], b: [f64; 2], m: egui::Modifiers| {
+            crate::distort_ui::pointer(app, ToolEvent::Down { x: a[0], y: a[1], pressure: 1.0 }, m);
+            crate::distort_ui::pointer(app, ToolEvent::Move { x: b[0], y: b[1], pressure: 1.0 }, m);
+            crate::distort_ui::pointer(app, ToolEvent::Up { x: b[0], y: b[1] }, m);
+        };
+        let step = |app: &mut PhotocraftApp, st: Step| {
+            app.distort.vanishing.as_mut().unwrap().step(st);
+            sync_preview(app);
+        };
+        let top = app.distort.vanishing.as_ref().unwrap().edge_nodes(0).unwrap()[0];
+        drag(&mut app, top, [top[0], top[1] - 35.0], egui::Modifiers::COMMAND);
+        control(&mut app, &json!({"tool": "stamp", "source": [120, 139]})).unwrap();
+        drag(&mut app, [118.0, 100.0], [126.0, 100.0], egui::Modifiers::NONE);
+        assert_eq!(app.distort.vanishing.as_ref().unwrap().strokes.len(), 1);
+        assert!(crate::distort_ui::display_doc(&app, 0).is_some());
+
+        // ⌘Z takes the stroke back (and its preview), then the source, then the torn-off wall.
+        step(&mut app, Step::Undo);
+        assert!(app.distort.vanishing.as_ref().unwrap().strokes.is_empty());
+        assert!(crate::distort_ui::display_doc(&app, 0).is_none(), "no stamp preview left");
+        step(&mut app, Step::Undo);
+        assert_eq!(app.distort.vanishing.as_ref().unwrap().source, None);
+        step(&mut app, Step::Undo);
+        let s = app.distort.vanishing.as_ref().unwrap();
+        assert_eq!((s.planes.len(), s.torn.len()), (1, 1));
+        // ⇧⌘Z brings them back.
+        for _ in 0..3 {
+            step(&mut app, Step::Redo);
+        }
+        let s = app.distort.vanishing.as_ref().unwrap();
+        assert_eq!((s.planes.len(), s.strokes.len()), (2, 1));
+        assert!(s.torn[1].is_some());
+        assert!(crate::distort_ui::display_doc(&app, 0).is_some(), "the stroke shows again");
+    }
+    #[test]
+    fn overlapping_stamp_preview_matches_commit_across_batches() {
+        for new_layer in [false, true] {
+            let (ctx, mut app) = app_with_layer();
+            app.session
+                .edit("pattern", |doc, active| {
+                    let surf = doc.layer_mut(active.unwrap()).unwrap().surface_mut().unwrap();
+                    for x in 0..240 {
+                        surf.fill_rect(Rect::new(x, 0, x + 1, 160), &[x as f32 / 240.0, (x % 7) as f32 / 6.0, 0.3, 1.0]);
+                    }
+                    Ok(())
+                })
+                .unwrap();
+            crate::distort_ui::menu(&mut app, &ctx, VP, &json!({})).unwrap().unwrap();
+            control(&mut app, &json!({"planes": [{"corners": [[10, 10], [230, 10], [230, 150], [10, 150]]}]})).unwrap();
+            let points = [[80.0, 80.0], [84.0, 80.0], [88.0, 80.0], [92.0, 80.0]];
+            let s = app.distort.vanishing.as_mut().unwrap();
+            s.new_layer = new_layer;
+            s.strokes.push(CloneSpec { source: [76.0, 80.0], points: points[..2].to_vec(), size: 12.0, hardness: 0.8, opacity: 1.0 });
+            assert!(s.paint_preview(|| 1));
+            s.strokes[0].points.extend_from_slice(&points[2..]);
+            assert!(s.paint_preview(|| 2));
+            let (shown, _) = s.shown().unwrap();
+            let expected = photocraft_compose::flatten(&shown).px;
+            assert_ne!(expected, photocraft_compose::flatten(&app.session.active().unwrap().doc).px);
+            commit(&mut app).unwrap();
+            assert_eq!(photocraft_compose::flatten(&app.session.active().unwrap().doc).px, expected, "newLayer={new_layer}");
+        }
+    }
+
+    /// A red square on the clipboard (copied from the layer's top-left corner).
+    fn copy_red_square(app: &mut PhotocraftApp) {
+        app.session.execute("select.rect", json!({"x": 0, "y": 0, "width": 40, "height": 40})).unwrap();
+        app.session.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        app.session.execute("edit.copy", json!({})).unwrap();
+        app.session.execute("select.deselect", json!({})).unwrap();
+    }
+
+    #[test]
+    fn stamp_preview_paints_over_the_paste_like_ok() {
+        for new_layer in [false, true] {
+            let (ctx, mut app) = app_with_layer();
+            copy_red_square(&mut app);
+            crate::distort_ui::menu(&mut app, &ctx, VP, &json!({})).unwrap().unwrap();
+            control(&mut app, &json!({"planes": [{"corners": [[10, 10], [230, 10], [230, 150], [10, 150]]}], "newLayer": new_layer})).unwrap();
+            let s = app.distort.vanishing.as_ref().unwrap();
+            assert!(s.paste && s.paste_plane() == Some(0), "the clipboard pastes by default");
+            // The paste covers x 65..175 from y 45 down. One stroke clones it onto the base
+            // layer, the other paints across its right edge.
+            control(
+                &mut app,
+                &json!({"clone": [
+                    {"source": [100, 60], "points": [[40, 120], [48, 120], [56, 120]], "size": 16, "hardness": 80},
+                    {"source": [40, 130], "points": [[150, 60], [170, 60], [190, 60]], "size": 16, "hardness": 80},
+                ]}),
+            )
+            .unwrap();
+            let s = app.distort.vanishing.as_ref().unwrap();
+            assert!(s.preview_has_paste(), "the preview shows the paste, so the overlay isn't drawn over the strokes");
+            let (shown, _) = s.shown().unwrap();
+            let expected = photocraft_compose::flatten(&shown).px;
+            commit(&mut app).unwrap();
+            assert_eq!(photocraft_compose::flatten(&app.session.active().unwrap().doc).px, expected, "newLayer={new_layer}");
+        }
+    }
+
+    #[test]
+    fn moving_the_paste_repaints_the_stamp_preview() {
+        let (ctx, mut app) = app_with_layer();
+        copy_red_square(&mut app);
+        crate::distort_ui::menu(&mut app, &ctx, VP, &json!({})).unwrap().unwrap();
+        control(&mut app, &json!({"planes": [{"corners": [[10, 10], [230, 10], [230, 150], [10, 150]]}]})).unwrap();
+        control(&mut app, &json!({"clone": [{"source": [200, 130], "points": [[30, 130]], "size": 8}]})).unwrap();
+        let red = |app: &PhotocraftApp, x: i32, y: i32| {
+            let (shown, _) = app.distort.vanishing.as_ref().unwrap().shown().unwrap();
+            let l = app.session.active().unwrap().active_layer.unwrap();
+            shown.layer(l).unwrap().surface().unwrap().rgba(x, y)[0]
+        };
+        assert!(red(&app, 100, 60) > 0.9);
+        control(&mut app, &json!({"pasteAt": [0.0, 0.5]})).unwrap();
+        assert!(red(&app, 100, 60) < 0.5, "the paste left its old place");
+        assert!(red(&app, 30, 100) > 0.9, "and shows at the new one");
+        control(&mut app, &json!({"paste": false})).unwrap();
+        assert!(red(&app, 30, 100) < 0.5, "paste off: gone from the preview");
+        assert!(!app.distort.vanishing.as_ref().unwrap().preview_has_paste());
+    }
+
+    #[test]
+    fn dragging_the_paste_shows_it_once() {
+        let (ctx, mut app) = app_with_layer();
+        copy_red_square(&mut app);
+        crate::distort_ui::menu(&mut app, &ctx, VP, &json!({})).unwrap().unwrap();
+        control(&mut app, &json!({"planes": [{"corners": [[10, 10], [230, 10], [230, 150], [10, 150]]}], "tool": "edit"})).unwrap();
+        control(&mut app, &json!({"clone": [{"source": [200, 130], "points": [[30, 130]], "size": 8}]})).unwrap();
+        let layer = app.session.active().unwrap().active_layer.unwrap();
+        let red = |app: &PhotocraftApp, x: i32, y: i32| {
+            let (shown, _) = crate::distort_ui::display_doc(app, 0)?;
+            Some(shown.layer(layer).unwrap().surface().unwrap().rgba(x, y)[0])
+        };
+        assert!(red(&app, 100, 60).unwrap() > 0.9, "the paste is in the preview");
+        let ev = |app: &mut PhotocraftApp, e: ToolEvent| crate::distort_ui::pointer(app, e, egui::Modifiers::NONE);
+        ev(&mut app, ToolEvent::Down { x: 100.0, y: 60.0, pressure: 1.0 });
+        ev(&mut app, ToolEvent::Move { x: 60.0, y: 100.0, pressure: 1.0 });
+        // Mid-drag: no copy left behind at the old place, only the overlay at the pointer.
+        assert!(red(&app, 100, 60).is_none_or(|r| r < 0.5), "{:?}", red(&app, 100, 60));
+        assert!(app.distort.vanishing.as_ref().unwrap().paste_overlay(), "the overlay draws the moving paste");
+        ev(&mut app, ToolEvent::Up { x: 60.0, y: 100.0 });
+        assert!(red(&app, 100, 60).unwrap() < 0.5);
+        assert!(red(&app, 60, 100).unwrap() > 0.9, "released: the preview pastes at the new place");
+        assert!(!app.distort.vanishing.as_ref().unwrap().paste_overlay());
+        // A plane corner drag freezes the preview, paste included, until release: one copy.
+        ev(&mut app, ToolEvent::Down { x: 230.0, y: 150.0, pressure: 1.0 });
+        ev(&mut app, ToolEvent::Move { x: 236.0, y: 156.0, pressure: 1.0 });
+        let s = app.distort.vanishing.as_ref().unwrap();
+        assert!(matches!(s.drag, Some(Drag::Corner { .. })));
+        assert!(red(&app, 60, 100).unwrap() > 0.9 && !s.paste_overlay(), "frozen preview, no overlay on top");
+        ev(&mut app, ToolEvent::Up { x: 236.0, y: 156.0 });
+        let s = app.distort.vanishing.as_ref().unwrap();
+        assert!(s.preview_has_paste() && !s.paste_overlay());
+    }
+
+    #[test]
+    fn new_layer_stamp_preview_stays_on_the_canvas() {
+        let (ctx, mut app) = app_with_layer();
+        // A red stripe where the first dab samples, so cloning it changes pixels.
+        app.session.execute("select.rect", json!({"x": 130, "y": 70, "width": 20, "height": 20})).unwrap();
+        app.session.execute("edit.fill", json!({"color": "#ff0000"})).unwrap();
+        app.session.execute("select.deselect", json!({})).unwrap();
+        crate::distort_ui::menu(&mut app, &ctx, VP, &json!({})).unwrap().unwrap();
+        control(&mut app, &json!({"planes": [{"corners": [[10, 10], [230, 10], [230, 150], [10, 150]]}], "newLayer": true})).unwrap();
+        // The second dab lies left of the canvas and samples the canvas 100 px to its right.
+        control(&mut app, &json!({"clone": [{"source": [140, 80], "points": [[40, 80], [-30, 80]], "size": 16}]})).unwrap();
+        let s = app.distort.vanishing.as_ref().unwrap();
+        let out = s.preview.as_ref().unwrap().out.content_bounds();
+        assert!(!out.is_empty() && s.canvas.contains_rect(&out), "{out:?}");
+        let st = app.session.active().unwrap();
+        let area = damage(&app, st.doc.id, st.revision, 0, s.shown().unwrap().1).unwrap();
+        assert!(s.canvas.contains_rect(&area), "{area:?}");
+    }
+
+    #[test]
+    fn deleting_the_last_plane_drops_the_stamp_preview() {
+        let (ctx, mut app) = app_with_layer();
+        crate::distort_ui::menu(&mut app, &ctx, VP, &json!({})).unwrap().unwrap();
+        control(&mut app, &json!({"planes": [{"corners": [[70, 60], [170, 60], [220, 150], [20, 150]]}]})).unwrap();
+        control(&mut app, &json!({"clone": [{"source": [120, 139], "points": [[118, 100], [126, 100]], "size": 12}]})).unwrap();
+        assert!(crate::distort_ui::display_doc(&app, 0).is_some());
+        let s = app.distort.vanishing.as_mut().unwrap();
+        s.selected = Some(0);
+        s.delete_selected();
+        sync_preview(&mut app);
+        assert!(app.distort.vanishing.as_ref().unwrap().planes.is_empty());
+        assert!(crate::distort_ui::display_doc(&app, 0).is_none(), "no strokes shown without a plane");
+    }
+
+    /// Opens the mode on the active layer of `app_with_layer` and stamps one stroke.
+    fn stamp_a_stroke(app: &mut PhotocraftApp, ctx: &egui::Context) {
+        crate::distort_ui::menu(app, ctx, VP, &json!({})).unwrap().unwrap();
+        control(app, &json!({"planes": [{"corners": [[10, 10], [230, 10], [230, 150], [10, 150]]}]})).unwrap();
+        control(app, &json!({"clone": [{"source": [60, 80], "points": [[120, 80], [126, 80]], "size": 12}]})).unwrap();
+    }
+
+    #[test]
+    fn stamp_preview_is_not_shown_on_another_document() {
+        let (ctx, mut app) = app_with_layer();
+        stamp_a_stroke(&mut app, &ctx);
+        assert!(crate::distort_ui::display_doc(&app, 0).is_some());
+        app.session.execute("file.new", json!({"width": 32, "height": 32, "depth": 8})).unwrap();
+        let active = app.session.active_index().unwrap();
+        // The session stays until drop_foreign; the preview must not follow this document (#5115).
+        assert!(app.distort.vanishing.is_some());
+        assert!(crate::distort_ui::display_doc(&app, active).is_none());
+    }
+
+    #[test]
+    fn ok_paints_the_layer_the_mode_was_opened_on() {
+        for new_layer in [false, true] {
+            let (ctx, mut app) = app_with_layer();
+            let layer = app.session.active().unwrap().active_layer.unwrap();
+            app.session
+                .edit("stripe", |doc, active| {
+                    doc.layer_mut(active.unwrap()).unwrap().surface_mut().unwrap().fill_rect(Rect::new(50, 70, 70, 90), &[1.0, 0.0, 0.0, 1.0]);
+                    Ok(())
+                })
+                .unwrap();
+            stamp_a_stroke(&mut app, &ctx);
+            app.distort.vanishing.as_mut().unwrap().new_layer = new_layer;
+            sync_preview(&mut app);
+            // Another layer is picked while the mode is open (it isn't modal).
+            app.session.execute("layer.new.layer", json!({"name": "other"})).unwrap();
+            let other = app.session.active().unwrap().active_layer.unwrap();
+            sync_preview(&mut app);
+            let expected = photocraft_compose::flatten(&crate::distort_ui::display_doc(&app, 0).unwrap().0).px;
+            commit(&mut app).unwrap();
+            let d = &app.session.active().unwrap().doc;
+            assert!(d.layer(other).unwrap().surface().unwrap().content_bounds().is_empty(), "newLayer={new_layer}");
+            if !new_layer {
+                assert!(d.layer(layer).unwrap().surface().unwrap().rgba(120, 80)[0] > 0.9, "the stroke lands on the session's layer");
+                // And it becomes active, so Fade and a colour-channel target follow it.
+                assert_eq!(app.session.active().unwrap().active_layer, Some(layer));
+            }
+            assert_eq!(photocraft_compose::flatten(d).px, expected, "newLayer={new_layer}");
+        }
+    }
+
+    #[test]
+    fn an_edit_under_the_mode_shows_on_the_canvas() {
+        let (ctx, mut app) = app_with_layer();
+        app.session
+            .edit("stripe", |doc, active| {
+                doc.layer_mut(active.unwrap()).unwrap().surface_mut().unwrap().fill_rect(Rect::new(50, 70, 70, 90), &[1.0, 0.0, 0.0, 1.0]);
+                Ok(())
+            })
+            .unwrap();
+        stamp_a_stroke(&mut app, &ctx);
+        let before = crate::distort_ui::display_doc(&app, 0).unwrap();
+        app.session
+            .edit("edit", |doc, active| {
+                doc.layer_mut(active.unwrap()).unwrap().surface_mut().unwrap().fill_rect(Rect::new(200, 20, 220, 40), &[0.0, 1.0, 0.0, 1.0]);
+                Ok(())
+            })
+            .unwrap();
+        // Not the stale preview, even before the mode catches up.
+        assert!(crate::distort_ui::display_doc(&app, 0).is_none_or(|(d, _)| !Arc::ptr_eq(&d, &before.0)));
+        // The canvas catches up before it draws: the strokes over the edit, no frame without them.
+        let (shown, key) = crate::canvas::display_doc(&mut app, 0);
+        assert_ne!(key, before.1);
+        let st = app.session.active().unwrap();
+        let layer = st.active_layer.unwrap();
+        let px = shown.layer(layer).unwrap().surface().unwrap();
+        assert!(px.rgba(210, 30)[1] > 0.9, "the edit shows: {:?}", px.rgba(210, 30));
+        assert!(px.rgba(120, 80) != st.doc.layer(layer).unwrap().surface().unwrap().rgba(120, 80), "and so does the stroke");
+        let expected = photocraft_compose::flatten(&shown).px;
+        commit(&mut app).unwrap();
+        assert_eq!(photocraft_compose::flatten(&app.session.active().unwrap().doc).px, expected);
+    }
+
+    #[test]
+    fn selecting_another_layer_keeps_the_stamp_preview() {
+        let (ctx, mut app) = app_with_layer();
+        let layer = app.session.active().unwrap().active_layer.unwrap();
+        app.session.execute("layer.new.layer", json!({"name": "other"})).unwrap();
+        app.session.execute("layer.select", json!({"layer": layer.0})).unwrap();
+        app.sync_views();
+        stamp_a_stroke(&mut app, &ctx);
+        let before = crate::canvas::display_doc(&mut app, 0);
+        let (doc, revision) = app.session.active().map(|st| (st.doc.clone(), st.revision)).unwrap();
+        app.session.execute("layer.select", json!({"layer": "other"})).unwrap();
+        let st = app.session.active().unwrap();
+        assert!(st.revision != revision && Arc::ptr_eq(&st.doc, &doc), "a selection change leaves the pixels alone");
+        // Same preview, same key: nothing to repaint or recomposite.
+        let after = crate::canvas::display_doc(&mut app, 0);
+        assert!(Arc::ptr_eq(&after.0, &before.0));
+        assert_eq!(after.1, before.1);
+    }
 }
diff --git a/crates/ui-egui/src/wheel_nav.rs b/crates/ui-egui/src/wheel_nav.rs
index ec7047580f..51a5b1ec64 100644
--- a/crates/ui-egui/src/wheel_nav.rs
+++ b/crates/ui-egui/src/wheel_nav.rs
@@ -1,7 +1,7 @@
 //! Mouse wheel and trackpad navigation over the canvas (#293, #635), as in Photoshop:
 //!
 //! - The wheel scrolls up and down; ⇧ or ⌘/Ctrl + wheel scrolls sideways.
-//! - ⌥/Alt + wheel zooms around the pointer, 10% per wheel notch, applied the frame it arrives.
+//! - ⌥/Alt + wheel zooms around the pointer, 10% per wheel notch (eased or instant, see below).
 //!   ⇧/Shift + ⌥/Alt + wheel snaps to the next zoom ladder level instead.
 //! - Preferences › General › Zoom with Scroll Wheel swaps the two: the wheel zooms and
 //!   ⌥/Alt + wheel scrolls; ⇧/Shift + wheel snaps to the next zoom ladder level.
@@ -20,14 +20,22 @@
 //! before egui sees them, so Ctrl + a notched mouse wheel scrolls sideways and the pinch still
 //! zooms.
 //!
-//! The target behaviour is exact ×1.1 steps, one per notch, with no easing in between
-//! (measured frame by frame on a screen recording). egui smooths a wheel notch over several
-//! frames, so zooming reads the wheel events themselves and ignores that smoothed tail; panning
-//! keeps the smoothed delta. The Alt state is taken from the wheel events (and the Alt key's own
-//! press and release, `wheel_events`) and kept until the next wheel event: releasing Alt while
-//! the tail is still settling must not turn it into a pan.
+//! Either way a wheel notch zooms by exactly ×1.1 in total. How that step is spread over frames
+//! is set by Preferences › General › Animated Zoom (`general.animatedZoom`, on by default):
+//!
+//! - On: the zoom is eased over several frames (the curve of egui's wheel smoothing, fed by the zoom
+//!   notches only), so the factors of the frames of one notch multiply to ×1.1. An unfinished notch
+//!   is superseded, not carried, when ⇧ snap zoom or a pan takes over or the pointer leaves.
+//! - Off: one instant ×1.1 step per notch, applied the frame it arrives with no easing in between
+//!   (the Photoshop behaviour, measured frame by frame on a screen recording). Zooming reads the
+//!   wheel events themselves and ignores egui's smoothed tail.
+//!
+//! In both modes panning keeps the smoothed delta, and ⇧/Shift snap zoom reads the wheel events
+//! and stays instant. The Alt state is taken from the wheel events (and the Alt key's own press
+//! and release, `wheel_events`) and kept until the next wheel event: releasing Alt while the tail
+//! is still settling must not turn it into a pan.
 
-use egui::{Context, Event, Id, InputState, Key, Modifiers, MouseWheelUnit, RawInput, Vec2};
+use egui::{Context, Event, Id, InputState, Key, Modifiers, MouseWheelUnit, RawInput, TouchPhase, Vec2};
 
 /// Zoom factor of one wheel notch: every step is exactly ×1.1.
 pub const NOTCH: f32 = 1.1;
@@ -50,10 +58,11 @@ pub enum Wheel {
 /// Inputs of one frame's wheel gesture.
 #[derive(Clone, Copy, Debug)]
 pub struct Input {
-    /// Smoothed scroll delta (points, content direction); what panning uses.
+    /// Smoothed scroll delta (points, content direction); what panning uses. In the animated zoom
+    /// modes it is the eased zoom delta of that mode's own wheel events only.
     pub scroll: Vec2,
     /// This frame's wheel events for the gesture in progress, unsmoothed (points, content
-    /// direction); what zooming uses.
+    /// direction); what the instant zoom and the snap zoom use.
     pub raw: Vec2,
     /// egui's pinch zoom factor (1 = none).
     pub zoom_delta: f32,
@@ -65,6 +74,9 @@ pub struct Input {
     pub zoom_with_wheel: bool,
     /// Preferences › Enhanced Controls › Zoom with Trackpad Pinch.
     pub pinch_zooms: bool,
+    /// Preferences › General › Animated Zoom: the wheel zoom follows the smoothed delta (`scroll`)
+    /// across frames; off, it is one instant step from this frame's wheel events (`raw`).
+    pub animated_zoom: bool,
     /// Points per wheel notch (egui's `line_scroll_speed`).
     pub notch: f32,
 }
@@ -92,17 +104,21 @@ pub fn classify(i: Input) -> Option<Wheel> {
         let steps = n.clamp(-10.0, 10.0).round() as i32;
         if steps == 0 { None } else { Some(Wheel::SnapZoom(steps)) }
     };
+    let scroll_finite = i.scroll.x.is_finite() && i.scroll.y.is_finite();
     match (i.alt, i.zoom_with_wheel) {
         // ⇧ + ⌥ + scroll: snap to the zoom ladder instead of continuous ×1.1.
         (true, false) if i.shift => snap(i.raw.y + i.raw.x),
-        // ⌥ + scroll: continuous ×1.1 zoom. The smoothed tail of a notch is ignored.
-        (true, false) => step(i.raw.y + i.raw.x),
+        // ⌥ + scroll: continuous ×1.1 zoom. Animated Zoom on: follow the smoothed delta across frames.
+        (true, false) if i.animated_zoom && scroll_finite => step(i.scroll.y + i.scroll.x),
+        // Animated Zoom off: one instant step from the wheel events. The smoothed tail is ignored.
+        (true, false) if !i.animated_zoom => step(i.raw.y + i.raw.x),
         // ⇧ + scroll wheel with the preference on: snap to the zoom ladder.
         // Some systems deliver Shift+wheel as horizontal (delta in x, y = 0).
         (false, true) if i.shift => snap(i.raw.y + i.raw.x),
         // ⌘/Ctrl folds the wheel into x: those still scroll sideways.
-        (false, true) if i.raw.y != 0.0 || i.scroll.y != 0.0 => step(i.raw.y),
-        _ if !(i.scroll.x.is_finite() && i.scroll.y.is_finite()) || i.scroll == Vec2::ZERO => None,
+        (false, true) if i.animated_zoom && scroll_finite && i.scroll.y != 0.0 => step(i.scroll.y),
+        (false, true) if !i.animated_zoom && (i.raw.y != 0.0 || i.scroll.y != 0.0) => step(i.raw.y),
+        _ if !scroll_finite || i.scroll == Vec2::ZERO => None,
         _ => Some(Wheel::Pan(i.scroll)),
     }
 }
@@ -147,7 +163,7 @@ pub fn legacy_pinch_to_zoom(events: &mut [Event], now: f64, last: Option<f64>, n
 }
 
 fn pinch_id() -> Id {
-    Id::new("pc-wheel-legacy-pinch")
+    Id::unique("pc-wheel-legacy-pinch")
 }
 
 /// [`legacy_pinch_to_zoom`] for one frame's raw input (`raw_input_hook`, Windows and Linux).
@@ -172,37 +188,155 @@ pub fn fold_legacy_pinch(ctx: &Context, raw: &mut RawInput) {
 }
 
 fn alt_id() -> Id {
-    Id::new("pc-wheel-alt")
+    Id::unique("pc-wheel-alt")
 }
 
 fn shift_id() -> Id {
-    Id::new("pc-wheel-shift")
+    Id::unique("pc-wheel-shift")
 }
 
 fn snap_residual_id(owner: Id) -> Id {
-    Id::new("pc-wheel-snap-residual").with(owner)
+    Id::unique("pc-wheel-snap-residual").with(owner)
 }
 
 fn snap_time_id(owner: Id) -> Id {
-    Id::new("pc-wheel-snap-time").with(owner)
+    Id::unique("pc-wheel-snap-time").with(owner)
 }
 
 fn snap_frame_result_id(owner: Id) -> Id {
-    Id::new("pc-wheel-snap-frame-result").with(owner)
+    Id::unique("pc-wheel-snap-frame-result").with(owner)
 }
 
 fn active_snap_owner_id() -> Id {
-    Id::new("pc-wheel-active-snap-owner")
+    Id::unique("pc-wheel-active-snap-owner")
 }
 
 const SNAP_IDLE_TIMEOUT: f64 = 0.5;
 
+/// egui's own wheel smoothing (`InputState::begin_pass`): 90 % of a notch is released in 0.1 s.
+/// The eased zoom uses the same curve, so it paces like the eased pan.
+const EASE_REACH: f32 = 0.90;
+const EASE_REACH_SECS: f32 = 0.1;
+
+/// An unfinished eased notch belongs to the frames that follow it. It is dropped, never carried
+/// into a later notch, once its owner was not driven for more than this many passes (the pointer
+/// left the viewport, or another gesture took over there)...
+const ZOOM_EASE_MAX_GAP_PASSES: u64 = 3;
+/// ...or, when at least one pass was skipped, for this long (seconds). A single slow frame is
+/// not a gap: the owner was driven in the pass right before it, so the notch still finishes.
+const ZOOM_EASE_STALE_SECS: f64 = 0.5;
+
+#[derive(Clone, Copy)]
+struct ZoomEase {
+    residual: f32,
+    time: f64,
+    frame: u64,
+    released: f32,
+}
+
+fn zoom_ease_id(owner: Id) -> Id {
+    Id::unique(("wheel-zoom-ease", owner))
+}
+
+/// Eases `delta` (points of this viewport's zoom-mode wheel events) over the next frames and
+/// returns what is released this frame. Same curve as egui's wheel smoothing, but fed by the
+/// zoom notches only, so the tail of a pan notch never leaks in. What is released adds up to
+/// exactly what was fed. A second call in the same frame returns the cached result.
+fn ease_zoom_delta(ctx: &Context, owner: Id, delta: f32) -> f32 {
+    let id = zoom_ease_id(owner);
+    let frame = ctx.cumulative_pass_nr();
+    let (now, dt) = ctx.input(|i| (i.time, i.stable_dt.min(0.1)));
+    let prev = ctx.data(|d| d.get_temp::<ZoomEase>(id));
+    if let Some(e) = prev.filter(|e| e.frame == frame) {
+        return e.released;
+    }
+    // Fresh: driven in the previous pass (a slow frame, however long, keeps its notch), or within a
+    // few passes and a short time (a one-pass hover flicker). Anything older is stale.
+    let fresh = |e: &ZoomEase| {
+        let gap = frame.saturating_sub(e.frame);
+        e.residual.is_finite() && (gap <= 1 || (gap <= ZOOM_EASE_MAX_GAP_PASSES && now - e.time < ZOOM_EASE_STALE_SECS))
+    };
+    let carried = prev.filter(fresh).map_or(0.0, |e| e.residual);
+    let mut residual = carried + if delta.is_finite() { delta } else { 0.0 };
+    let t = egui::emath::exponential_smooth_factor(EASE_REACH, EASE_REACH_SECS, dt);
+    let released = if residual.abs() < 1.0 { residual } else { t * residual };
+    residual -= released;
+    ctx.data_mut(|d| d.insert_temp(id, ZoomEase { residual, time: now, frame, released }));
+    // Callers do not repaint on their own after consuming the zoom: keep frames coming until the
+    // notch has been fully released, or a reactive UI would stop below ×1.1.
+    if residual != 0.0 {
+        ctx.request_repaint();
+    }
+    released
+}
+
+/// A zoom limit stopped the eased zoom of `owner`: drop what is left of the notch. It would no
+/// longer zoom, only cancel the first notch back (flick to 12800 %, and the notch back did
+/// nothing). This frame's release stays cached, so a second read in the same frame is unchanged.
+pub fn settle(ctx: &Context, owner: Id) {
+    let id = zoom_ease_id(owner);
+    ctx.data_mut(|d| {
+        if let Some(e) = d.get_temp::<ZoomEase>(id) {
+            d.insert_temp(id, ZoomEase { residual: 0.0, ..e });
+        }
+    });
+}
+
+/// Whether a trackpad touch is in progress (egui's `InTouch`), at the start and at the end of a
+/// frame: the start is kept, so every read in one frame sees the same states.
+#[derive(Clone, Copy)]
+struct Touch {
+    frame: u64,
+    at_start: bool,
+    at_end: bool,
+}
+
+/// Per viewport, as egui keeps its wheel state per viewport.
+fn touch_id(ctx: &Context) -> Id {
+    Id::unique(("wheel-nav-touch", ctx.viewport_id()))
+}
+
+/// This frame's wheel events (in order) with, for each, whether egui leaves it unsmoothed: during a
+/// trackpad touch, or a point delta under 8 points (`WheelState::on_wheel_event`). Those are
+/// already smooth, and easing them again would only add latency; the rest (notches, and the
+/// big pixel steps browsers report for a mouse wheel) is what Animated Zoom eases.
+fn mark_unsmoothed(ctx: &Context, events: Vec<(MouseWheelUnit, Vec2, Modifiers, TouchPhase)>) -> Vec<(MouseWheelUnit, Vec2, Modifiers, bool)> {
+    let frame = ctx.cumulative_pass_nr();
+    let (horizontal, vertical) = ctx.options(|o| (o.input_options.horizontal_scroll_modifier, o.input_options.vertical_scroll_modifier));
+    // Not read in the previous pass (no canvas then): a touch could have ended unseen, and a
+    // stuck one would leave every later notch un-eased.
+    let id = touch_id(ctx);
+    let mut touch = match ctx.data(|d| d.get_temp::<Touch>(id)) {
+        Some(t) if t.frame == frame => t.at_start,
+        Some(t) if t.frame.saturating_add(1) == frame => t.at_end,
+        _ => false,
+    };
+    let at_start = touch;
+    let mut wheel = Vec::with_capacity(events.len());
+    for (unit, delta, modifiers, phase) in events {
+        match phase {
+            TouchPhase::Start => touch = true,
+            TouchPhase::End | TouchPhase::Cancel => touch = false,
+            TouchPhase::Move => {}
+        }
+        // egui folds a scroll onto one axis by its modifiers before it measures the step.
+        let step = match (modifiers.matches_any(horizontal), modifiers.matches_any(vertical)) {
+            (true, false) | (false, true) => (delta.x + delta.y).abs(),
+            _ => delta.length(),
+        };
+        let instant = touch || (unit == MouseWheelUnit::Point && step < 8.0);
+        wheel.push((unit, delta, modifiers, instant));
+    }
+    ctx.data_mut(|d| d.insert_temp(id, Touch { frame, at_start, at_end: touch }));
+    wheel
+}
+
 /// Read this frame's wheel input. Call it every frame (hovered or not) so the Alt and Shift
 /// states of the gesture follow the latest wheel event. `owner` scopes the snap-zoom
 /// accumulator per viewport. `hovered` gates accumulation: only the viewport receiving
 /// navigation may add raw input to the snap residual.
-pub fn read(ctx: &Context, zoom_with_wheel: bool, pinch_zooms: bool, owner: Id, hovered: bool) -> Option<Wheel> {
-    read_with(ctx, zoom_with_wheel, pinch_zooms, owner, hovered, true, true)
+pub fn read(ctx: &Context, zoom_with_wheel: bool, pinch_zooms: bool, animated_zoom: bool, owner: Id, hovered: bool) -> Option<Wheel> {
+    read_with(ctx, zoom_with_wheel, pinch_zooms, animated_zoom, owner, hovered, true, true)
 }
 
 /// [`read`], choosing how a plain wheel scroll pans: `smooth` glides it over a few frames (egui's
@@ -210,16 +344,29 @@ pub fn read(ctx: &Context, zoom_with_wheel: bool, pinch_zooms: bool, owner: Id,
 /// in the frame the wheel turns and stops there (#5721), as scroll areas already do.
 /// `touch_gestures` is Preferences › Enhanced Controls › Enable Gestures: off, a touch screen's
 /// two-finger pinch doesn't zoom ([`pinch_factor`]).
-pub fn read_with(ctx: &Context, zoom_with_wheel: bool, pinch_zooms: bool, owner: Id, hovered: bool, smooth: bool, touch_gestures: bool) -> Option<Wheel> {
+/// `animated_zoom` is Preferences › General › Animated Zoom: on, the wheel zoom is eased over the
+/// frames of a notch; off, a notch is one instant ×1.1 step.
+#[allow(clippy::too_many_arguments)]
+pub fn read_with(
+    ctx: &Context,
+    zoom_with_wheel: bool,
+    pinch_zooms: bool,
+    animated_zoom: bool,
+    owner: Id,
+    hovered: bool,
+    smooth: bool,
+    touch_gestures: bool,
+) -> Option<Wheel> {
     let notch = ctx.options(|o| o.input_options.line_scroll_speed);
 
     // --- Modifier tracking (always runs for all callers) ---
     let (scroll, zoom_delta, latest_alt, latest_shift, wheel, page) = ctx.input(|i| {
         let wheel = wheel_events(i);
-        let latest_alt = wheel.last().map(|(_, _, m)| m.alt && !m.command && !m.ctrl);
-        let latest_shift = wheel.last().map(|(_, _, m)| m.shift && !m.command && !m.ctrl);
+        let latest_alt = wheel.last().map(|(_, _, m, _)| m.alt && !m.command && !m.ctrl);
+        let latest_shift = wheel.last().map(|(_, _, m, _)| m.shift && !m.command && !m.ctrl);
         (i.smooth_scroll_delta, pinch_factor(i, touch_gestures), latest_alt, latest_shift, wheel, i.content_rect().height())
     });
+    let wheel = mark_unsmoothed(ctx, wheel);
     let alt = match latest_alt {
         Some(a) => {
             ctx.data_mut(|d| d.insert_temp(alt_id(), a));
@@ -242,9 +389,10 @@ pub fn read_with(ctx: &Context, zoom_with_wheel: bool, pinch_zooms: bool, owner:
     // --- Input classification (hovered viewport only) ---
     // The wheel events that belong to the gesture in progress: Shift+Alt (snap zoom), Alt-only
     // (continuous zoom), Shift-only (snap zoom with zoom_with_wheel), or plain (scroll/zoom).
-    let raw = wheel
+    // `instant`: the part of `raw` egui leaves unsmoothed (a trackpad; see `wheel_events`).
+    let (raw, instant) = wheel
         .iter()
-        .filter(|(_, _, m)| {
+        .filter(|(_, _, m, _)| {
             if alt && shift {
                 m.alt && m.shift && !m.command && !m.ctrl
             } else if alt {
@@ -255,18 +403,22 @@ pub fn read_with(ctx: &Context, zoom_with_wheel: bool, pinch_zooms: bool, owner:
                 !m.alt && !m.shift && !m.command && !m.ctrl
             }
         })
-        .fold(Vec2::ZERO, |sum, (unit, delta, _)| {
-            sum + *delta
+        .fold((Vec2::ZERO, Vec2::ZERO), |(sum, instant), (unit, delta, _, unsmoothed)| {
+            let d = *delta
                 * match unit {
                     MouseWheelUnit::Point => 1.0,
                     MouseWheelUnit::Line => notch,
                     MouseWheelUnit::Page => page,
-                }
+                };
+            (sum + d, if *unsmoothed { instant + d } else { instant })
         });
     let snap_mode = shift && ((alt && !zoom_with_wheel) || (!alt && zoom_with_wheel));
     let has_pinch = pinch_zooms && zoom_delta.is_finite() && zoom_delta > 0.0 && zoom_delta != 1.0;
 
     if snap_mode && !has_pinch {
+        // Shift snap zoom takes over: drop this owner's unfinished eased notch, so a continuous
+        // zoom started shortly after Shift is released cannot carry its residual.
+        ctx.data_mut(|d| d.remove::<ZoomEase>(zoom_ease_id(owner)));
         let dy = raw.y + raw.x;
         if dy == 0.0 {
             return None;
@@ -316,9 +468,24 @@ pub fn read_with(ctx: &Context, zoom_with_wheel: bool, pinch_zooms: bool, owner:
                 d.remove::<f64>(snap_time_id(owner));
             });
         }
-        // Unsmoothed, a plain scroll pans by this frame's own wheel events (none: no tail).
-        let scroll = if smooth || alt || shift { scroll } else { raw };
-        classify(Input { scroll, raw, zoom_delta, alt, shift, zoom_with_wheel, pinch_zooms, notch })
+        // Zoom-mode input: ⌥ + wheel, or the plain wheel with Zoom with Scroll Wheel. With Animated
+        // Zoom on it eases from this mode's own wheel events: egui's smoothed delta has no notion of
+        // modifiers, so it would also carry the unfinished tail of a pan notch into the zoom.
+        let wheel_zooms = !shift && (alt != zoom_with_wheel);
+        let scroll = if animated_zoom && wheel_zooms {
+            // Eased as egui eases a wheel: what it leaves unsmoothed (a trackpad) zooms at once.
+            let along = |v: Vec2| if alt { v.y + v.x } else { v.y };
+            let eased = ease_zoom_delta(ctx, owner, along(raw - instant)) + along(instant);
+            // The plain wheel zooms through `y`; its sideways part (⌘/Ctrl + wheel, a trackpad's
+            // horizontal scroll) is not a zoom event, so it pans like any scroll: smoothed, or
+            // with Enable Animations off at once (#5721).
+            if alt { Vec2::new(0.0, eased) } else { Vec2::new(if smooth { scroll.x } else { raw.x }, eased) }
+        } else {
+            ctx.data_mut(|d| d.remove::<ZoomEase>(zoom_ease_id(owner)));
+            // Unsmoothed, a plain scroll pans by this frame's own wheel events (none: no tail).
+            if smooth || alt || shift { scroll } else { raw }
+        };
+        classify(Input { scroll, raw, zoom_delta, alt, shift, zoom_with_wheel, pinch_zooms, animated_zoom, notch })
     }
 }
 
@@ -332,7 +499,7 @@ fn is_alt_key(key: Key) -> bool {
 /// tapped), while the Alt key's own press and release still arrive; the menu bar follows those
 /// too (`menu_keys`). Alt is down from its press until its release, starting from whether it
 /// was down before this frame's first Alt key event (egui's `keys_down` when there is none).
-fn wheel_events(i: &InputState) -> Vec<(MouseWheelUnit, Vec2, Modifiers)> {
+fn wheel_events(i: &InputState) -> Vec<(MouseWheelUnit, Vec2, Modifiers, TouchPhase)> {
     let first_alt_key = i.events.iter().find_map(|e| match e {
         // A repeat means the key was already down; a release means it was down until then.
         Event::Key { key, pressed, repeat, .. } if is_alt_key(*key) => Some(!*pressed || *repeat),
@@ -343,9 +510,9 @@ fn wheel_events(i: &InputState) -> Vec<(MouseWheelUnit, Vec2, Modifiers)> {
     for e in &i.events {
         match e {
             Event::Key { key, pressed, .. } if is_alt_key(*key) => alt_key = *pressed,
-            Event::MouseWheel { unit, delta, modifiers, .. } => {
+            Event::MouseWheel { unit, delta, phase, modifiers, .. } => {
                 let modifiers = Modifiers { alt: modifiers.alt || alt_key, ..*modifiers };
-                wheel.push((*unit, *delta, modifiers));
+                wheel.push((*unit, *delta, modifiers, *phase));
             }
             _ => {}
         }
@@ -378,11 +545,11 @@ mod tests {
     use super::*;
 
     fn input(scroll: Vec2, alt: bool) -> Input {
-        Input { scroll, raw: scroll, zoom_delta: 1.0, alt, shift: false, zoom_with_wheel: false, pinch_zooms: true, notch: 40.0 }
+        Input { scroll, raw: scroll, zoom_delta: 1.0, alt, shift: false, zoom_with_wheel: false, pinch_zooms: true, animated_zoom: true, notch: 40.0 }
     }
 
     fn wheel(delta: Vec2, modifiers: Modifiers) -> Event {
-        Event::MouseWheel { unit: MouseWheelUnit::Line, delta, phase: TouchPhase::Move, modifiers }
+        Event::MouseWheel { source: egui::MouseWheelSource::Unknown, unit: MouseWheelUnit::Line, delta, phase: TouchPhase::Move, modifiers }
     }
 
     const CTRL: Modifiers = Modifiers { ctrl: true, command: true, ..Modifiers::NONE };
@@ -390,8 +557,14 @@ mod tests {
 
     /// Feed `events` through an egui context set up like the app's (`legacy`: the Windows pinch
     /// fold on) and add up what the wheel did to the view over the following second.
+    ///
+    /// `gesture` runs with Animated Zoom off (a notch is one instant step); see [`gesture_with`].
     fn gesture(frames: Vec<Vec<Event>>, zoom_with_wheel: bool, legacy: bool) -> (Vec2, f32, i32) {
-        let owner = Id::new("test-gesture");
+        gesture_with(frames, zoom_with_wheel, legacy, false)
+    }
+
+    fn gesture_with(frames: Vec<Vec<Event>>, zoom_with_wheel: bool, legacy: bool, animated_zoom: bool) -> (Vec2, f32, i32) {
+        let owner = Id::unique("test-gesture");
         let ctx = Context::default();
         configure(&ctx);
         let (mut pan, mut zoom, mut snaps) = (Vec2::ZERO, 1.0, 0i32);
@@ -402,7 +575,7 @@ mod tests {
             if legacy {
                 fold_legacy_pinch(&ctx, &mut raw);
             }
-            let mut out = ctx.run_ui(raw, |ui| match read(ui.ctx(), zoom_with_wheel, true, owner, true) {
+            let mut out = ctx.run_ui(raw, |ui| match read(ui.ctx(), zoom_with_wheel, true, animated_zoom, owner, true) {
                 Some(Wheel::Pan(d)) => pan += d,
                 Some(Wheel::Zoom(f)) => zoom *= f,
                 Some(Wheel::SnapZoom(n)) => snaps += n,
@@ -414,7 +587,7 @@ mod tests {
     }
 
     fn wheel_point(delta: Vec2, modifiers: Modifiers) -> Event {
-        Event::MouseWheel { unit: MouseWheelUnit::Point, delta, phase: TouchPhase::Move, modifiers }
+        Event::MouseWheel { source: egui::MouseWheelSource::Unknown, unit: MouseWheelUnit::Point, delta, phase: TouchPhase::Move, modifiers }
     }
 
     fn near(a: Vec2, b: Vec2) -> bool {
@@ -426,7 +599,7 @@ mod tests {
     #[test]
     fn unsmoothed_wheel_pans_at_once_without_a_glide() {
         let pans = |smooth: bool| -> Vec<Vec2> {
-            let owner = Id::new("test-unsmoothed");
+            let owner = Id::unique("test-unsmoothed");
             let ctx = Context::default();
             configure(&ctx);
             (0..30)
@@ -435,7 +608,7 @@ mod tests {
                     let raw = RawInput { time: Some(f64::from(n) / 60.0), predicted_dt: 1.0 / 60.0, events, ..Default::default() };
                     let mut pan = Vec2::ZERO;
                     let mut out = ctx.run_ui(raw, |ui| {
-                        if let Some(Wheel::Pan(d)) = read_with(ui.ctx(), false, true, owner, true, smooth, true) {
+                        if let Some(Wheel::Pan(d)) = read_with(ui.ctx(), false, true, true, owner, true, smooth, true) {
                             pan = d;
                         }
                     });
@@ -457,6 +630,39 @@ mod tests {
         assert!(smooth[1..].iter().any(|p| p.y != 0.0), "and the rest follows");
     }
 
+    /// Interface › Enable Animations off only stops the *pan* gliding. A plain wheel that zooms
+    /// (Zoom with Scroll Wheel) with Animated Zoom on must still ease over the frames of a notch,
+    /// exactly as it does with the pan smoothing on.
+    #[test]
+    fn animated_wheel_zoom_keeps_its_eased_tail_when_pan_smoothing_is_off() {
+        let frames = |smooth: bool| -> Vec<f32> {
+            let owner = Id::unique("test-animated-zoom-unsmoothed-pan");
+            let ctx = Context::default();
+            configure(&ctx);
+            (0..60)
+                .map(|n| {
+                    let events = if n == 0 { vec![wheel(Vec2::new(0.0, 1.0), Modifiers::NONE)] } else { Vec::new() };
+                    let raw = RawInput { time: Some(f64::from(n) / 60.0), predicted_dt: 1.0 / 60.0, events, ..Default::default() };
+                    let mut factor = 1.0;
+                    let mut out = ctx.run_ui(raw, |ui| {
+                        if let Some(Wheel::Zoom(f)) = read_with(ui.ctx(), true, true, true, owner, true, smooth, true) {
+                            factor = f;
+                        }
+                    });
+                    out.textures_delta.clear();
+                    factor
+                })
+                .collect()
+        };
+        let unsmoothed = frames(false);
+        assert!(unsmoothed[0] > 1.0 && unsmoothed[0] < NOTCH - 1e-3, "the first frame carries only part of it: {:?}", &unsmoothed[..4]);
+        assert!(unsmoothed[1..].iter().any(|f| *f > 1.0), "and the rest follows: {unsmoothed:?}");
+        let product: f32 = unsmoothed.iter().product();
+        assert!((product - NOTCH).abs() < 1e-4, "still x1.1 in total: {product}");
+        let smoothed = frames(true);
+        assert!(unsmoothed.iter().zip(&smoothed).all(|(a, b)| (a - b).abs() < 1e-6), "same pacing as with pan smoothing on");
+    }
+
     #[test]
     fn plain_scroll_pans() {
         assert_eq!(classify(input(Vec2::new(3.0, -40.0), false)), Some(Wheel::Pan(Vec2::new(3.0, -40.0))));
@@ -474,17 +680,352 @@ mod tests {
         assert!((f - 1.21).abs() < 1e-4, "{f}");
     }
 
+    /// Animated Zoom off: a notch is one instant step, and egui's smoothed tail does nothing.
     #[test]
     fn a_notch_zooms_the_frame_it_arrives_and_its_smoothed_tail_does_nothing() {
         // egui keeps feeding a smoothed delta for several frames after the wheel event. Zooming
         // must not follow it (that would ease the zoom), nor turn it into a pan.
+        let off = |i: Input| Input { animated_zoom: false, ..i };
+        let tail = off(Input { raw: Vec2::ZERO, ..input(Vec2::new(0.0, 12.0), true) });
+        assert_eq!(classify(tail), None);
+        let tail = off(Input { raw: Vec2::ZERO, zoom_with_wheel: true, ..input(Vec2::new(0.0, 12.0), false) });
+        assert_eq!(classify(tail), None);
+        // The frame the notch arrives carries it whole, whatever the smoothed delta is.
+        let arrival = off(Input { scroll: Vec2::new(0.0, 12.0), raw: Vec2::new(0.0, 40.0), ..input(Vec2::ZERO, true) });
+        assert!(matches!(classify(arrival), Some(Wheel::Zoom(f)) if (f - 1.1).abs() < 1e-5));
+        // Plain scrolling without the preference still pans from the smoothed delta.
+        let pan = off(Input { raw: Vec2::ZERO, ..input(Vec2::new(0.0, 12.0), false) });
+        assert_eq!(classify(pan), Some(Wheel::Pan(Vec2::new(0.0, 12.0))));
+    }
+
+    /// Animated Zoom on: the zoom follows egui's smoothed delta over the frames of a notch, and
+    /// never turns that tail into a pan.
+    #[test]
+    fn animated_zoom_follows_the_smoothed_tail_of_a_notch() {
         let tail = Input { raw: Vec2::ZERO, ..input(Vec2::new(0.0, 12.0), true) };
-        assert_eq!(classify(tail), None);
+        assert!(matches!(classify(tail), Some(Wheel::Zoom(f)) if f > 1.0));
         let tail = Input { raw: Vec2::ZERO, zoom_with_wheel: true, ..input(Vec2::new(0.0, 12.0), false) };
-        assert_eq!(classify(tail), None);
+        assert!(matches!(classify(tail), Some(Wheel::Zoom(f)) if f > 1.0));
+        // The size of the step comes from the smoothed delta, not the raw one.
+        let part = Input { scroll: Vec2::new(0.0, 20.0), raw: Vec2::new(0.0, 40.0), ..input(Vec2::ZERO, true) };
+        assert!(matches!(classify(part), Some(Wheel::Zoom(f)) if (f - 1.1f32.powf(0.5)).abs() < 1e-5));
         // Plain scrolling without the preference still pans from the smoothed delta.
         let pan = Input { raw: Vec2::ZERO, ..input(Vec2::new(0.0, 12.0), false) };
         assert_eq!(classify(pan), Some(Wheel::Pan(Vec2::new(0.0, 12.0))));
+        // ⇧ + snap zoom stays on the wheel events and instant, in both modes.
+        for animated_zoom in [false, true] {
+            let tail = Input { shift: true, zoom_with_wheel: true, raw: Vec2::ZERO, animated_zoom, ..input(Vec2::new(12.0, 0.0), false) };
+            assert_eq!(classify(tail), None, "animated_zoom {animated_zoom}");
+            let snap = Input { shift: true, zoom_with_wheel: true, raw: Vec2::new(0.0, 40.0), animated_zoom, ..input(Vec2::new(0.0, 12.0), false) };
+            assert_eq!(classify(snap), Some(Wheel::SnapZoom(1)), "animated_zoom {animated_zoom}");
+        }
+    }
+
+    /// The factor of every frame of one notch, through a real egui context (60 frames at 60 fps).
+    fn zoom_frames(modifiers: Modifiers, zoom_with_wheel: bool, animated_zoom: bool) -> Vec<f32> {
+        let owner = Id::unique("test-zoom-frames");
+        let ctx = Context::default();
+        configure(&ctx);
+        (0..60)
+            .map(|n| {
+                let events = if n == 0 { vec![wheel(Vec2::new(0.0, 1.0), modifiers)] } else { Vec::new() };
+                let raw = RawInput { time: Some(f64::from(n) / 60.0), predicted_dt: 1.0 / 60.0, events, ..Default::default() };
+                let mut factor = 1.0;
+                let mut out = ctx.run_ui(raw, |ui| {
+                    if let Some(Wheel::Zoom(f)) = read(ui.ctx(), zoom_with_wheel, true, animated_zoom, owner, true) {
+                        factor = f;
+                    }
+                });
+                out.textures_delta.clear();
+                factor
+            })
+            .collect()
+    }
+
+    /// The property the eased zoom relies on: however egui spreads a notch over frames, the
+    /// factors of those frames multiply to exactly ×1.1 (and ×1/1.1 for a notch the other way).
+    #[test]
+    fn the_eased_frames_of_one_notch_multiply_to_ten_percent() {
+        for (modifiers, zoom_with_wheel) in [(Modifiers::ALT, false), (Modifiers::NONE, true)] {
+            let frames = zoom_frames(modifiers, zoom_with_wheel, true);
+            assert!(frames.iter().all(|f| f.is_finite() && *f >= 1.0), "{frames:?}");
+            assert!(frames.iter().filter(|f| **f != 1.0).count() > 1, "eased over several frames: {frames:?}");
+            let product: f32 = frames.iter().product();
+            assert!((product - NOTCH).abs() < 1e-4, "{modifiers:?} zoom_with_wheel {zoom_with_wheel}: {product} from {frames:?}");
+        }
+        // The other way round: ×1/1.1.
+        let owner = Id::unique("test-zoom-frames-out");
+        let ctx = Context::default();
+        configure(&ctx);
+        let mut product = 1.0f32;
+        for n in 0..60 {
+            let events = if n == 0 { vec![wheel(Vec2::new(0.0, -1.0), Modifiers::ALT)] } else { Vec::new() };
+            let raw = RawInput { time: Some(f64::from(n) / 60.0), predicted_dt: 1.0 / 60.0, events, ..Default::default() };
+            let mut out = ctx.run_ui(raw, |ui| {
+                if let Some(Wheel::Zoom(f)) = read(ui.ctx(), false, true, true, owner, true) {
+                    product *= f;
+                }
+            });
+            out.textures_delta.clear();
+        }
+        assert!((product - 1.0 / NOTCH).abs() < 1e-4, "{product}");
+    }
+
+    /// Animated Zoom changes the pacing of a notch, never its size: off, the whole ×1.1 lands in
+    /// the frame the notch arrives and nothing follows; on, that frame carries only part of it.
+    #[test]
+    fn animated_zoom_changes_the_pacing_of_a_notch_not_its_size() {
+        for (modifiers, zoom_with_wheel) in [(Modifiers::ALT, false), (Modifiers::NONE, true)] {
+            let instant = zoom_frames(modifiers, zoom_with_wheel, false);
+            assert!((instant[0] - NOTCH).abs() < 1e-5, "the whole notch at once: {:?}", &instant[..4]);
+            assert!(instant[1..].iter().all(|f| *f == 1.0), "no tail after it: {instant:?}");
+            let eased = zoom_frames(modifiers, zoom_with_wheel, true);
+            assert!(eased[0] > 1.0 && eased[0] < NOTCH - 1e-3, "the first frame carries only part of it: {:?}", &eased[..4]);
+            assert!(eased[1..].iter().any(|f| *f > 1.0), "and the rest follows");
+        }
+    }
+
+    /// Animated Zoom is only about the wheel zoom: ⇧ snap zoom and plain scrolling are the same
+    /// in both modes.
+    #[test]
+    fn animated_zoom_leaves_snap_zoom_and_panning_alone() {
+        let notch = Vec2::new(0.0, 1.0);
+        let shift_alt = Modifiers { shift: true, alt: true, ..Modifiers::NONE };
+        for animated_zoom in [false, true] {
+            let (pan, zoom, snaps) = gesture_with(vec![vec![wheel(notch, shift_alt)]], false, false, animated_zoom);
+            assert!(pan == Vec2::ZERO && zoom == 1.0 && snaps == 1, "⇧ + ⌥: {pan:?} {zoom} {snaps}");
+            let (pan, zoom, snaps) = gesture_with(vec![vec![wheel(notch, Modifiers::NONE)]], false, false, animated_zoom);
+            assert!(near(pan, Vec2::new(0.0, 40.0)) && zoom == 1.0 && snaps == 0, "plain wheel pans: {pan:?} {zoom} {snaps}");
+            // A notch zooms ×1.1 in total in either mode.
+            let (pan, zoom, _) = gesture_with(vec![vec![wheel(notch, Modifiers::ALT)]], false, false, animated_zoom);
+            assert!(pan == Vec2::ZERO && (zoom - NOTCH).abs() < 1e-4, "animated_zoom {animated_zoom}: {pan:?} {zoom}");
+        }
+    }
+
+    /// A pan notch still gliding when an ⌥ notch arrives (and the same the other way round with
+    /// Zoom with Scroll Wheel): the zoom is that one notch's ×1.1, not the sum of both tails.
+    #[test]
+    fn a_pan_tail_does_not_leak_into_the_animated_zoom() {
+        let notch = Vec2::new(0.0, 1.0);
+        // Wheel pans, ⌥ zooms: plain notch, then ⌥ notch one frame later.
+        let frames = vec![vec![wheel(notch, Modifiers::NONE)], vec![wheel(notch, Modifiers::ALT)]];
+        let (pan, zoom, snaps) = gesture_with(frames, false, false, true);
+        assert!((zoom - NOTCH).abs() < 1e-4, "only the ⌥ notch zooms: {zoom}");
+        assert!(pan.y > 0.0 && pan.y < 40.0 && snaps == 0, "the plain notch only panned its first frame: {pan:?} {snaps}");
+        // Wheel zooms, ⌥ pans: ⌥ notch, then plain notch.
+        let frames = vec![vec![wheel(notch, Modifiers::ALT)], vec![wheel(notch, Modifiers::NONE)]];
+        let (_, zoom, snaps) = gesture_with(frames, true, false, true);
+        assert!((zoom - NOTCH).abs() < 1e-4, "only the plain notch zooms: {zoom}");
+        assert_eq!(snaps, 0);
+    }
+
+    /// The zoom factor of each of `frames` frames with Animated Zoom on and ⌥ zooming. `time` gives a
+    /// frame's timestamp and `hovered` whether the owner is hovered in it.
+    fn run_zoom(frames: u32, events: impl Fn(u32) -> Vec<Event>, time: impl Fn(u32) -> f64, hovered: impl Fn(u32) -> bool) -> Vec<f32> {
+        let owner = Id::unique("test-run-zoom");
+        let ctx = Context::default();
+        configure(&ctx);
+        (0..frames)
+            .map(|n| {
+                let raw = RawInput { time: Some(time(n)), predicted_dt: 1.0 / 60.0, events: events(n), ..Default::default() };
+                let mut factor = 1.0;
+                let mut out = ctx.run_ui(raw, |ui| {
+                    if let Some(Wheel::Zoom(f)) = read(ui.ctx(), false, true, true, owner, hovered(n)) {
+                        factor = f;
+                    }
+                });
+                out.textures_delta.clear();
+                factor
+            })
+            .collect()
+    }
+
+    /// A slow frame in the middle of an eased notch (a big image redrawing) must not drop what is
+    /// left of it: the notch still adds up to exactly ×1.1.
+    #[test]
+    fn a_slow_frame_does_not_cut_an_eased_notch_short() {
+        let notch = Vec2::new(0.0, 1.0);
+        let time = |n: u32| if n == 0 { 0.0 } else { 0.7 + f64::from(n - 1) / 60.0 };
+        let frames = run_zoom(60, |n| if n == 0 { vec![wheel(notch, Modifiers::ALT)] } else { Vec::new() }, time, |_| true);
+        let product: f32 = frames.iter().product();
+        assert!((product - NOTCH).abs() < 1e-4, "still x1.1 in total: {product} from {frames:?}");
+    }
+
+    /// What is left of an eased notch when the pointer leaves the viewport is dropped: a notch
+    /// made after it comes back is ×1.1 on its own, not ×1.1 plus the old remainder.
+    #[test]
+    fn an_unfinished_notch_is_not_carried_into_a_notch_after_the_pointer_left() {
+        let notch = Vec2::new(0.0, 1.0);
+        let events = |n: u32| if n == 0 || n == 40 { vec![wheel(notch, Modifiers::ALT)] } else { Vec::new() };
+        let frames = run_zoom(100, events, |n| f64::from(n) / 60.0, |n| !(1..30).contains(&n));
+        let first: f32 = frames[..40].iter().product();
+        assert!(first > 1.0 && first < NOTCH - 1e-3, "the first notch was left unfinished: {first}");
+        let second: f32 = frames[40..].iter().product();
+        assert!((second - NOTCH).abs() < 1e-4, "the second notch is ×1.1 on its own: {second}");
+    }
+
+    /// Zoom with Scroll Wheel + Animated Zoom (the defaults of both): ⌘/Ctrl + wheel still scrolls
+    /// sideways, as it does with Animated Zoom off.
+    #[test]
+    fn animated_zoom_keeps_ctrl_wheel_sideways_scroll_with_zoom_with_wheel() {
+        let (pan, zoom, snaps) = gesture_with(vec![vec![wheel(Vec2::new(0.0, 1.0), CTRL)]], true, false, true);
+        assert!(near(pan, Vec2::new(40.0, 0.0)) && zoom == 1.0 && snaps == 0, "{pan:?} {zoom} {snaps}");
+    }
+
+    /// Shift snap zoom interrupting an unfinished animated notch drops that notch's residual: a
+    /// continuous zoom started right after Shift is released is its own ×1.1 and nothing more.
+    #[test]
+    fn shift_snap_zoom_drops_the_unfinished_eased_notch() {
+        let notch = Vec2::new(0.0, 1.0);
+        let shift_alt = Modifiers { shift: true, ..Modifiers::ALT };
+        let owner = Id::unique("test-snap-interrupts-ease");
+        let ctx = Context::default();
+        configure(&ctx);
+        let (mut zoom, mut zoom_after_first, mut snaps) = (1.0f32, 1.0f32, 0i32);
+        for n in 0..60u32 {
+            // ⌥ notch (eases), ⇧⌥ notch (snap zoom takes over), then ⌥ notch again within 0.5 s.
+            let events = match n {
+                0 | 2 => vec![wheel(notch, Modifiers::ALT)],
+                1 => vec![wheel(notch, shift_alt)],
+                _ => Vec::new(),
+            };
+            let raw = RawInput { time: Some(f64::from(n) / 60.0), predicted_dt: 1.0 / 60.0, events, ..Default::default() };
+            let mut out = ctx.run_ui(raw, |ui| match read(ui.ctx(), false, true, true, owner, true) {
+                Some(Wheel::Zoom(f)) => zoom *= f,
+                Some(Wheel::SnapZoom(s)) => snaps += s,
+                _ => {}
+            });
+            out.textures_delta.clear();
+            if n == 0 {
+                zoom_after_first = zoom;
+            }
+        }
+        assert_eq!(snaps, 1);
+        let second = zoom / zoom_after_first;
+        assert!((second - NOTCH).abs() < 1e-4, "the second ⌥ notch zooms ×1.1 on its own: {second}");
+    }
+
+    /// A trackpad's ⌥ + two-finger scroll comes in points and is already smooth: egui leaves it
+    /// unsmoothed because smoothing adds latency, so Animated Zoom must not ease it either. Each
+    /// frame zooms by its own events, at once.
+    #[test]
+    fn animated_zoom_does_not_ease_a_trackpad() {
+        let frames =
+            run_zoom(30, |n| if n == 0 { vec![wheel_point(Vec2::new(0.0, 4.0), Modifiers::ALT)] } else { Vec::new() }, |n| f64::from(n) / 60.0, |_| true);
+        assert!((frames[0] - NOTCH.powf(0.1)).abs() < 1e-6, "all of it in the frame it arrives: {:?}", &frames[..4]);
+        assert!(frames[1..].iter().all(|f| *f == 1.0), "no tail after it: {frames:?}");
+    }
+
+    /// Zoom with Scroll Wheel + Animated Zoom with Enable Animations off: the wheel zooms eased, but
+    /// a sideways wheel still pans without a glide (#5721), all of it in the frame it turns.
+    #[test]
+    fn animated_zoom_keeps_the_sideways_wheel_unsmoothed_with_animations_off() {
+        let owner = Id::unique("test-sideways-unsmoothed");
+        let ctx = Context::default();
+        configure(&ctx);
+        let pans: Vec<Vec2> = (0..30)
+            .map(|n| {
+                let events = if n == 0 { vec![wheel(Vec2::new(1.0, 0.0), Modifiers::NONE)] } else { Vec::new() };
+                let raw = RawInput { time: Some(f64::from(n) / 60.0), predicted_dt: 1.0 / 60.0, events, ..Default::default() };
+                let mut pan = Vec2::ZERO;
+                let mut out = ctx.run_ui(raw, |ui| {
+                    if let Some(Wheel::Pan(d)) = read_with(ui.ctx(), true, true, true, owner, true, false, true) {
+                        pan = d;
+                    }
+                });
+                out.textures_delta.clear();
+                pan
+            })
+            .collect();
+        assert!(near(pans[0], Vec2::new(40.0, 0.0)), "the whole notch at once: {:?}", &pans[..4]);
+        assert!(pans[1..].iter().all(|p| *p == Vec2::ZERO), "no glide after it: {pans:?}");
+    }
+
+    /// A diagonal point step with ⌥ is measured as egui measures it, folded onto one axis: (5, 5)
+    /// is a 10-point step, which egui smooths, so Animated Zoom eases it.
+    #[test]
+    fn a_diagonal_alt_point_step_is_measured_like_egui() {
+        let frames =
+            run_zoom(60, |n| if n == 0 { vec![wheel_point(Vec2::new(5.0, 5.0), Modifiers::ALT)] } else { Vec::new() }, |n| f64::from(n) / 60.0, |_| true);
+        assert!(frames[0] < NOTCH.powf(0.25) - 1e-4 && frames[1] > 1.0, "eased: {:?}", &frames[..4]);
+    }
+
+    /// A touch whose end nobody read (no canvas in that pass, e.g. the last document closed
+    /// during a trackpad scroll) must not leave later mouse notches un-eased.
+    #[test]
+    fn a_touch_end_nobody_read_does_not_stick() {
+        let owner = Id::unique("test-touch-unread-end");
+        let ctx = Context::default();
+        configure(&ctx);
+        let point = |phase: TouchPhase| Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: MouseWheelUnit::Point,
+            delta: Vec2::ZERO,
+            phase,
+            modifiers: Modifiers::ALT,
+        };
+        let mut first = 1.0;
+        for n in 0..10u32 {
+            let events = match n {
+                0 => vec![point(TouchPhase::Start)],
+                2 => vec![point(TouchPhase::End)],
+                5 => vec![wheel(Vec2::new(0.0, 1.0), Modifiers::ALT)],
+                _ => Vec::new(),
+            };
+            let raw = RawInput { time: Some(f64::from(n) / 60.0), predicted_dt: 1.0 / 60.0, events, ..Default::default() };
+            let mut out = ctx.run_ui(raw, |ui| {
+                // Frames 2-3: nothing reads the wheel.
+                if !(2..4).contains(&n)
+                    && let Some(Wheel::Zoom(f)) = read(ui.ctx(), false, true, true, owner, true)
+                    && n == 5
+                {
+                    first = f;
+                }
+            });
+            out.textures_delta.clear();
+        }
+        assert!(first > 1.0 && first < NOTCH - 1e-3, "the notch is eased: {first}");
+    }
+
+    /// Quick back-and-forth wheeling still lands on whole ×1.1 steps: three notches in and one
+    /// out a frame later is ×1.1², whatever was still easing.
+    #[test]
+    fn a_quick_notch_back_nets_out() {
+        for back_at in [1, 3] {
+            let events = |n: u32| match n {
+                0 => vec![wheel(Vec2::new(0.0, 3.0), Modifiers::ALT)],
+                n if n == back_at => vec![wheel(Vec2::new(0.0, -1.0), Modifiers::ALT)],
+                _ => Vec::new(),
+            };
+            let total: f32 = run_zoom(60, events, |n| f64::from(n) / 60.0, |_| true).iter().product();
+            assert!((total - NOTCH * NOTCH).abs() < 1e-4, "back at frame {back_at}: {total}");
+        }
+    }
+
+    /// A browser reports a mouse notch as a big pixel step (about 100 points in Chrome), which
+    /// egui smooths like a notch: Animated Zoom eases it too. Within a trackpad touch (egui's
+    /// `InTouch`) even big point steps zoom at once.
+    #[test]
+    fn animated_zoom_eases_big_pixel_steps_but_not_a_touch() {
+        let point = |dy: f32, phase: TouchPhase| Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: MouseWheelUnit::Point,
+            delta: Vec2::new(0.0, dy),
+            phase,
+            modifiers: Modifiers::ALT,
+        };
+        let browser = run_zoom(60, |n| if n == 0 { vec![point(100.0, TouchPhase::Move)] } else { Vec::new() }, |n| f64::from(n) / 60.0, |_| true);
+        assert!(browser[0] > 1.0 && browser[0] < NOTCH.powf(2.5) - 1e-3, "eased: {:?}", &browser[..4]);
+        let total: f32 = browser.iter().product();
+        assert!((total - NOTCH.powf(2.5)).abs() < 1e-3, "{total}");
+        let events = |n: u32| match n {
+            0 => vec![point(0.0, TouchPhase::Start)],
+            1 => vec![point(20.0, TouchPhase::Move)],
+            _ => Vec::new(),
+        };
+        let touch = run_zoom(30, events, |n| f64::from(n) / 60.0, |_| true);
+        assert!((touch[1] - NOTCH.powf(0.5)).abs() < 1e-5, "at once: {:?}", &touch[..4]);
+        assert!(touch[2..].iter().all(|f| *f == 1.0), "no tail: {touch:?}");
     }
 
     #[test]
@@ -523,6 +1064,7 @@ mod tests {
             unit: MouseWheelUnit::Line,
             delta: egui::vec2(0.0, 0.25),
             phase: egui::TouchPhase::Move,
+            source: egui::MouseWheelSource::Unknown,
             modifiers: Modifiers { ctrl: true, command: true, ..Modifiers::NONE },
         };
         let mut raw = RawInput { time: Some(1.0), events: vec![event()], ..Default::default() };
@@ -638,7 +1180,13 @@ mod tests {
     fn linux_wayland_point_unit_pinch_keeps_mouse_notches_for_sideways_scroll() {
         // Some Wayland compositors report fractional Ctrl-wheel pinch steps in points
         // rather than line units. The delta must not be multiplied by notch twice.
-        let mut point = [Event::MouseWheel { unit: MouseWheelUnit::Point, delta: Vec2::new(0.0, 8.0), phase: TouchPhase::Move, modifiers: CTRL }];
+        let mut point = [Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: MouseWheelUnit::Point,
+            delta: Vec2::new(0.0, 8.0),
+            phase: TouchPhase::Move,
+            modifiers: CTRL,
+        }];
         assert_eq!(legacy_pinch_to_zoom(&mut point, 1.0, None, 40.0, 0.005), Some(1.0));
         assert!(matches!(point[0], Event::Zoom(f) if (f - (8.0f32 * 0.005).exp()).abs() < 1e-5));
         let mut wheel_only = [wheel(Vec2::new(0.0, 1.0), CTRL)];
@@ -696,7 +1244,7 @@ mod tests {
         for s in [f32::NAN, f32::INFINITY, -f32::INFINITY, 1e30, -1e30] {
             for alt in [false, true] {
                 for notch in [0.0, -1.0, f32::NAN, 40.0] {
-                    for zd in [f32::NAN, 0.0, -1.0, f32::INFINITY, 1.0] {
+                    for (zd, animated_zoom) in [f32::NAN, 0.0, -1.0, f32::INFINITY, 1.0].into_iter().flat_map(|zd| [(zd, false), (zd, true)]) {
                         let i = Input {
                             scroll: Vec2::new(0.0, s),
                             raw: Vec2::new(0.0, s),
@@ -705,6 +1253,7 @@ mod tests {
                             shift: false,
                             zoom_with_wheel: !alt,
                             pinch_zooms: true,
+                            animated_zoom,
                             notch,
                         };
                         if let Some(Wheel::Zoom(f)) = classify(i) {
@@ -721,6 +1270,7 @@ mod tests {
                                 shift: false,
                                 zoom_with_wheel: true,
                                 pinch_zooms: true,
+                                animated_zoom,
                                 notch,
                             }
                         };
@@ -749,7 +1299,7 @@ mod tests {
         for n in 0..60 {
             let raw = RawInput { time: Some(f64::from(n) / 60.0), predicted_dt: 1.0 / 60.0, events: frames.next().unwrap_or_default(), ..Default::default() };
             let mut out = ctx.run_ui(raw, |ui| {
-                if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), zoom_with_wheel, true, owner, true) {
+                if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), zoom_with_wheel, true, true, owner, true) {
                     snaps += s;
                 }
             });
@@ -761,7 +1311,7 @@ mod tests {
     #[test]
     fn fractional_point_events_accumulate_across_frames() {
         let quarter = Vec2::new(0.0, 10.0);
-        let batched = snap_gesture(vec![vec![wheel_point(Vec2::new(0.0, 40.0), Modifiers::SHIFT)]], true, Id::new("accum-batched"));
+        let batched = snap_gesture(vec![vec![wheel_point(Vec2::new(0.0, 40.0), Modifiers::SHIFT)]], true, Id::unique("accum-batched"));
         let split = snap_gesture(
             vec![
                 vec![wheel_point(quarter, Modifiers::SHIFT)],
@@ -770,7 +1320,7 @@ mod tests {
                 vec![wheel_point(quarter, Modifiers::SHIFT)],
             ],
             true,
-            Id::new("accum-split"),
+            Id::unique("accum-split"),
         );
         assert_eq!(batched, 1, "40 points batched → 1 step");
         assert_eq!(split, 1, "4 × 10 points split → 1 step");
@@ -787,7 +1337,7 @@ mod tests {
                 vec![wheel_point(neg_quarter, Modifiers::SHIFT)],
             ],
             true,
-            Id::new("accum-neg"),
+            Id::unique("accum-neg"),
         );
         assert_eq!(neg_split, -1, "4 × −10 points → −1 step");
         let h_quarter = Vec2::new(10.0, 0.0);
@@ -799,7 +1349,7 @@ mod tests {
                 vec![wheel_point(h_quarter, Modifiers::SHIFT)],
             ],
             true,
-            Id::new("accum-horiz"),
+            Id::unique("accum-horiz"),
         );
         assert_eq!(h_split, 1, "horizontal 4 × 10 → 1 step");
     }
@@ -815,13 +1365,13 @@ mod tests {
                 vec![wheel_point(Vec2::new(0.0, 10.0), Modifiers::SHIFT)],
             ],
             true,
-            Id::new("accum-empty"),
+            Id::unique("accum-empty"),
         );
         assert_eq!(snaps, 1, "empty frame preserves residual");
         let reversal = snap_gesture(
             vec![vec![wheel_point(Vec2::new(0.0, 30.0), Modifiers::SHIFT)], vec![wheel_point(Vec2::new(0.0, -15.0), Modifiers::SHIFT)]],
             true,
-            Id::new("accum-reversal"),
+            Id::unique("accum-reversal"),
         );
         assert_eq!(reversal, 0, "30 − 15 = 15 points, below 1 notch → 0 steps");
     }
@@ -837,15 +1387,15 @@ mod tests {
                 vec![wheel_point(Vec2::new(0.0, 10.0), shift_alt)],
             ],
             false,
-            Id::new("accum-shift-alt"),
+            Id::unique("accum-shift-alt"),
         );
         assert_eq!(split, 1, "Shift+Alt 4 × 10 → 1 step without preference");
     }
 
     #[test]
     fn cross_viewport_does_not_leak_residual() {
-        let owner_a = Id::new("owner-a");
-        let owner_b = Id::new("owner-b");
+        let owner_a = Id::unique("owner-a");
+        let owner_b = Id::unique("owner-b");
         let ctx = Context::default();
         configure(&ctx);
         let mut snaps_a = 0i32;
@@ -854,10 +1404,10 @@ mod tests {
         let raw =
             RawInput { time: Some(0.0), predicted_dt: 1.0 / 60.0, events: vec![wheel_point(Vec2::new(0.0, 30.0), Modifiers::SHIFT)], ..Default::default() };
         let mut out = ctx.run_ui(raw, |ui| {
-            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, owner_a, true) {
+            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, true, owner_a, true) {
                 snaps_a += s;
             }
-            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, owner_b, false) {
+            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, true, owner_b, false) {
                 snaps_b += s;
             }
         });
@@ -872,10 +1422,10 @@ mod tests {
             ..Default::default()
         };
         let mut out = ctx.run_ui(raw, |ui| {
-            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, owner_a, false) {
+            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, true, owner_a, false) {
                 snaps_a += s;
             }
-            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, owner_b, true) {
+            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, true, owner_b, true) {
                 snaps_b += s;
             }
         });
@@ -890,8 +1440,8 @@ mod tests {
                 ..Default::default()
             };
             let mut out = ctx.run_ui(raw, |ui| {
-                let _ = read(ui.ctx(), true, true, owner_a, false);
-                if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, owner_b, true) {
+                let _ = read(ui.ctx(), true, true, true, owner_a, false);
+                if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, true, owner_b, true) {
                     snaps_b += s;
                 }
             });
@@ -906,10 +1456,10 @@ mod tests {
             ..Default::default()
         };
         let mut out = ctx.run_ui(raw, |ui| {
-            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, owner_a, true) {
+            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, true, owner_a, true) {
                 snaps_a += s;
             }
-            let _ = read(ui.ctx(), true, true, owner_b, false);
+            let _ = read(ui.ctx(), true, true, true, owner_b, false);
         });
         out.textures_delta.clear();
         assert_eq!(snaps_a, 0, "A: fresh start after switch, 30 points, no snap yet");
@@ -917,17 +1467,17 @@ mod tests {
 
     #[test]
     fn two_reads_same_owner_same_frame_do_not_double_count() {
-        let owner = Id::new("same-owner");
+        let owner = Id::unique("same-owner");
         let ctx = Context::default();
         configure(&ctx);
         let mut total_snaps = 0i32;
         let raw =
             RawInput { time: Some(0.0), predicted_dt: 1.0 / 60.0, events: vec![wheel_point(Vec2::new(0.0, 20.0), Modifiers::SHIFT)], ..Default::default() };
         let mut out = ctx.run_ui(raw, |ui| {
-            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, owner, true) {
+            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, true, owner, true) {
                 total_snaps += s;
             }
-            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, owner, true) {
+            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, true, owner, true) {
                 total_snaps += s;
             }
         });
@@ -941,7 +1491,7 @@ mod tests {
             ..Default::default()
         };
         let mut out = ctx.run_ui(raw, |ui| {
-            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, owner, true) {
+            if let Some(Wheel::SnapZoom(s)) = read(ui.ctx(), true, true, true, owner, true) {
                 total_snaps += s;
             }
         });
@@ -952,7 +1502,7 @@ mod tests {
     #[test]
     fn accumulation_hostile_numbers() {
         for dy in [1e30, -1e30, 1e-10, -1e-10] {
-            let snaps = snap_gesture(vec![vec![wheel_point(Vec2::new(0.0, dy), Modifiers::SHIFT)]], true, Id::new("accum-hostile"));
+            let snaps = snap_gesture(vec![vec![wheel_point(Vec2::new(0.0, dy), Modifiers::SHIFT)]], true, Id::unique("accum-hostile"));
             assert!(snaps.abs() <= 10, "hostile {dy} clamped: {snaps}");
         }
     }
@@ -985,14 +1535,14 @@ mod tests {
 
     /// The total zoom [`read_with`] reports over `frames`, Enable Gestures set to `touch_gestures`.
     fn touch_zoom(frames: Vec<Vec<Event>>, touch_gestures: bool) -> f32 {
-        let owner = Id::new("test-touch");
+        let owner = Id::unique("test-touch");
         let ctx = Context::default();
         configure(&ctx);
         let mut zoom = 1.0;
         for (n, events) in (0u32..).zip(frames) {
             let raw = RawInput { time: Some(f64::from(n) / 60.0), predicted_dt: 1.0 / 60.0, events, ..Default::default() };
             let mut out = ctx.run_ui(raw, |ui| {
-                if let Some(Wheel::Zoom(f)) = read_with(ui.ctx(), false, true, owner, true, true, touch_gestures) {
+                if let Some(Wheel::Zoom(f)) = read_with(ui.ctx(), false, true, true, owner, true, true, touch_gestures) {
                     zoom *= f;
                 }
             });
diff --git a/crates/ui-egui/src/wide_angle_ui.rs b/crates/ui-egui/src/wide_angle_ui.rs
index b577bf5861..11740b3a30 100644
--- a/crates/ui-egui/src/wide_angle_ui.rs
+++ b/crates/ui-egui/src/wide_angle_ui.rs
@@ -261,7 +261,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let screen = ctx.content_rect();
     let mut action: Option<&str> = None;
     let shift = ctx.input(|i| i.modifiers.shift);
-    egui::Area::new(egui::Id::new("awa-dialog")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
+    egui::Area::new(egui::Id::unique("awa-dialog")).order(egui::Order::Foreground).fixed_pos(screen.min).show(ctx, |ui| {
         let Some(d) = app.wide_angle.as_mut() else { return };
         d.history.settle(&d.params, ctx.input(|i| i.pointer.any_down()));
         if d.dirty {
@@ -284,7 +284,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
         let (fx, fy) = (d.frame.x0 as f64, d.frame.y0 as f64);
         let to_screen = |p: [f64; 2]| pos2(img_r.left() + ((p[0] - fx) * k) as f32 * s, img_r.top() + ((p[1] - fy) * k) as f32 * s);
         let to_doc = |q: Pos2| [fx + ((q.x - img_r.left()) / s) as f64 / k, fy + ((q.y - img_r.top()) / s) as f64 / k];
-        let resp = ui.interact(img_r, ui.id().with("awa-image"), Sense::click_and_drag());
+        let resp = ui.interact(img_r, ui.scope_id().with("awa-image"), Sense::click_and_drag());
         if let Some(p) = resp.interact_pointer_pos() {
             if resp.drag_started() {
                 d.drag = Some((to_doc(p), to_doc(p)));
@@ -369,6 +369,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
             if widgets::dropdown(
                 ui,
                 "awa-model",
+                tl!("Correction"),
                 &mut model,
                 &[
                     (WideModel::Auto, tl!("Auto")),
@@ -406,6 +407,7 @@ pub fn show(app: &mut PhotocraftApp, ctx: &egui::Context) {
                     if widgets::dropdown(
                         ui,
                         &format!("awa-o-{i}"),
+                        tl!("Orientation"),
                         &mut o,
                         &[(Orientation::Free, tl!("Free")), (Orientation::Horizontal, tl!("Horizontal")), (Orientation::Vertical, tl!("Vertical"))],
                         120.0,
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index 1210c6c804..9becc29532 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -61,104 +61,8 @@ pub fn surface(ui: &Ui, rect: Rect, fill: Color32, raised: bool) {
     }
 }
 
-/// A dock card: rounded container with a header of pill tabs and optional trailing actions.
-/// Returns the index of the selected tab.
-pub fn card(ui: &mut Ui, id: &str, tabs: &[&str], selected: &mut usize, body: impl FnOnce(&mut Ui, usize)) {
-    let _ = card_ex(ui, id, tabs, selected, false, false, body);
-}
-
-/// What happened on a card's tab strip this frame (see [`card_ex`]).
-pub struct CardResponse {
-    /// The tab strip background: drag to move the group, double-click to collapse it.
-    pub strip: Response,
-    /// The panel menu button (hamburger in Pro, ellipsis in Studio).
-    pub menu: Response,
-    /// A tab was clicked or chosen from the overflow menu.
-    pub tab_clicked: bool,
-    /// A tab was double-clicked (Photoshop collapses the group).
-    pub tab_double_clicked: bool,
-    /// Right-click action selected for a visible tab.
-    pub tab_context: Option<crate::tab_strip::TabContextAction>,
-    /// Rects of the tabs on the strip, `(tab index, rect)`; tabs that don't fit are in the
-    /// chevron menu instead (#151).
-    pub tabs: Vec<(usize, Rect)>,
-    pub responses: Vec<(usize, Response)>,
-    /// The » overflow button, when some tabs didn't fit.
-    pub chevron: Option<Rect>,
-    /// A tab dragged along the strip was dropped: `(tab, before)` (#2272).
-    pub tab_reorder: Option<(usize, Option<usize>)>,
-    /// The index of a tab being dragged away from the strip.
-    pub tab_dragging_out: Option<usize>,
-    /// The index of a tab whose drag ended away from the strip.
-    pub tab_dropped_out: Option<usize>,
-}
-
-impl CardResponse {
-    fn new(strip: Response, menu: Response, tabs: crate::tab_strip::StripOut) -> Self {
-        CardResponse {
-            strip,
-            menu,
-            tab_clicked: tabs.clicked,
-            tab_double_clicked: tabs.double_clicked,
-            tab_context: tabs.context,
-            tabs: tabs.tabs,
-            responses: tabs.responses,
-            chevron: tabs.chevron,
-            tab_reorder: tabs.reorder,
-            tab_dragging_out: tabs.dragging_out,
-            tab_dropped_out: tabs.dropped_out,
-        }
-    }
-}
-
-/// [`card`] that can be collapsed to its tab strip and reports strip and menu interactions.
-/// With `reorderable`, tabs can be dragged along the strip (reported, not applied).
-#[allow(clippy::too_many_arguments)]
-pub fn card_ex(
-    ui: &mut Ui,
-    id: &str,
-    tabs: &[&str],
-    selected: &mut usize,
-    collapsed: bool,
-    reorderable: bool,
-    body: impl FnOnce(&mut Ui, usize),
-) -> CardResponse {
-    let t = Tokens::get(ui.ctx());
-    if t.pro {
-        return pro_panel(ui, id, tabs, selected, collapsed, reorderable, body);
-    }
-    let m = body_margin(false);
-    let frame = egui::Frame::NONE
-        .fill(t.card)
-        .stroke(Stroke::new(1.0, t.card_border))
-        .corner_radius(CornerRadius::same(t.radius as u8))
-        .inner_margin(egui::Margin { bottom: if collapsed { 6 } else { m.bottom }, ..m });
-    let out = frame
-        .show(ui, |ui| {
-            ui.set_width(ui.available_width());
-            // Registered before the tabs so they keep their clicks; drags fall through to it.
-            let strip_rect = Rect::from_min_size(ui.cursor().min, vec2(ui.available_width(), 22.0));
-            let strip = ui.interact(strip_rect, ui.id().with((id, "strip")), Sense::click_and_drag());
-            // Pill tabs left of the menu button; they elide or overflow into a chevron (#151).
-            let (row, _) = ui.allocate_exact_size(vec2(ui.available_width(), 24.0), Sense::hover());
-            let tip = crate::i18n::fmt(tl!("{name} options"), &[("name", tl!(tabs.get(*selected).copied().unwrap_or(id)))]);
-            let menu_rect = Rect::from_min_max(pos2(row.right() - 22.0, row.top() + 1.0), pos2(row.right(), row.bottom() - 1.0));
-            let menu = crate::icons::button(&mut ui.new_child(egui::UiBuilder::new().max_rect(menu_rect)), "ellipsis", 22.0, false, &tip);
-            let area = Rect::from_min_max(row.min, pos2((menu_rect.left() - 4.0).max(row.left()), row.bottom()));
-            let tabs_out = crate::tab_strip::pill_tabs(ui, ui.id().with((id, "tabs")), area, tabs, selected, reorderable);
-            if !collapsed {
-                ui.add_space(6.0);
-                body(ui, *selected);
-            }
-            CardResponse::new(strip, menu, tabs_out)
-        })
-        .inner;
-    ui.add_space(6.0);
-    out
-}
-
 /// Inner margin of a dock panel's body: a Pro panel's, or a Studio card's below its tab strip.
-fn body_margin(pro: bool) -> egui::Margin {
+pub(crate) fn body_margin(pro: bool) -> egui::Margin {
     if pro { egui::Margin::same(8) } else { egui::Margin { left: 8, right: 8, top: 6, bottom: 10 } }
 }
 
@@ -190,44 +94,6 @@ pub fn panel_footer<R>(ui: &mut Ui, add: impl FnOnce(&mut Ui) -> R) -> R {
     add(&mut bar_ui)
 }
 
-/// Photoshop-grammar panel group: dark tab strip with flat tabs, flat body, hamburger menu.
-fn pro_panel(
-    ui: &mut Ui,
-    id: &str,
-    tabs: &[&str],
-    selected: &mut usize,
-    collapsed: bool,
-    reorderable: bool,
-    body: impl FnOnce(&mut Ui, usize),
-) -> CardResponse {
-    let t = Tokens::get(ui.ctx());
-    let width = ui.available_width();
-    // Tab strip. Its background senses drags (move the group) and double-clicks (collapse);
-    // the tabs, registered after it, keep their clicks.
-    let (strip, _) = ui.allocate_exact_size(vec2(width, 26.0), Sense::hover());
-    let strip_resp = ui.interact(strip, ui.id().with((id, "strip")), Sense::click_and_drag());
-    let rounding = if collapsed { CornerRadius::same(3) } else { CornerRadius { nw: 3, ne: 3, sw: 0, se: 0 } };
-    ui.painter().rect_filled(strip, rounding, t.tab_strip);
-    // Panel menu (hamburger); the tabs stay left of it, eliding or overflowing (#151).
-    let menu = Rect::from_center_size(pos2(strip.right() - 14.0, strip.center().y), vec2(20.0, 18.0));
-    let tabs_out = crate::tab_strip::pro_tabs(ui, ui.id().with((id, "tabs")), strip, menu.left(), tabs, selected, collapsed, reorderable);
-    let mresp = ui.interact(menu, ui.id().with((id, "menu")), Sense::click());
-    let c = if mresp.hovered() { t.text } else { t.text_faint };
-    for k in 0..3 {
-        let y = menu.center().y - 3.5 + k as f32 * 3.5;
-        ui.painter().line_segment([pos2(menu.center().x - 5.0, y), pos2(menu.center().x + 5.0, y)], Stroke::new(1.0, c));
-    }
-    // Body.
-    if !collapsed {
-        egui::Frame::NONE.fill(t.card).corner_radius(CornerRadius { nw: 0, ne: 0, sw: 3, se: 3 }).inner_margin(body_margin(true)).show(ui, |ui| {
-            ui.set_width(width - 16.0);
-            body(ui, *selected);
-        });
-    }
-    ui.add_space(2.0);
-    CardResponse::new(strip_resp, mresp, tabs_out)
-}
-
 /// The panel menu button (hamburger in Pro, ellipsis in Studio), matching the dock and cards.
 pub fn panel_menu_button(ui: &mut Ui) -> Response {
     let t = Tokens::get(ui.ctx());
@@ -243,7 +109,7 @@ pub fn panel_menu_button(ui: &mut Ui) -> Response {
         crate::icons::paint(ui, rect, "ellipsis", 14.0, tint);
     }
     let tip = tl!("Panel menu");
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tip));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tip));
     resp.on_hover_text(tip)
 }
 
@@ -264,7 +130,7 @@ pub fn pill_tab(ui: &mut Ui, label: &str, selected: bool) -> Response {
     }
     let color = if selected { t.text } else { t.text_dim };
     ui.painter().galley_with_override_text_color(rect.center() - galley.size() / 2.0, galley, color);
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, translated));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, translated));
     resp
 }
 
@@ -272,7 +138,13 @@ pub fn pill_tab(ui: &mut Ui, label: &str, selected: bool) -> Response {
 /// arithmetic (`1920/2`) applies on Enter, Tab or click-away, and a unit after a number converts
 /// into the field's unit (`1in` in a px field, at the resolution [`set_field_resolution`] gave).
 pub fn value_field(ui: &mut Ui, value: &mut f32, range: std::ops::RangeInclusive<f32>, suffix: &str, width: f32) -> Response {
-    value_field_in(ui, value, range, suffix, width, 0.0, FieldOpts::default()).0
+    value_field_in(ui, value, range, suffix, width, 0.0, FieldOpts::default(), None).0
+}
+
+/// A [`value_field`] whose visible caption was drawn apart from it (an options-bar caption in a
+/// nested layout): `name` names the number when the caption's scrub link did not reach it.
+pub fn value_field_named(ui: &mut Ui, name: &str, value: &mut f32, range: std::ops::RangeInclusive<f32>, suffix: &str, width: f32) -> Response {
+    value_field_in(ui, value, range, suffix, width, 0.0, FieldOpts::default(), Some(name)).0
 }
 
 /// A single-line label for a row that also holds fixed-width controls: laid out no wider than
@@ -287,7 +159,7 @@ pub fn elided_label_sensed(ui: &mut Ui, text: &str, max_w: f32, sense: Sense) ->
     let elided = galley.elided;
     let (rect, resp) = ui.allocate_exact_size(galley.size(), sense);
     ui.painter().galley(rect.min, galley, t.text_dim);
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Label, ui.is_enabled(), text));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Label, ui.is_enabled(), text));
     if elided { resp.on_hover_text(text) } else { resp }
 }
 
@@ -302,12 +174,12 @@ pub const VALUE_FIELD_H: f32 = 24.0;
 /// A [`value_field`] `height` points tall instead of [`VALUE_FIELD_H`], for slim bars such as
 /// the status bar (#2823).
 pub fn compact_value_field(ui: &mut Ui, value: &mut f32, range: std::ops::RangeInclusive<f32>, suffix: &str, width: f32, height: f32) -> Response {
-    value_field_box(ui, value, range, suffix, vec2(width, height), 0.0, FieldOpts::default()).0
+    value_field_box(ui, value, range, suffix, vec2(width, height), 0.0, FieldOpts::default(), None).0
 }
 
 /// A compact field whose mouse scrub wraps at the native fullscreen viewport's horizontal edges.
 pub(crate) fn compact_wrapping_value_field(ui: &mut Ui, value: &mut f32, range: std::ops::RangeInclusive<f32>, suffix: &str, size: Vec2) -> Response {
-    value_field_box(ui, value, range, suffix, size, 0.0, FieldOpts { wrap_drag: true, ..Default::default() }).0
+    value_field_box(ui, value, range, suffix, size, 0.0, FieldOpts { wrap_drag: true, ..Default::default() }, None).0
 }
 
 /// A size dialog's unit key (`px`, `in`, `cm`, `mm`, `pt`, `pica`, `percent`) as a unit.
@@ -334,7 +206,7 @@ pub fn unit_decimals(key: &str) -> u32 {
 /// A [`value_field`] showing `decimals` decimal places instead of the one (or two, for a small
 /// range) it picks itself: the ruler units need their own precision (#2434).
 pub fn value_field_prec(ui: &mut Ui, value: &mut f32, range: std::ops::RangeInclusive<f32>, suffix: &str, width: f32, decimals: u32) -> Response {
-    value_field_in(ui, value, range, suffix, width, 0.0, FieldOpts { decimals: Some(decimals), ..Default::default() }).0
+    value_field_in(ui, value, range, suffix, width, 0.0, FieldOpts { decimals: Some(decimals), ..Default::default() }, None).0
 }
 
 /// A field's unit and the resolution a typed unit converts at (`1in` in a px field).
@@ -350,7 +222,7 @@ pub struct FieldUnits {
 /// A [`value_field_prec`] without a suffix, whose unit is chosen beside it (Image Size and New
 /// Document's unit menus) and converts typed units at that dialog's own resolution.
 pub fn value_field_units(ui: &mut Ui, value: &mut f32, range: std::ops::RangeInclusive<f32>, width: f32, decimals: u32, units: FieldUnits) -> Response {
-    value_field_in(ui, value, range, "", width, 0.0, FieldOpts { decimals: Some(decimals), units: Some(units), ..Default::default() }).0
+    value_field_in(ui, value, range, "", width, 0.0, FieldOpts { decimals: Some(decimals), units: Some(units), ..Default::default() }, None).0
 }
 
 /// A [`value_field_prec`] in `units` whose 100 % is a length of `extent` px (Free Transform's W
@@ -369,11 +241,11 @@ pub fn value_field_extent(
     extent: f64,
 ) -> Response {
     let opts = FieldOpts { decimals: Some(decimals), units: Some(units), extent: Some(extent), ..Default::default() };
-    value_field_in(ui, value, range, suffix, width, 0.0, opts).0
+    value_field_in(ui, value, range, suffix, width, 0.0, opts, None).0
 }
 
 fn field_resolution_id() -> egui::Id {
-    egui::Id::new("pc-field-resolution")
+    egui::Id::unique("pc-field-resolution")
 }
 
 /// The resolution (pixels per inch) and point size (points per inch) a unit typed into a value
@@ -402,7 +274,10 @@ fn unit_of_suffix(suffix: &str) -> Option<photocraft_engine::prefs::Unit> {
 #[derive(Clone, Copy, Debug)]
 struct LabelScrub {
     pass: u64,
+    /// The id whose drags move the field (the label itself, or an options caption's hit area).
     label: egui::Id,
+    /// The visible label's own id, which names the field it scrubs.
+    name: Option<egui::Id>,
     rect: Rect,
     /// How far right of the label the field may start (the whole row for a slider row).
     max_gap: f32,
@@ -418,7 +293,7 @@ struct LabelScrub {
 }
 
 fn label_scrub_id() -> egui::Id {
-    egui::Id::new("pc-label-scrub")
+    egui::Id::unique("pc-label-scrub")
 }
 
 /// Makes `label` scrubby: dragging it left or right moves the value field drawn right after it on
@@ -444,6 +319,7 @@ fn scrub_option_area(ui: &Ui, label: &Response, tip: Option<&'static str>) {
     let scrub = LabelScrub {
         pass: ui.ctx().cumulative_pass_nr(),
         label: label.id.with("pc-option-scrub"),
+        name: Some(label.id),
         rect: label.rect,
         max_gap: 24.0,
         option_area: true,
@@ -459,7 +335,7 @@ fn scrub_option_area(ui: &Ui, label: &Response, tip: Option<&'static str>) {
 fn scrub_label_within(ui: &Ui, label: &Response, max_gap: f32) -> Response {
     // Drag only, not focusable: Tab goes to the value field, not to its label as well.
     let resp = label.interact(Sense::DRAG);
-    let scrub = label_scrub_response(ui, &resp, label.rect, max_gap);
+    let scrub = label_scrub_response(ui, &resp, label.rect, max_gap, Some(label.id));
     ui.data_mut(|d| {
         d.insert_temp(label_scrub_id(), scrub);
         d.insert_temp(resp.id.with("pc-scrub-linked"), false);
@@ -467,7 +343,7 @@ fn scrub_label_within(ui: &Ui, label: &Response, max_gap: f32) -> Response {
     resp
 }
 
-fn label_scrub_response(ui: &Ui, resp: &Response, original_rect: Rect, max_gap: f32) -> LabelScrub {
+fn label_scrub_response(ui: &Ui, resp: &Response, original_rect: Rect, max_gap: f32, name: Option<egui::Id>) -> LabelScrub {
     // Whether a field took this label's drags last frame: only then is it scrubby.
     let linked = ui.data(|d| d.get_temp::<bool>(resp.id.with("pc-scrub-linked"))).unwrap_or(false);
     if linked && resp.enabled() && (resp.hovered() || resp.dragged()) {
@@ -500,6 +376,7 @@ fn label_scrub_response(ui: &Ui, resp: &Response, original_rect: Rect, max_gap:
     LabelScrub {
         pass: ui.ctx().cumulative_pass_nr(),
         label: resp.id,
+        name,
         rect: original_rect,
         max_gap,
         option_area: false,
@@ -528,6 +405,22 @@ fn take_label_scrub(ui: &Ui, rect: Rect) -> Option<LabelScrub> {
     linked.then_some(s)
 }
 
+/// The visible caption left for the control drawn next this frame, if any, consumed so that a
+/// non-scrubbing control (a dropdown) can still take its name and the caption cannot leak on.
+fn take_label_scrub_name(ui: &Ui, rect: Rect) -> Option<egui::Id> {
+    let s = ui.data_mut(|d| {
+        let s = d.get_temp::<LabelScrub>(label_scrub_id());
+        d.remove::<LabelScrub>(label_scrub_id());
+        s
+    })?;
+    if s.pass != ui.ctx().cumulative_pass_nr() {
+        return None;
+    }
+    // Only a caption on the control's own row names it; one left over from an earlier row does not.
+    let same_row = rect.top() < s.rect.bottom() && rect.bottom() > s.rect.top();
+    same_row.then_some(s.name).flatten()
+}
+
 /// How a [`value_field_in`] shows and reads its number, beyond its suffix.
 #[derive(Clone, Copy, Debug, Default)]
 struct FieldOpts {
@@ -557,6 +450,8 @@ fn field_fine(range: &std::ops::RangeInclusive<f32>, decimals: Option<u32>, step
 
 /// A [`value_field`] that leaves `trailing` points free inside its box, right of the suffix, and
 /// returns the box with the number's response.
+// The explicit accessible name accompanies the existing numeric-field parameters.
+#[expect(clippy::too_many_arguments)]
 fn value_field_in(
     ui: &mut Ui,
     value: &mut f32,
@@ -565,11 +460,14 @@ fn value_field_in(
     width: f32,
     trailing: f32,
     opts: FieldOpts,
+    name: Option<&str>,
 ) -> (Response, Rect) {
-    value_field_box(ui, value, range, suffix, vec2(width, VALUE_FIELD_H), trailing, opts)
+    value_field_box(ui, value, range, suffix, vec2(width, VALUE_FIELD_H), trailing, opts, name)
 }
 
 /// [`value_field_in`] with a box of any `size`.
+// The explicit accessible name accompanies the existing numeric-field parameters.
+#[expect(clippy::too_many_arguments)]
 fn value_field_box(
     ui: &mut Ui,
     value: &mut f32,
@@ -578,10 +476,13 @@ fn value_field_box(
     size: Vec2,
     trailing: f32,
     opts: FieldOpts,
+    name: Option<&str>,
 ) -> (Response, Rect) {
     let FieldOpts { decimals, step_from_decimals, units, extent, wrap_drag } = opts;
     let t = Tokens::get(ui.ctx());
     let (rect, slot) = ui.allocate_exact_size(size, Sense::hover());
+    let last_editor = ui.data(|d| d.get_temp::<egui::Id>(slot.id));
+    let mut option_click = false;
     let scrub = take_label_scrub(ui, rect).map(|s| {
         if !s.option_area {
             return s;
@@ -591,12 +492,13 @@ fn value_field_box(
         // Preserve a popup field's trailing arrow, and never extend outside the UI clip.
         let hit = Rect::from_min_max(pos2(s.rect.left(), rect.top()), pos2(rect.right() - trailing, rect.bottom())).intersect(ui.clip_rect());
         let mut resp = ui.interact(hit, s.label, Sense::CLICK | Sense::DRAG);
+        option_click = resp.clicked();
         if let Some(tip) = s.tip
             && resp.hover_pos().is_some_and(|p| s.rect.contains(p))
         {
             resp = resp.on_hover_text(tip);
         }
-        label_scrub_response(ui, &resp, s.rect, s.max_gap)
+        label_scrub_response(ui, &resp, s.rect, s.max_gap, s.name)
     });
     let (dpi, ppi) = ui.data(|d| d.get_temp::<(f64, f64)>(field_resolution_id())).unwrap_or((72.0, 72.0));
     // Typed text loses its spaces before parsing, so a " pt" suffix reads as "pt".
@@ -662,6 +564,21 @@ fn value_field_box(
         }
     };
     ui.data_mut(|d| d.insert_temp(slot.id, resp.id));
+    // A click on the caption's expanded hit area (outside the editor) is not an edit: keep the
+    // number's keyboard focus, but never take it for a field that did not have it.
+    if option_click
+        && let Some(id) = last_editor
+        && ui.memory(|m| m.had_focus_last_frame(id))
+    {
+        ui.memory_mut(|m| m.request_focus(id));
+    }
+    // A scrubby caption is also the field's visible label, so it names the number for screen readers.
+    if let Some(id) = scrub.as_ref().and_then(|s| s.name) {
+        resp = resp.labelled_by(id);
+    } else if let Some(name) = name {
+        // The caption drew in another Ui (or row), so it could not name the number itself.
+        resp = resp.accessible_name(name);
+    }
     if let Some(s) = scrub {
         if s.started && ui.memory(|m| m.has_focus(resp.id)) {
             ui.memory_mut(|m| m.surrender_focus(resp.id));
@@ -740,11 +657,13 @@ pub struct PopupFieldResponse {
 pub fn popup_value_field(ui: &mut Ui, name: &str, value: &mut f32, range: std::ops::RangeInclusive<f32>, suffix: &str, width: f32) -> PopupFieldResponse {
     let t = Tokens::get(ui.ctx());
     let (lo, hi) = (*range.start(), *range.end());
-    let (field, rect) = value_field_in(ui, value, range.clone(), suffix, width, POPUP_ARROW_W, FieldOpts::default());
+    let (mut field, rect) = value_field_in(ui, value, range.clone(), suffix, width, POPUP_ARROW_W, FieldOpts::default(), None);
     let arrow = Rect::from_min_max(pos2(rect.right() - POPUP_ARROW_W - 2.0, rect.top() + 2.0), rect.max - vec2(2.0, 2.0));
     let resp = ui.interact(arrow, field.id.with("popup-slider"), Sense::click_and_drag());
     let name = name.trim_end_matches([':', '：']).to_string();
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), &name));
+    // Both the number and its ▾ are named by the control's own semantic name.
+    field = field.accessible_name(name.clone());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), &name));
     let resp = resp.on_hover_text(&name);
     let drag_key = resp.id.with("drag");
     // Every drag gets a new number when it starts, even if its first frame changes nothing.
@@ -890,11 +809,11 @@ pub fn text_field_ex(ui: &mut Ui, id: egui::Id, text: &mut String, hint: &str, w
     // the text sits on the field's middle like a dropdown's or value field's.
     let edit = egui::TextEdit::singleline(shown)
         .id(id)
-        .hint_text(hint)
+        .hint_text(hint.to_owned())
         .frame(egui::Frame::NONE)
         .font(font)
         .min_size(inner.size())
-        .vertical_align(egui::Align::Center)
+        .align(egui::Align2::LEFT_CENTER)
         .char_limit(limit);
     // A child Ui keeps the field's selection colour local: `Visuals::selection` also fills selected
     // list rows and slider trails, which must keep the theme's.
@@ -913,7 +832,7 @@ pub fn text_field_ex(ui: &mut Ui, id: egui::Id, text: &mut String, hint: &str, w
 }
 
 fn first_field_id() -> egui::Id {
-    egui::Id::new("pc-focus-first-field")
+    egui::Id::unique("pc-focus-first-field")
 }
 
 /// While `on`, the next number field drawn takes the keyboard focus with its text selected (a
@@ -1291,9 +1210,12 @@ pub fn slider_row_prec(
 ) -> Response {
     let t = Tokens::get(ui.ctx());
     let mut changed_resp = None;
+    // The row's caption names both its number (through the scrub link) and its slider.
+    let mut label_id = None;
     ui.horizontal(|ui| {
         // The label scrubs the row's field, across the row (Photoshop's scrubby labels).
         let l = ui.label(egui::RichText::new(tl!(label)).color(t.text_dim));
+        label_id = Some(l.id);
         scrub_label_within(ui, &l, f32::INFINITY);
         ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
             changed_resp = Some(
@@ -1305,12 +1227,15 @@ pub fn slider_row_prec(
                     74.0,
                     0.0,
                     FieldOpts { decimals, step_from_decimals: decimals.is_some(), ..Default::default() },
+                    None,
                 )
                 .0,
             );
         });
     });
     let s = slider_with(ui, value, range, gradient, g);
+    s.widget_info(|| egui::WidgetInfo::slider(ui.is_enabled(), f64::from(*value), tl!(label)));
+    let s = if let Some(id) = label_id { s.labelled_by(id) } else { s };
     let mut r = s.clone();
     if let Some(v) = changed_resp {
         if v.changed() {
@@ -1491,7 +1416,7 @@ fn button_impl_h(ui: &mut Ui, label: &str, min_width: f32, height: Option<f32>,
     let h = size.y;
     let (rect, resp) = ui.allocate_exact_size(size, Sense::click());
     // Painted text: name the button for accessibility (and so tests and agents can find it).
-    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), label));
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, ui.is_enabled(), label));
     if resp.has_focus() {
         // Keyboard focus (Tab); clicks don't focus egui buttons.
         let r = if t.pro { h / 2.0 } else { t.radius_sm } + 2.0;
@@ -1579,20 +1504,20 @@ pub fn hue_stops() -> Vec<Color32> {
 }
 
 /// A compact labelled dropdown in the studio style.
-pub fn dropdown<T: PartialEq + Clone>(ui: &mut Ui, id: &str, current: &mut T, options: &[(T, &str)], width: f32) -> bool {
-    dropdown_hovered(ui, id, current, options, width).0
+pub fn dropdown<T: PartialEq + Clone>(ui: &mut Ui, id: &str, name: &str, current: &mut T, options: &[(T, &str)], width: f32) -> bool {
+    dropdown_hovered(ui, id, name, current, options, width).0
 }
 
 /// [`dropdown`] whose option labels are shown exactly as given: names the user typed (a channel
 /// or layer name) must not be translated, unlike the built-in labels [`dropdown`] translates (#5335).
-pub fn dropdown_literal<T: PartialEq + Clone>(ui: &mut Ui, id: &str, current: &mut T, options: &[(T, &str)], width: f32) -> bool {
-    let (chosen, _) = dropdown_with(ui, id, current, options, width, false, false);
+pub fn dropdown_literal<T: PartialEq + Clone>(ui: &mut Ui, id: &str, name: &str, current: &mut T, options: &[(T, &str)], width: f32) -> bool {
+    let (chosen, _) = dropdown_with(ui, id, name, current, options, width, false, false);
     !chosen.is_empty()
 }
 
 /// [`dropdown`], also returning the option under the pointer in its open list (live previews).
-pub fn dropdown_hovered<T: PartialEq + Clone>(ui: &mut Ui, id: &str, current: &mut T, options: &[(T, &str)], width: f32) -> (bool, Option<T>) {
-    let (chosen, hovered) = dropdown_with(ui, id, current, options, width, false, true);
+pub fn dropdown_hovered<T: PartialEq + Clone>(ui: &mut Ui, id: &str, name: &str, current: &mut T, options: &[(T, &str)], width: f32) -> (bool, Option<T>) {
+    let (chosen, hovered) = dropdown_with(ui, id, name, current, options, width, false, true);
     (!chosen.is_empty(), hovered)
 }
 
@@ -1602,14 +1527,22 @@ pub fn dropdown_hovered<T: PartialEq + Clone>(ui: &mut Ui, id: &str, current: &m
 /// follows the value instead, nor what the dropdown is in. Returns every option chosen this frame
 /// in order (one per notch; the last is `current`) and the option under the pointer in the open
 /// list, none while the pointer rests where the wheel last stepped.
-pub fn dropdown_wheel_hovered<T: PartialEq + Clone>(ui: &mut Ui, id: &str, current: &mut T, options: &[(T, &str)], width: f32) -> (Vec<T>, Option<T>) {
-    dropdown_with(ui, id, current, options, width, true, true)
+pub fn dropdown_wheel_hovered<T: PartialEq + Clone>(
+    ui: &mut Ui,
+    id: &str,
+    name: &str,
+    current: &mut T,
+    options: &[(T, &str)],
+    width: f32,
+) -> (Vec<T>, Option<T>) {
+    dropdown_with(ui, id, name, current, options, width, true, true)
 }
 
 #[allow(clippy::too_many_arguments)]
 fn dropdown_with<T: PartialEq + Clone>(
     ui: &mut Ui,
     id: &str,
+    name: &str,
     current: &mut T,
     options: &[(T, &str)],
     width: f32,
@@ -1678,14 +1611,19 @@ fn dropdown_with<T: PartialEq + Clone>(
                 hovered = nearest.map(|(_, v)| v.clone());
             }
         });
-    press.after(&response.response);
-    if combo_box_arrow_keys(ui, &response.response, current, options) {
+    // A scrubby caption drawn just before the dropdown names it; otherwise its own name does.
+    let response = match take_label_scrub_name(ui, response.response.rect) {
+        Some(label) => response.response.labelled_by(label),
+        None => response.response.accessible_name(name),
+    };
+    press.after(&response);
+    if combo_box_arrow_keys(ui, &response, current, options) {
         chosen.push(current.clone());
     }
     if wheel && !over_list {
-        let stepped = wheel_steps(ui, wheel_id, response.response.hovered(), current, options);
+        let stepped = wheel_steps(ui, wheel_id, response.hovered(), current, options);
         wheeled = !stepped.is_empty();
-        if wheeled && egui::ComboBox::is_open(ui.ctx(), response.response.id) {
+        if wheeled && egui::ComboBox::is_open(ui.ctx(), response.id) {
             ui.data_mut(|d| d.insert_temp(reveal_id, true));
         }
         chosen.extend(stepped);
@@ -1824,7 +1762,7 @@ pub fn swatch_popup(swatch: &Response) -> egui::Popup<'static> {
         .align_alternatives(&[egui::RectAlign::TOP_START])
 }
 
-pub fn dropdown_with_tooltips<T: PartialEq + Clone>(ui: &mut Ui, id: &str, current: &mut T, options: &[(T, &str, &str)], width: f32) -> bool {
+pub fn dropdown_with_tooltips<T: PartialEq + Clone>(ui: &mut Ui, id: &str, name: &str, current: &mut T, options: &[(T, &str, &str)], width: f32) -> bool {
     let label = options.iter().find(|(v, _, _)| v == current).map(|(_, l, _)| tl!(l)).unwrap_or("—");
     let mut changed = false;
     let (press, close) = crate::press_menu::PressCombo::before(ui, id);
@@ -1845,9 +1783,13 @@ pub fn dropdown_with_tooltips<T: PartialEq + Clone>(ui: &mut Ui, id: &str, curre
                 }
             }
         });
-    press.after(&response.response);
+    let response = match take_label_scrub_name(ui, response.response.rect) {
+        Some(label) => response.response.labelled_by(label),
+        None => response.response.accessible_name(name),
+    };
+    press.after(&response);
     if let Some((_, _, tip)) = options.iter().find(|(v, _, _)| v == current) {
-        let _ = response.response.on_hover_text(tl!(tip));
+        response.on_hover_text(tl!(tip));
     }
     changed
 }
@@ -1882,7 +1824,7 @@ fn checker_uv(rect: Rect, cell: f32) -> Rect {
 }
 
 fn checker_tile_id() -> egui::Id {
-    egui::Id::new("transparency-checker-tile")
+    egui::Id::unique("transparency-checker-tile")
 }
 
 /// The checker's two-by-two tile (light, dark / dark, light), loaded once per context and shared
@@ -1927,7 +1869,7 @@ pub fn checkbox(ui: &mut Ui, on: &mut bool, label: &str) -> Response {
     }
     // The label is the single named, focusable checkbox; the box is a mouse target.
     // Override Label's metadata instead of creating a second node with the same name.
-    label_resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, ui.is_enabled(), *on, tl!(label)));
+    label_resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::CheckBox, ui.is_enabled(), *on, tl!(label)));
     resp
 }
 
@@ -2261,7 +2203,7 @@ mod tests {
         let mut h = Harness::new_ui_state(
             |ui, s: &mut (String, egui::Color32, egui::Color32)| {
                 s.1 = ui.visuals().selection.bg_fill;
-                super::text_field(ui, egui::Id::new("tf"), &mut s.0, "hint", 140.0, false);
+                super::text_field(ui, egui::Id::unique("tf"), &mut s.0, "hint", 140.0, false);
                 s.2 = ui.visuals().selection.bg_fill;
             },
             (String::new(), egui::Color32::WHITE, egui::Color32::BLACK),
@@ -2283,7 +2225,7 @@ mod tests {
     #[test]
     fn text_field_caps_a_huge_paste() {
         use egui::accesskit::Role;
-        let mut h = Harness::new_ui_state(|ui, s: &mut String| drop(super::text_field(ui, egui::Id::new("tf"), s, "", 140.0, false)), String::new());
+        let mut h = Harness::new_ui_state(|ui, s: &mut String| drop(super::text_field(ui, egui::Id::unique("tf"), s, "Value", 140.0, false)), String::new());
         crate::PhotocraftApp::setup_context(&h.ctx, crate::theme::ThemeKind::Studio);
         h.run();
         h.get_by_role(Role::TextInput).click();
@@ -2303,7 +2245,7 @@ mod tests {
     fn text_field_bounds_an_oversized_existing_value() {
         use egui::accesskit::Role;
         let long = "9".repeat(super::TEXT_FIELD_LIMIT * 4);
-        let mut h = Harness::new_ui_state(|ui, s: &mut String| drop(super::text_field(ui, egui::Id::new("tf"), s, "", 140.0, false)), long.clone());
+        let mut h = Harness::new_ui_state(|ui, s: &mut String| drop(super::text_field(ui, egui::Id::unique("tf"), s, "Value", 140.0, false)), long.clone());
         crate::PhotocraftApp::setup_context(&h.ctx, crate::theme::ThemeKind::Studio);
         h.run();
         assert_eq!(*h.state(), long, "drawing alone leaves the caller's value alone");
@@ -2358,11 +2300,53 @@ mod tests {
         assert_eq!(events[5], egui::Event::Copy);
     }
 
+    /// A row's visible caption names both its number and its slider; a dropdown is named by its
+    /// own caption, or by the scrubby caption drawn just before it.
+    #[test]
+    fn labelled_rows_and_dropdowns_have_semantic_accessible_names() {
+        use egui_kittest::{Harness, kittest::Queryable};
+
+        #[derive(Default)]
+        struct State {
+            value: f32,
+            fill: f32,
+            blend: usize,
+            mode: usize,
+        }
+
+        let mut h = Harness::builder().with_size(egui::vec2(360.0, 240.0)).build_ui_state(
+            |ui, s: &mut State| {
+                super::slider_row(ui, "Opacity", &mut s.value, 0.0..=100.0, "%", None);
+                super::popup_value_field(ui, "Fill", &mut s.fill, 0.0..=100.0, "%", 74.0);
+                let opts = [(0usize, "Normal"), (1, "Multiply")];
+                super::dropdown(ui, "blend", "Blend Mode", &mut s.blend, &opts, 120.0);
+                ui.horizontal(|ui| {
+                    let caption = ui.label("Mode");
+                    super::scrub_option_label(ui, &caption);
+                    super::dropdown(ui, "mode", "Not this name", &mut s.mode, &opts, 120.0);
+                });
+            },
+            State::default(),
+        );
+        crate::PhotocraftApp::setup_context(&h.ctx, Default::default());
+        h.run();
+
+        // The row's caption is the accessible name of the value field and of the slider.
+        h.get_by_role_and_label(egui::accesskit::Role::SpinButton, "Opacity");
+        h.get_by_role_and_label(egui::accesskit::Role::Slider, "Opacity");
+        // A popup value field names both its number and the arrow that opens its slider.
+        h.get_by_role_and_label(egui::accesskit::Role::SpinButton, "Fill");
+        h.get_by_role_and_label(egui::accesskit::Role::Button, "Fill");
+        // A dropdown requires a real name; a preceding scrubby caption is used when present.
+        h.get_by_role_and_label(egui::accesskit::Role::ComboBox, "Blend Mode");
+        h.get_by_role_and_label(egui::accesskit::Role::ComboBox, "Mode");
+    }
+
     /// Sets up a test with one value field. Its state is its value and how many times it changed.
     fn field(value: f32, range: std::ops::RangeInclusive<f32>) -> Harness<'static, (f32, u32)> {
         let mut h = Harness::new_ui_state(
             move |ui, s: &mut (f32, u32)| {
-                if super::value_field(ui, &mut s.0, range.clone(), "px", 80.0).changed() {
+                if super::value_field(ui, &mut s.0, range.clone(), "px", 80.0).accessible_name("Test number").changed() {
                     s.1 += 1;
                 }
             },
@@ -2390,7 +2374,9 @@ mod tests {
     fn value_field_number_slot_is_centred_in_its_box() {
         let mut h = Harness::new_ui_state(
             |ui, s: &mut (f32, egui::Rect)| {
-                s.1 = super::value_field_in(ui, &mut s.0, 0.0..=100.0, "px", 80.0, 0.0, super::FieldOpts::default()).1;
+                let field = super::value_field_in(ui, &mut s.0, 0.0..=100.0, "px", 80.0, 0.0, super::FieldOpts::default(), None);
+                s.1 = field.1;
+                field.0.accessible_name("Value");
             },
             (50.0, egui::Rect::NOTHING),
         );
@@ -2409,7 +2395,9 @@ mod tests {
         for kind in [crate::theme::ThemeKind::Pro, crate::theme::ThemeKind::Studio] {
             let mut h = Harness::builder().with_size(egui::vec2(100.0, 40.0)).with_pixels_per_point(scale).wgpu().build_ui_state(
                 |ui, s: &mut (f32, egui::Rect)| {
-                    s.1 = super::value_field_in(ui, &mut s.0, 0.0..=100.0, "%", 80.0, 0.0, super::FieldOpts::default()).1;
+                    let field = super::value_field_in(ui, &mut s.0, 0.0..=100.0, "%", 80.0, 0.0, super::FieldOpts::default(), None);
+                    s.1 = field.1;
+                    field.0.accessible_name("Value");
                 },
                 (100.0, egui::Rect::NOTHING),
             );
@@ -2446,7 +2434,7 @@ mod tests {
                 let mut harness = Harness::new_ui_state(
                     move |ui, s: &mut (f32, egui::Rect)| {
                         let before = ui.cursor().min;
-                        super::compact_value_field(ui, &mut s.0, 0.0..=3200.0, "%", w, h);
+                        super::compact_value_field(ui, &mut s.0, 0.0..=3200.0, "%", w, h).accessible_name("Zoom");
                         s.1 = egui::Rect::from_min_size(before, egui::vec2(w, h));
                     },
                     (v, egui::Rect::NOTHING),
@@ -2471,7 +2459,7 @@ mod tests {
             let mut h = Harness::new_ui_state(
                 move |ui, s: &mut (f32, egui::Rect, f32)| {
                     let before = ui.cursor().min;
-                    super::compact_value_field(ui, &mut s.0, 0.0..=3200.0, suffix, 64.0, 18.0);
+                    super::compact_value_field(ui, &mut s.0, 0.0..=3200.0, suffix, 64.0, 18.0).accessible_name("Zoom");
                     s.1 = egui::Rect::from_min_size(before, egui::vec2(64.0, 18.0));
                     s.2 = ui.painter().layout_no_wrap(suffix.to_owned(), crate::theme::mono(11.0), egui::Color32::WHITE).size().x;
                 },
@@ -2589,8 +2577,8 @@ mod tests {
     fn held_arrow_keeps_stepping_the_focused_field() {
         let mut h = Harness::new_ui_state(
             |ui, s: &mut (f32, f32)| {
-                super::value_field(ui, &mut s.0, 0.0..=1000.0, "", 80.0);
-                super::value_field(ui, &mut s.1, 0.0..=1000.0, "", 80.0);
+                super::value_field(ui, &mut s.0, 0.0..=1000.0, "", 80.0).accessible_name("Left");
+                super::value_field(ui, &mut s.1, 0.0..=1000.0, "", 80.0).accessible_name("Right");
             },
             (10.0, 59.0),
         );
@@ -2641,13 +2629,13 @@ mod tests {
                 ui.horizontal(|ui| {
                     let l = ui.label("Size:");
                     super::scrub_label(ui, &l);
-                    super::value_field(ui, &mut s.0, 0.0..=1000.0, "px", 80.0);
+                    super::value_field(ui, &mut s.0, 0.0..=1000.0, "px", 80.0).accessible_name("Start");
                 });
                 ui.horizontal(|ui| {
                     let l = ui.label("Mode:");
                     super::scrub_label(ui, &l);
                     ui.add_space(60.0);
-                    super::value_field(ui, &mut s.1, 0.0..=1000.0, "px", 80.0);
+                    super::value_field(ui, &mut s.1, 0.0..=1000.0, "px", 80.0).accessible_name("End");
                 });
             },
             (100.0, 100.0),
@@ -2759,7 +2747,7 @@ mod tests {
         use egui_kittest::{Harness, kittest::Queryable};
         let mut h = Harness::builder().with_size(egui::vec2(300.0, 100.0)).build_ui_state(
             move |ui, (v, ok): &mut (f32, Option<f32>)| {
-                super::value_field(ui, v, 0.0..=300000.0, "px", 90.0);
+                super::value_field(ui, v, 0.0..=300000.0, "px", 90.0).accessible_name("Size");
                 if round {
                     *v = v.round();
                 }
@@ -2787,7 +2775,7 @@ mod tests {
         use egui_kittest::{Harness, kittest::Queryable};
         let mut h = Harness::builder().with_size(egui::vec2(300.0, 100.0)).build_ui_state(
             |ui, (v, changes): &mut (f32, u32)| {
-                if super::value_field(ui, v, 0.0..=100.0, "%", 90.0).changed() {
+                if super::value_field(ui, v, 0.0..=100.0, "%", 90.0).accessible_name("Opacity").changed() {
                     *changes += 1;
                 }
             },
@@ -2811,7 +2799,7 @@ mod tests {
         use egui_kittest::{Harness, kittest::Queryable};
         let mut h = Harness::builder().with_size(egui::vec2(300.0, 100.0)).build_ui_state(
             |ui, (v, changes): &mut (f32, u32)| {
-                if super::value_field(ui, v, 0.1..=1296.0, "pt", 90.0).changed() {
+                if super::value_field(ui, v, 0.1..=1296.0, "pt", 90.0).accessible_name("Font size").changed() {
                     *changes += 1;
                 }
             },
@@ -2863,7 +2851,7 @@ mod tests {
         let mut h = Harness::builder().with_size(egui::vec2(300.0, 100.0)).build_ui_state(
             |ui, selected: &mut usize| {
                 let options = [(0, "Normal"), (1, "Multiply"), (2, "Screen")];
-                super::dropdown(ui, "blend-mode", selected, &options, 120.0);
+                super::dropdown(ui, "blend-mode", tl!("Blend Mode"), selected, &options, 120.0);
             },
             0,
         );
@@ -2885,7 +2873,7 @@ mod tests {
         let mut h = Harness::builder().with_size(egui::vec2(400.0, 700.0)).build_ui_state(
             |ui, mode: &mut BlendMode| {
                 let opts: Vec<(BlendMode, &str)> = BlendMode::LAYER_MODES.iter().map(|m| (*m, m.label())).collect();
-                super::dropdown(ui, "brush-mode", mode, &opts, 96.0);
+                super::dropdown(ui, "brush-mode", tl!("Mode"), mode, &opts, 96.0);
             },
             BlendMode::Normal,
         );
@@ -2899,6 +2887,7 @@ mod tests {
         for _ in 0..30 {
             h.hover_at(open.center());
             h.event(egui::Event::MouseWheel {
+                source: egui::MouseWheelSource::Unknown,
                 unit: egui::MouseWheelUnit::Line,
                 delta: egui::vec2(0.0, -1.0),
                 phase: egui::TouchPhase::Move,
@@ -2916,9 +2905,9 @@ mod tests {
         Harness::builder().with_size(egui::vec2(300.0, 100.0)).build_ui_state(
             move |ui, selected: &mut usize| {
                 if wheel {
-                    super::dropdown_wheel_hovered(ui, "blend-mode", selected, &MODES, 120.0);
+                    super::dropdown_wheel_hovered(ui, "blend-mode", tl!("Blend Mode"), selected, &MODES, 120.0);
                 } else {
-                    super::dropdown(ui, "blend-mode", selected, &MODES, 120.0);
+                    super::dropdown(ui, "blend-mode", tl!("Blend Mode"), selected, &MODES, 120.0);
                 }
             },
             0,
@@ -2931,7 +2920,7 @@ mod tests {
         h.event(egui::Event::ModifiersChanged(modifiers));
         h.hover_at(at);
         h.run();
-        h.event(egui::Event::MouseWheel { unit, delta, phase: egui::TouchPhase::Move, modifiers });
+        h.event(egui::Event::MouseWheel { source: egui::MouseWheelSource::Unknown, unit, delta, phase: egui::TouchPhase::Move, modifiers });
         h.run();
         h.event(egui::Event::ModifiersChanged(Modifiers::NONE));
         h.run();
@@ -2964,7 +2953,7 @@ mod tests {
         let mut h = Harness::builder().with_size(egui::vec2(300.0, 100.0)).build_ui_state(
             |ui, selected: &mut usize| {
                 egui::ScrollArea::vertical().max_height(80.0).show(ui, |ui| {
-                    super::dropdown_wheel_hovered(ui, "blend-mode", selected, &MODES, 120.0);
+                    super::dropdown_wheel_hovered(ui, "blend-mode", tl!("Blend Mode"), selected, &MODES, 120.0);
                     ui.add_space(400.0);
                 });
             },
@@ -2995,7 +2984,9 @@ pub fn color_edit_button_srgba(ui: &mut Ui, color: &mut Color32) -> Response {
 pub(crate) fn color_swatch(ui: &mut Ui, color: Color32) -> Response {
     let t = Tokens::get(ui.ctx());
     let (rect, response) = ui.allocate_exact_size(ui.spacing().interact_size, Sense::click());
-    response.widget_info(|| egui::WidgetInfo::new(egui::WidgetType::ColorButton));
+    // A swatch's meaning is the colour it edits; callers with a more specific caption use
+    // `color_swatch_button` or add `labelled_by`.
+    response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ColorWell, ui.is_enabled(), tl!("Color")));
     checker_rounded(ui.painter(), rect, 4.0, t.radius_sm);
     ui.painter().rect_filled(rect.shrink(1.0), t.radius_sm, color);
     ui.painter().rect_stroke(rect, t.radius_sm, Stroke::new(1.0, t.field_border), StrokeKind::Inside);
@@ -3016,7 +3007,7 @@ pub fn pick_pos(resp: &Response) -> Option<Pos2> {
 pub fn color_swatch_button(ui: &mut Ui, color: Color32, label: &str) -> Response {
     let t = Tokens::get(ui.ctx());
     let (rect, response) = ui.allocate_exact_size(ui.spacing().interact_size, Sense::click());
-    response.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::ColorButton, true, label));
+    response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ColorWell, true, label));
     checker_rounded(ui.painter(), rect, 4.0, t.radius_sm);
     ui.painter().rect_filled(rect.shrink(1.0), t.radius_sm, color);
     ui.painter().rect_stroke(rect, t.radius_sm, Stroke::new(1.0, t.field_border), StrokeKind::Inside);
diff --git a/crates/ui-egui/src/widgets/angle_dial.rs b/crates/ui-egui/src/widgets/angle_dial.rs
index f606161a12..7a6c82f6b1 100644
--- a/crates/ui-egui/src/widgets/angle_dial.rs
+++ b/crates/ui-egui/src/widgets/angle_dial.rs
@@ -16,7 +16,7 @@ pub fn angle_dial_row(ui: &mut Ui, label: &str, angle: &mut f32, range: std::ops
     ui.horizontal(|ui| {
         ui.label(egui::RichText::new(tl!(label)).color(t.text_dim));
         let (rect, mut dial) = ui.allocate_exact_size(vec2(42.0, 42.0), Sense::click_and_drag());
-        dial.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Slider, ui.is_enabled(), tl!(label)));
+        dial.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Slider, ui.is_enabled(), tl!(label)));
         if (dial.clicked() || dial.dragged())
             && let Some(pos) = dial.interact_pointer_pos()
         {
@@ -49,7 +49,7 @@ pub fn angle_dial_row(ui: &mut Ui, label: &str, angle: &mut f32, range: std::ops
             }
         }
         // The dialogs' own number field: it takes the opening focus (#1757), Tab and arrow steps.
-        let field = value_field(ui, angle, range, "°", 64.0);
+        let field = value_field(ui, angle, range, "°", 64.0).accessible_name(tl!(label));
         if field.changed() {
             dial.mark_changed();
         }
@@ -64,7 +64,7 @@ mod tests {
     use egui_kittest::kittest::Queryable;
 
     fn click(h: &mut egui_kittest::Harness<'_, f32>, delta: Vec2) {
-        let rect = h.query_all_by_label("Angle").last().unwrap().rect();
+        let rect = h.get_by_role_and_label(egui::accesskit::Role::Slider, "Angle").rect();
         let pos = rect.center() + delta;
         h.event(egui::Event::PointerMoved(pos));
         h.event(egui::Event::PointerButton { pos, button: egui::PointerButton::Primary, pressed: true, modifiers: egui::Modifiers::NONE });
diff --git a/crates/ui-egui/src/widgets/color_count.rs b/crates/ui-egui/src/widgets/color_count.rs
index 87d109b4de..da65928ad7 100644
--- a/crates/ui-egui/src/widgets/color_count.rs
+++ b/crates/ui-egui/src/widgets/color_count.rs
@@ -42,7 +42,7 @@ pub fn color_count_row(ui: &mut Ui, label: &str, count: &mut u32) -> Response {
             child.style_mut().visuals.widgets.inactive.bg_stroke = Stroke::NONE;
             child.style_mut().visuals.widgets.hovered.bg_stroke = Stroke::NONE;
             child.style_mut().override_font_id = Some(theme::mono(12.0));
-            child.add(egui::DragValue::new(count).range(2..=256).speed(1.0).max_decimals(0).custom_parser(parse_count));
+            child.add(egui::DragValue::new(count).range(2..=256).speed(1.0).max_decimals(0).custom_parser(parse_count)).accessible_name(tl!(label));
         });
     });
     let (rect, mut response) = ui.allocate_exact_size(vec2(ui.available_width().max(60.0), 36.0), Sense::click_and_drag());
diff --git a/crates/ui-egui/src/widgets/numeric_input_tests.rs b/crates/ui-egui/src/widgets/numeric_input_tests.rs
index 41eff2ed4c..bcabc433d7 100644
--- a/crates/ui-egui/src/widgets/numeric_input_tests.rs
+++ b/crates/ui-egui/src/widgets/numeric_input_tests.rs
@@ -9,7 +9,7 @@ type Fields = (f32, String);
 fn fields() -> Harness<'static, Fields> {
     let mut h = Harness::builder().with_size(egui::vec2(400.0, 180.0)).build_ui_state(
         |ui, (number, text): &mut Fields| {
-            super::value_field(ui, number, 0.01..=12800.0, "%", 90.0);
+            super::value_field(ui, number, 0.01..=12800.0, "%", 90.0).accessible_name("Test number");
             ui.add(egui::TextEdit::multiline(text).hint_text("Document text"));
         },
         (100.0, String::new()),
@@ -64,9 +64,9 @@ fn oversized_numeric_text_paste_and_ime_are_bounded_before_layout() {
         if matches!(&event, Event::Ime(_)) {
             // egui 0.36 assigns IME events to the focused widget; Enabled is deprecated and
             // ignored. Prove both live composition and commitment reach this field first.
-            h.event(Event::Ime(ImeEvent::Preedit { text: "に".into(), active_range_chars: Some(0..1) }));
+            h.event(Event::Ime(ImeEvent::Preedit { text: "é".into(), active_range_chars: Some(0..1) }));
             h.run();
-            assert_eq!(numeric_text(&h), "に", "short IME composition reaches the numeric editor");
+            assert_eq!(numeric_text(&h), "é", "short IME composition reaches the numeric editor");
             h.event(Event::Ime(ImeEvent::Commit("é".into())));
             h.run();
             assert_eq!(numeric_text(&h), "é", "IME commit replaces its composition");
@@ -179,7 +179,7 @@ fn tab_and_paste_in_one_frame_filter_only_the_receiving_numeric_field() {
     let mut h = Harness::builder().with_size(egui::vec2(400.0, 180.0)).build_ui_state(
         |ui, (number, text): &mut Fields| {
             ui.add(egui::TextEdit::multiline(text).hint_text("Document text"));
-            super::value_field(ui, number, 0.01..=12800.0, "%", 90.0);
+            super::value_field(ui, number, 0.01..=12800.0, "%", 90.0).accessible_name("Test number");
         },
         (100.0, String::new()),
     );
diff --git a/crates/ui-egui/src/widgets/type_ahead.rs b/crates/ui-egui/src/widgets/type_ahead.rs
index 288b33b02b..57eebc0f85 100644
--- a/crates/ui-egui/src/widgets/type_ahead.rs
+++ b/crates/ui-egui/src/widgets/type_ahead.rs
@@ -10,7 +10,7 @@ const PAUSE: f64 = 1.0;
 
 /// Where the frame number of the last frame an open dropdown list was drawn is kept.
 fn open_id() -> Id {
-    Id::new("pc-dropdown-list-open")
+    Id::unique("pc-dropdown-list-open")
 }
 
 /// Is a dropdown list open? It then owns the keyboard, like an open menu: a letter picks an
@@ -137,7 +137,7 @@ mod tests {
         let mut h = Harness::builder().with_size(egui::vec2(300.0, 400.0)).build_ui_state(
             |ui, selected: &mut usize| {
                 let options = [(0, "Normal"), (1, "Dissolve"), (2, "Darken"), (3, "Multiply"), (4, "Darker Color")];
-                crate::widgets::dropdown(ui, "blend-mode", selected, &options, 120.0);
+                crate::widgets::dropdown(ui, "blend-mode", tl!("Blend Mode"), selected, &options, 120.0);
             },
             0,
         );
diff --git a/crates/ui-egui/src/work_area.rs b/crates/ui-egui/src/work_area.rs
index df4bc7a77e..a597784d8d 100644
--- a/crates/ui-egui/src/work_area.rs
+++ b/crates/ui-egui/src/work_area.rs
@@ -102,7 +102,7 @@ pub fn fits(outer: Vec2, monitor: Vec2) -> bool {
 }
 
 fn fitted_id() -> egui::Id {
-    egui::Id::new("pc-window-fitted")
+    egui::Id::unique("pc-window-fitted")
 }
 
 /// Once, as soon as the monitor is known: maximize a window that is bigger than its monitor
diff --git a/crates/ui-egui/src/workspace_ui.rs b/crates/ui-egui/src/workspace_ui.rs
index 4fb9140021..b5a67b1800 100644
--- a/crates/ui-egui/src/workspace_ui.rs
+++ b/crates/ui-egui/src/workspace_ui.rs
@@ -160,6 +160,9 @@ pub fn menu(app: &mut PhotocraftApp, id: &str, params: &Value) -> Option<Result<
         "window.workspace.lockWorkspace" => {
             let on = params.get("on").and_then(Value::as_bool).unwrap_or(!app.session.prefs().workspace_locked);
             app.session.prefs.edit(|p| p.workspace_locked = on);
+            if let Some(workspace) = app.ui.docking.as_mut() {
+                workspace.locked = on;
+            }
             Ok(json!({"locked": on}))
         }
         "window.workspace.newWorkspace" if no_params(params) => {
@@ -210,7 +213,8 @@ fn new_workspace(app: &mut PhotocraftApp, p: &Value) -> Result<Value, String> {
         return Err(format!("\"{name}\" is a built-in workspace"));
     }
     let prefs = app.session.prefs().clone();
-    let mut ws = json!({"panels": app.ui.panels, "dockTabs": app.ui.dock_tabs, "dock": app.ui.dock, "timelineOpen": app.ui.timeline.open, "docking": app.ui.docking, "dockingHidden": app.ui.docking_hidden, "dockingCollapsed": app.ui.docking_collapsed});
+    let mut ws = json!({"panels": app.ui.panels, "dockTabs": app.ui.dock_tabs, "dock": app.ui.dock, "timelineOpen": app.ui.timeline.open, "docking": app.ui.docking, "dockingReturns": app.ui.docking_returns, "dockingCollapsed": app.ui.docking_collapsed});
+    crate::dock::keep_newer(app, &mut ws);
     // The icon rail and menu bar flags belong to an embedding app's session, not to a saved
     // layout: a workspace never brings back a window without its menus.
     if let Some(panels) = ws.get_mut("panels").and_then(Value::as_object_mut) {
@@ -404,7 +408,7 @@ fn dialog(app: &mut PhotocraftApp, ctx: &egui::Context) {
     let title = title(&kind);
     let names: Vec<String> = app.session.prefs().workspaces.keys().cloned().collect();
     let mut result: Option<bool> = None;
-    egui::Window::new(title).id(egui::Id::new("shell-dialog")).collapsible(false).resizable(false).anchor(Align2::CENTER_CENTER, vec2(0.0, 0.0)).show(
+    egui::Window::new(title).id(egui::Id::unique("shell-dialog")).collapsible(false).resizable(false).anchor(Align2::CENTER_CENTER, vec2(0.0, 0.0)).show(
         ctx,
         |ui| {
             ui.label(RichText::new(tl!(&title)).color(t.text).size(13.0).strong());
@@ -414,7 +418,7 @@ fn dialog(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 ui.horizontal(|ui| {
                     ui.label(RichText::new(tl!(&label)).color(t.text_dim).size(11.0));
                     let mut v = f.get(key).and_then(Value::as_str).unwrap_or("").to_string();
-                    if ui.add(egui::TextEdit::singleline(&mut v).desired_width(180.0)).changed() {
+                    if ui.add(egui::TextEdit::singleline(&mut v).desired_width(180.0)).accessible_name(tl!(label)).changed() {
                         f.insert(key.into(), json!(v));
                     }
                 });
@@ -429,7 +433,9 @@ fn dialog(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 ui.horizontal(|ui| {
                     ui.label(RichText::new(tl!(&label)).color(t.text_dim).size(11.0));
                     let mut v = f.get(key).and_then(Value::as_f64).unwrap_or(0.0) as f32;
-                    if crate::widgets::slider(ui, &mut v, range.clone(), None).changed() | crate::widgets::value_field(ui, &mut v, range, "", 60.0).changed() {
+                    if crate::widgets::slider(ui, &mut v, range.clone(), None).changed()
+                        | crate::widgets::value_field(ui, &mut v, range, "", 60.0).accessible_name(tl!(&label)).changed()
+                    {
                         f.insert(key.into(), json!(v));
                     }
                 });
@@ -450,7 +456,7 @@ fn dialog(app: &mut PhotocraftApp, ctx: &egui::Context) {
                 "deleteWorkspace" => {
                     let mut cur = f.get("name").and_then(Value::as_str).unwrap_or("").to_string();
                     let opts: Vec<(String, &str)> = names.iter().map(|n| (n.clone(), n.as_str())).collect();
-                    if !opts.is_empty() && crate::widgets::dropdown(ui, "ws-delete", &mut cur, &opts, 180.0) {
+                    if !opts.is_empty() && crate::widgets::dropdown(ui, "ws-delete", tl!("Workspace"), &mut cur, &opts, 180.0) {
                         f.insert("name".into(), json!(cur));
                     }
                 }
@@ -466,6 +472,7 @@ fn dialog(app: &mut PhotocraftApp, ctx: &egui::Context) {
                     if crate::widgets::dropdown(
                         ui,
                         "p32-method",
+                        tl!("Mode"),
                         &mut m,
                         &[("exposureGamma".to_string(), tl!("Exposure and Gamma")), ("highlightCompression".to_string(), tl!("Highlight Compression"))],
                         180.0,
@@ -590,10 +597,12 @@ mod tests {
                 crate::menus::invoke(h.state_mut(), &ctx, "window.workspace.select", json!({"name": "Embedded"})).unwrap();
                 h.run_steps(4);
                 assert_eq!(h.state().ui.theme, theme, "the fixture renders the requested theme");
-                for name in ["title_bar", "rail"] {
-                    if egui::containers::panel::PanelState::load(&h.ctx, egui::Id::new(name)).is_some() {
-                        failures.push(format!("{theme:?}, width={width}: {name} is drawn"));
-                    }
+                if egui::containers::panel::PanelState::load(&h.ctx, crate::panels::panel_state_id(&h.ctx, "title_bar")).is_some() {
+                    failures.push(format!("{theme:?}, width={width}: title_bar is drawn"));
+                }
+                // The rail is drawn inside the canvas panel: find it by a button only it has.
+                if egui_kittest::kittest::Queryable::query_by_label(&h, "Color & Swatches").is_some() {
+                    failures.push(format!("{theme:?}, width={width}: rail is drawn"));
                 }
                 if h.state().ui.panels.menu_bar || h.state().ui.panels.rail {
                     failures.push(format!("{theme:?}, width={width}: host flags were overwritten"));
@@ -772,13 +781,15 @@ mod tests {
                 crate::menus::invoke(h.state_mut(), &ctx, "view.thirtyTwoBitPreviewOptions", json!({})).unwrap();
                 h.run_steps(4);
                 let screen = egui::Rect::from_min_size(egui::Pos2::ZERO, size);
-                let first = h.ctx.memory(|m| m.area_rect(egui::Id::new("shell-dialog"))).unwrap();
+                let first = h.ctx.memory(|m| m.area_rect(egui::Id::unique("shell-dialog"))).unwrap();
                 h.run_steps(20);
-                let last = h.ctx.memory(|m| m.area_rect(egui::Id::new("shell-dialog"))).unwrap();
+                let last = h.ctx.memory(|m| m.area_rect(egui::Id::unique("shell-dialog"))).unwrap();
                 assert!(screen.contains_rect(last), "{theme:?} at {size:?}: dialog {last:?} must fit");
                 assert!((last.width() - first.width()).abs() < 1.0, "{theme:?}: width grew from {first:?} to {last:?}");
                 for label in ["Exposure:", "Gamma:", "OK", "Cancel"] {
-                    let rect = h.get_by_label(label).rect();
+                    // A slider row names its number and its slider with the caption; either is visible.
+                    let node = h.query_all_by_label(label).next().unwrap_or_else(|| panic!("{label} in the dialog"));
+                    let rect = node.rect();
                     assert!(last.contains_rect(rect) && screen.contains_rect(rect), "{label} must remain visible: {rect:?}");
                 }
             }
diff --git a/crates/ui-egui/src/zoom_hold.rs b/crates/ui-egui/src/zoom_hold.rs
index ec0d5f9376..8da4535e01 100644
--- a/crates/ui-egui/src/zoom_hold.rs
+++ b/crates/ui-egui/src/zoom_hold.rs
@@ -40,7 +40,7 @@ struct Hold {
 /// Where a canvas keeps its hold: each canvas (document `idx` of the tiled windows, in the main
 /// or a secondary window) has its own, so a hold on one never zooms another.
 pub fn hold_id(idx: usize, primary: bool, viewport: egui::ViewportId) -> egui::Id {
-    egui::Id::new(("pc-zoom-tool-hold", idx, primary, viewport))
+    egui::Id::unique(("pc-zoom-tool-hold", idx, primary, viewport))
 }
 
 /// The zoom after holding for `dt` seconds at `zoom` (out: shrinking), within the range for a
diff --git a/crates/ui-egui/src/zoom_tool.rs b/crates/ui-egui/src/zoom_tool.rs
index 63440006e1..0a96c76420 100644
--- a/crates/ui-egui/src/zoom_tool.rs
+++ b/crates/ui-egui/src/zoom_tool.rs
@@ -28,7 +28,7 @@ struct ZoomDrag {
 }
 
 fn id() -> egui::Id {
-    egui::Id::new("pc-zoom-tool-drag")
+    egui::Id::unique("pc-zoom-tool-drag")
 }
 
 /// The scrubby zoom for a horizontal drag of `dx` points from a press at zoom `zoom0`, on a
@@ -419,6 +419,7 @@ mod tests {
                     unit: egui::MouseWheelUnit::Line,
                     delta: vec2(0.0, 1.0),
                     phase: egui::TouchPhase::Move,
+                    source: egui::MouseWheelSource::Unknown,
                     modifiers: egui::Modifiers { alt: gesture == 1, ..Default::default() },
                 }),
                 _ => {
diff --git a/crates/ui-egui/src/zoom_window_fit.rs b/crates/ui-egui/src/zoom_window_fit.rs
index a44692c14f..9667c95949 100644
--- a/crates/ui-egui/src/zoom_window_fit.rs
+++ b/crates/ui-egui/src/zoom_window_fit.rs
@@ -99,7 +99,7 @@ pub fn wrapped_center(view: &View, layout: &Layout) -> Option<[f32; 2]> {
 
 /// Where the zoom a window was last wrapped for (or first seen at) is kept between frames.
 fn last_zoom_id(window: u64) -> Id {
-    Id::new(("pc-zoom-resizes-windows", window))
+    Id::unique(("pc-zoom-resizes-windows", window))
 }
 
 /// The inner size floating window `window` should take this frame, if any: when `on` (the
diff --git a/crates/ui-egui/tests/fixtures/main-docking-workspace.json b/crates/ui-egui/tests/fixtures/main-docking-workspace.json
new file mode 100644
index 0000000000..4c1dd15845
--- /dev/null
+++ b/crates/ui-egui/tests/fixtures/main-docking-workspace.json
@@ -0,0 +1,61 @@
+{
+  "workspace": "Essentials",
+  "panels": {
+    "layers": true,
+    "history": true,
+    "properties": true,
+    "color": true,
+    "navigator": false,
+    "toolbar": true,
+    "options_bar": true,
+    "status_bar": true,
+    "brush_settings": false,
+    "brushes": false,
+    "character": false,
+    "toolbar_double": false,
+    "dock": true,
+    "rail": true,
+    "menu_bar": true
+  },
+  "dockTabs": {"properties": 0, "color": 0, "layers": 0, "navigator": 0, "history": 1, "character": 0, "brushes": 0},
+  "dock": {
+    "order": [],
+    "heights": {},
+    "collapsed": [],
+    "hidden_tabs": {"history": ["Layer Comps"], "layers": ["Paths"]},
+    "tabOrder": {}
+  },
+  "timelineOpen": false,
+  "docking": {
+    "root": {"Split": {
+      "axis": "Vertical",
+      "size": {"FixedFirst": 180.0},
+      "first": {"Tabs": {"panels": ["swatches"], "active": 0}},
+      "second": {"Split": {
+        "axis": "Vertical",
+        "size": {"FixedFirst": 260.0},
+        "first": {"Tabs": {"panels": ["color", "gradients", "patterns"], "active": 0}},
+        "second": {"Split": {
+          "axis": "Vertical",
+          "size": {"Ratio": 0.4},
+          "first": {"Tabs": {"panels": ["history", "actions"], "active": 1}},
+          "second": {"Tabs": {"panels": ["layers", "channels"], "active": 0}}
+        }}
+      }}
+    }},
+    "floating": [{"panels": ["properties", "adjustments"], "active": 0, "rect": [420.0, 150.0, 320.0, 440.0]}]
+  },
+  "dockingHidden": {
+    "layerComps": {"floating": null, "anchor": "actions", "placement": {"Tab": {"before": null}}, "size": null, "stack": null, "sibling": []},
+    "paths": {"floating": null, "anchor": "channels", "placement": {"Tab": {"before": null}}, "size": null, "stack": null, "sibling": []},
+    "properties": {
+      "floating": null,
+      "anchor": "layers",
+      "placement": {"Split": "Top"},
+      "size": {"FixedFirst": 300.0},
+      "stack": null,
+      "sibling": ["layers", "channels"]
+    }
+  },
+  "dockingCollapsed": ["history", "actions"]
+}
diff --git a/crates/ui-egui/tests/it/arbitrary_rotation_preview.rs b/crates/ui-egui/tests/it/arbitrary_rotation_preview.rs
index 388c941f16..13bff55cf3 100644
--- a/crates/ui-egui/tests/it/arbitrary_rotation_preview.rs
+++ b/crates/ui-egui/tests/it/arbitrary_rotation_preview.rs
@@ -67,7 +67,7 @@ fn blue(h: &mut Harness, name: &str) -> (usize, u32, u32) {
     h.run_steps(3);
     let rect = h.state().last_canvas_rect.shrink(3.0);
     let modals: Vec<_> =
-        h.state().ui.dialogs.iter().map(|d| h.ctx.memory(|m| m.area_rect(egui::Id::new(("dialog", d.id)))).expect("laid-out dialog").expand(4.0)).collect();
+        h.state().ui.dialogs.iter().map(|d| h.ctx.memory(|m| m.area_rect(egui::Id::unique(("dialog", d.id)))).expect("laid-out dialog").expand(4.0)).collect();
     let img = h.render().expect("render");
     if let Some(dir) = std::env::var_os("PHOTOCRAFT_ROTATION_EVIDENCE_DIR") {
         std::fs::create_dir_all(&dir).expect("evidence directory");
diff --git a/crates/ui-egui/tests/it/batch_export_options.rs b/crates/ui-egui/tests/it/batch_export_options.rs
index 5bf87909bf..980331a91f 100644
--- a/crates/ui-egui/tests/it/batch_export_options.rs
+++ b/crates/ui-egui/tests/it/batch_export_options.rs
@@ -42,16 +42,9 @@ fn evidence(h: &mut Harness, name: &str) {
 }
 
 fn open_format_choices(h: &mut Harness) {
-    let label = h.get_by_label("Format").rect();
-    // The full app also draws the workspace and layer-blend dropdowns behind this modal.
-    // Target the actual form field beside Format, like the existing numeric-field harnesses.
-    h.query_all_by_role(egui::accesskit::Role::ComboBox)
-        .find(|n| {
-            let r = n.rect();
-            r.left() >= label.right() && (r.center().y - label.center().y).abs() < 3.0
-        })
-        .expect("format dropdown beside its label")
-        .click();
+    // The caption is a separate Label node with the same text; the accessible ComboBox name
+    // identifies the actual form field without guessing from coordinates.
+    h.get_by_role_and_label(egui::accesskit::Role::ComboBox, "Format").click();
     h.run_steps(3);
 }
 
@@ -69,32 +62,20 @@ fn replace_text(h: &mut Harness, value: &str) {
 }
 
 fn edit_path(h: &mut Harness, name: &str, value: &Path) {
-    let label = h.get_by_label(name).rect();
-    h.query_all_by_role(egui::accesskit::Role::TextInput)
-        .find(|n| {
-            let r = n.rect();
-            r.left() >= label.right() && (r.center().y - label.center().y).abs() < 3.0
-        })
-        .expect("path text field beside its label")
-        .click();
+    h.get_by_role_and_label(egui::accesskit::Role::TextInput, name).click();
     h.run_steps(2);
     replace_text(h, &value.to_string_lossy());
-    h.get_by_label(name).click();
+    // Clicking the caption commits the field without Enter confirming the dialog.
+    h.get_by_role_and_label(egui::accesskit::Role::Label, name).click();
     h.run_steps(2);
 }
 
 fn edit_quality(h: &mut Harness, value: &str) {
-    let label = h.get_by_label("Quality").rect();
-    h.query_all_by_role(egui::accesskit::Role::SpinButton)
-        .find(|n| {
-            let r = n.rect();
-            r.left() >= label.right() && (r.center().y - label.center().y).abs() < 3.0
-        })
-        .expect("quality numeric field beside its label")
-        .click();
+    h.get_by_role_and_label(egui::accesskit::Role::SpinButton, "Quality").click();
     h.run_steps(2);
     replace_text(h, value);
-    h.get_by_label("Quality").click();
+    // Clicking the caption commits the field without Enter confirming the dialog.
+    h.get_by_role_and_label(egui::accesskit::Role::Label, "Quality").click();
     h.run_steps(3);
 }
 
@@ -114,7 +95,7 @@ fn batch_menu_offers_quality() {
     let mut h = harness();
     open(&mut h, "file.automate.batch");
     evidence(&mut h, "batch-quality");
-    assert!(h.query_by_label("Quality").is_some(), "Batch must expose its supported output quality");
+    assert!(h.query_by_role_and_label(egui::accesskit::Role::SpinButton, "Quality").is_some(), "Batch must expose its supported output quality");
 }
 
 #[test]
@@ -310,18 +291,11 @@ fn batch_naming_controls_export_the_requested_names_and_reset_on_cancel() {
     h.get_by_role_and_label(egui::accesskit::Role::TextInput, "File Naming").click();
     h.run_steps(2);
     replace_text(&mut h, "{serial}_{name}");
-    let label = h.get_by_label("Starting serial").rect();
-    h.query_all_by_role(egui::accesskit::Role::SpinButton)
-        .find(|n| {
-            let r = n.rect();
-            r.left() >= label.right() && r.left() < label.right() + 100.0 && (r.center().y - label.center().y).abs() < 3.0
-        })
-        .expect("starting serial number control")
-        .click();
+    h.get_by_role_and_label(egui::accesskit::Role::SpinButton, "Starting serial").click();
     h.run_steps(2);
     h.event(egui::Event::Text("7".into()));
     h.run_steps(3);
-    h.get_by_label("Starting serial").click();
+    h.get_by_role_and_label(egui::accesskit::Role::Label, "Starting serial").click();
     h.run_steps(3);
     assert_eq!(h.state().ui.dialogs.last().unwrap().fields["startingSerial"], 7, "typing changes the starting serial");
     evidence(&mut h, "batch-naming");
diff --git a/crates/ui-egui/tests/it/camera_raw_histogram.rs b/crates/ui-egui/tests/it/camera_raw_histogram.rs
index 7b1c9502d0..5cd27c9c16 100644
--- a/crates/ui-egui/tests/it/camera_raw_histogram.rs
+++ b/crates/ui-egui/tests/it/camera_raw_histogram.rs
@@ -33,7 +33,13 @@ fn header_stays_fixed_and_resize_hover_scroll_before_do_not_rebuild_the_proxy()
         let label = photocraft_ui_egui::i18n::tr(photocraft_ui_egui::i18n::current(), "Tone Histogram");
         let header = h.query_by_label(label).expect("histogram graph").rect();
         h.event(Event::PointerMoved(pos2(1050.0, 400.0)));
-        h.event(Event::MouseWheel { unit: MouseWheelUnit::Point, phase: egui::TouchPhase::Move, delta: vec2(0.0, -320.0), modifiers: Modifiers::NONE });
+        h.event(Event::MouseWheel {
+            source: egui::MouseWheelSource::Unknown,
+            unit: MouseWheelUnit::Point,
+            phase: egui::TouchPhase::Move,
+            delta: vec2(0.0, -320.0),
+            modifiers: Modifiers::NONE,
+        });
         h.run_steps(3);
         assert_eq!(h.query_by_label(label).expect("histogram graph").rect(), header, "{theme:?}: histogram scrolled");
         h.set_size(vec2(960.0, 600.0));
@@ -99,33 +105,36 @@ fn settings_sections_group_existing_controls_without_rendering_or_document_edits
         let tr = |s| photocraft_ui_egui::i18n::tr_ctx(lang, "cameraRaw", s);
         let mut y = 0.0;
         for label in [light, tr("Color"), tr("Effects"), tr("Curve"), tr("Color Mixer"), tr("Color Grading"), tr("Detail")] {
-            let next = h.get_by_role_and_label(Role::Button, label).rect().top();
+            // egui 0.37 exposes a CollapsingHeader as a DisclosureTriangle, not a Button.
+            let next = h.get_by_role_and_label(Role::DisclosureTriangle, label).rect().top();
             assert!(next > y, "section order: {label}");
             y = next;
         }
         assert!(h.query_by_label(tr("Basic")).is_none());
         assert!(h.query_by_label(tr("Temperature")).is_none());
         assert!(h.query_by_label(tr("Texture")).is_none());
-        assert!(h.query_by_label(tr("Exposure")).is_some());
-        h.get_by_role_and_label(Role::Button, light).click();
+        assert!(h.query_by_role_and_label(Role::Slider, tr("Exposure")).is_some());
+        h.get_by_role_and_label(Role::DisclosureTriangle, light).click();
         h.run_steps(12);
-        h.get_by_role_and_label(Role::Button, tr("Color")).click();
+        h.get_by_role_and_label(Role::DisclosureTriangle, tr("Color")).click();
         h.run_steps(12);
         // The dock also has Saturation; query only the Camera Raw settings panel.
-        let settings = std::iter::successors(Some(h.get_by_role_and_label(Role::Button, tr("Color"))), |node| node.parent())
+        let settings = std::iter::successors(Some(h.get_by_role_and_label(Role::DisclosureTriangle, tr("Color"))), |node| node.parent())
             .find(|node| node.query_by_label(tr("Tone Histogram")).is_some())
             .expect("Camera Raw settings panel");
         for label in ["Temperature", "Tint", "Vibrance", "Saturation"] {
-            assert!(settings.query_by_label(tr(label)).is_some(), "color control: {label}");
+            assert!(settings.query_by_role_and_label(Role::Slider, tr(label)).is_some(), "color control: {label}");
         }
         assert!(h.query_by_label(tr("Exposure")).is_none());
-        h.get_by_role_and_label(Role::Button, tr("Color")).click();
+        h.get_by_role_and_label(Role::DisclosureTriangle, tr("Color")).click();
         h.run_steps(12);
-        h.get_by_role_and_label(Role::Button, tr("Effects")).click();
+        h.get_by_role_and_label(Role::DisclosureTriangle, tr("Effects")).click();
         h.run_steps(12);
-        for label in ["Texture", "Clarity", "Dehaze", "Vignetting", "Grain"] {
-            assert!(h.query_by_label(tr(label)).is_some(), "effects control: {label}");
+        for label in ["Texture", "Clarity", "Dehaze"] {
+            assert!(h.query_by_role_and_label(Role::Slider, tr(label)).is_some(), "effects control: {label}");
         }
+        assert!(h.query_by_role_and_label(Role::ComboBox, tr("Vignetting")).is_some(), "effects control: Vignetting");
+        assert!(h.query_by_role_and_label(Role::Label, tr("Grain")).is_some(), "effects control: Grain");
         let after = control::inspect(h.state(), &h.ctx);
         assert_eq!(after["cameraRaw"]["params"], before["params"]);
         assert_eq!(after["cameraRaw"]["previewRevision"], before["previewRevision"]);
diff --git a/crates/ui-egui/tests/it/camera_raw_localization.rs b/crates/ui-egui/tests/it/camera_raw_localization.rs
index 83727dd00f..ef42396364 100644
--- a/crates/ui-egui/tests/it/camera_raw_localization.rs
+++ b/crates/ui-egui/tests/it/camera_raw_localization.rs
@@ -5,7 +5,15 @@ use photocraft_ui_egui::{PhotocraftApp, camera_raw_ui, control, i18n, theme::The
 use serde_json::json;
 
 #[test]
-fn all_seven_languages_render_camera_raw_and_switch_without_resetting_view_or_filter() {
+fn all_registered_languages_render_camera_raw_and_switch_without_resetting_view_or_filter() {
+    // Required central-font acceptance must not pass only because the host supplies Hindi.
+    if std::env::var_os("CRAFT_FONTS_REQUIRED").is_some() {
+        let faces: Vec<_> = photocraft_text::craft_fonts::CRAFT_FONTS.iter().filter(|f| f.family == "Noto Sans Devanagari").collect();
+        assert_eq!(faces.len(), 1, "the central default manifest supplies one Devanagari face");
+        assert_eq!(faces[0].style, "Regular");
+        assert_eq!(faces[0].scripts, ["Deva"]);
+        assert!(!faces[0].bytes.is_empty());
+    }
     let _gpu = photocraft_testkit::gpu_lock();
     for lang in i18n::Lang::all() {
         let gpu = std::env::var_os("PHOTOCRAFT_LOCALE_SNAPSHOTS").is_some();
@@ -28,27 +36,29 @@ fn all_seven_languages_render_camera_raw_and_switch_without_resetting_view_or_fi
         let tr = |s| i18n::tr_ctx(lang, "cameraRaw", s);
         let before = control::inspect(h.state(), &ctx)["cameraRaw"].clone();
         for section in ["Light", "Color", "Effects", "Curve", "Color Mixer", "Color Grading", "Detail"] {
-            assert!(h.query_by_role_and_label(Role::Button, tr(section)).is_some(), "{}: {section}", lang.code());
+            // egui 0.37 exposes a CollapsingHeader as a DisclosureTriangle, not a Button.
+            assert!(h.query_by_role_and_label(Role::DisclosureTriangle, tr(section)).is_some(), "{}: {section}", lang.code());
         }
-        assert!(h.query_by_label(tr("Blacks")).is_some());
-        h.get_by_role_and_label(Role::Button, tr("Light")).click();
+        assert!(h.query_by_role_and_label(Role::Slider, tr("Blacks")).is_some());
+        h.get_by_role_and_label(Role::DisclosureTriangle, tr("Light")).click();
         h.run_steps(12);
-        h.get_by_role_and_label(Role::Button, tr("Color")).click();
+        h.get_by_role_and_label(Role::DisclosureTriangle, tr("Color")).click();
         h.run_steps(12);
-        for label in ["White Balance: As Shot", "Temperature", "Tint", "Vibrance", "Saturation"] {
-            assert!(h.query_by_label(tr(label)).is_some(), "{}: {label}", lang.code());
+        assert!(h.query_by_role_and_label(Role::Label, tr("White Balance: As Shot")).is_some(), "{}: White Balance", lang.code());
+        for label in ["Temperature", "Tint", "Vibrance", "Saturation"] {
+            assert!(h.query_by_role_and_label(Role::Slider, tr(label)).is_some(), "{}: {label}", lang.code());
         }
-        h.get_by_role_and_label(Role::Button, tr("Color")).click();
+        h.get_by_role_and_label(Role::DisclosureTriangle, tr("Color")).click();
         h.run_steps(12);
-        h.get_by_role_and_label(Role::Button, tr("Color Mixer")).click();
+        h.get_by_role_and_label(Role::DisclosureTriangle, tr("Color Mixer")).click();
         h.run_steps(12);
         for tab in ["Hue", "Saturation", "Luminance"] {
-            assert!(h.get_by_label(tr(tab)).rect().right() <= 1426.0, "{}: mixer tabs overflow the panel", lang.code());
+            assert!(h.get_by_role_and_label(Role::Button, tr(tab)).rect().right() <= 1426.0, "{}: mixer tabs overflow the panel", lang.code());
         }
         for band in ["Red", "Orange", "Yellow", "Green", "Aqua", "Blue", "Purple", "Magenta"] {
-            assert!(h.query_by_label(tr(band)).is_some(), "{}: {band}", lang.code());
+            assert!(h.query_by_role_and_label(Role::Slider, tr(band)).is_some(), "{}: {band}", lang.code());
         }
-        h.get_by_role_and_label(Role::Button, tr("Color Mixer")).click();
+        h.get_by_role_and_label(Role::DisclosureTriangle, tr("Color Mixer")).click();
         h.run_steps(12);
         for (section, labels) in [
             ("Effects", vec!["Texture", "Clarity", "Dehaze", "Vignetting", "Grain", "Roughness"]),
@@ -56,16 +66,16 @@ fn all_seven_languages_render_camera_raw_and_switch_without_resetting_view_or_fi
             ("Color Grading", vec!["Midtones", "Global", "Hue", "Saturation", "Luminance", "Blending", "Balance"]),
             ("Detail", vec!["Sharpening", "Masking", "Noise Reduction", "Luminance Detail", "Color Detail"]),
         ] {
-            h.get_by_role_and_label(Role::Button, tr(section)).click();
+            h.get_by_role_and_label(Role::DisclosureTriangle, tr(section)).click();
             h.run_steps(12);
             for label in labels {
                 assert!(h.query_all_by_label(tr(label)).next().is_some(), "{}: {section}/{label}", lang.code());
             }
-            // Detail is also the sharpening slider label; target the section button.
-            h.get_by_role_and_label(Role::Button, tr(section)).click();
+            // Detail is also the sharpening slider label; target the section disclosure.
+            h.get_by_role_and_label(Role::DisclosureTriangle, tr(section)).click();
             h.run_steps(12);
         }
-        h.get_by_role_and_label(Role::Button, tr("Color Mixer")).click();
+        h.get_by_role_and_label(Role::DisclosureTriangle, tr("Color Mixer")).click();
         h.run_steps(12);
         let graph = h.get_by_label(tr("Tone Histogram")).rect();
         h.event(egui::Event::PointerMoved(graph.center()));
@@ -98,7 +108,7 @@ fn all_seven_languages_render_camera_raw_and_switch_without_resetting_view_or_fi
         // Changing labels must keep the same collapse IDs and open mixer, without an image edit.
         h.state_mut().session.prefs.edit(|p| p.interface.language = "en".into());
         h.run_steps(3);
-        assert!(h.query_by_label("Aqua").is_some(), "{} → en: preserve the open section", lang.code());
+        assert!(h.query_by_role_and_label(Role::Slider, "Aqua").is_some(), "{} → en: preserve the open section", lang.code());
         assert!(h.query_by_label("Exposure").is_none(), "{} → en: Light stays collapsed", lang.code());
         let after = control::inspect(h.state(), &ctx)["cameraRaw"].clone();
         assert_eq!(after["params"], before["params"]);
diff --git a/crates/ui-egui/tests/it/camera_raw_scope.rs b/crates/ui-egui/tests/it/camera_raw_scope.rs
index 418d59c6ec..ba6ee7d705 100644
--- a/crates/ui-egui/tests/it/camera_raw_scope.rs
+++ b/crates/ui-egui/tests/it/camera_raw_scope.rs
@@ -739,11 +739,12 @@ fn sampler_list_replacement_and_operations_cannot_silently_cancel_each_other() {
     assert_eq!(r["scope"]["samplers"], json!([[0.5, 0.5]]));
 }
 
-/// Alt-drags the slider under the only visible `label` and returns the inspected dialog.
+/// Alt-drags the only visible slider named `label` and returns the inspected dialog.
 fn alt_drag_slider(h: &mut Harness<'_, PhotocraftApp>, label: &str) -> Value {
-    // The label sits above its 18 pt slider track.
-    let text = h.get_by_label(label).rect();
-    let at = pos2(text.left() + 80.0, text.bottom() + 12.0);
+    // The row also exposes a numeric SpinButton and a caption with the same name; the slider
+    // itself is the 18 pt track underneath them.
+    let track = h.get_by_role_and_label(egui::accesskit::Role::Slider, label).rect();
+    let at = pos2(track.left() + 80.0, track.center().y);
     let alt = Modifiers { alt: true, ..Modifiers::NONE };
     press(h, at, true, alt);
     for n in 1..=3 {
diff --git a/crates/ui-egui/tests/it/camera_raw_zoom.rs b/crates/ui-egui/tests/it/camera_raw_zoom.rs
index bfe97d05db..89576c5816 100644
--- a/crates/ui-egui/tests/it/camera_raw_zoom.rs
+++ b/crates/ui-egui/tests/it/camera_raw_zoom.rs
@@ -93,7 +93,13 @@ fn scrub_zoom_and_alt_wheel_preserve_the_detail_under_the_initial_pointer() {
     let old = zoom(&h);
     h.event(Event::PointerMoved(at));
     h.event(Event::ModifiersChanged(Modifiers::ALT));
-    h.event(Event::MouseWheel { unit: egui::MouseWheelUnit::Point, delta: vec2(0.0, 100.0), phase: egui::TouchPhase::Move, modifiers: Modifiers::ALT });
+    h.event(Event::MouseWheel {
+        source: egui::MouseWheelSource::Unknown,
+        unit: egui::MouseWheelUnit::Point,
+        delta: vec2(0.0, 100.0),
+        phase: egui::TouchPhase::Move,
+        modifiers: Modifiers::ALT,
+    });
     // Release Alt while the wheel notch is still being smoothed: no residual pan.
     h.event(Event::ModifiersChanged(Modifiers::NONE));
     h.run_steps(10);
diff --git a/crates/ui-egui/tests/it/checker_canvas.rs b/crates/ui-egui/tests/it/checker_canvas.rs
index 3c5e061afd..513d277abf 100644
--- a/crates/ui-egui/tests/it/checker_canvas.rs
+++ b/crates/ui-egui/tests/it/checker_canvas.rs
@@ -20,8 +20,12 @@ fn harness() -> Option<Harness> {
 
 /// The app with the GPU canvas (`gpu`), or without it: the CPU fallback path.
 fn harness_with(gpu: bool) -> Option<Harness> {
+    harness_with_scale(gpu, 1.0)
+}
+
+fn harness_with_scale(gpu: bool, ppp: f32) -> Option<Harness> {
     let built = std::panic::catch_unwind(|| {
-        egui_kittest::Harness::builder().with_size(egui::vec2(1400.0, 800.0)).with_pixels_per_point(1.0).with_max_steps(64).wgpu().build_eframe(|cc| {
+        egui_kittest::Harness::builder().with_size(egui::vec2(1400.0, 800.0)).with_pixels_per_point(ppp).with_max_steps(64).wgpu().build_eframe(|cc| {
             PhotocraftApp::setup_context(&cc.egui_ctx, Default::default());
             let mut app = PhotocraftApp::new(photocraft_engine::Session::new(), Default::default());
             if let Some(rs) = cc.wgpu_render_state.as_ref().filter(|_| gpu) {
@@ -111,13 +115,15 @@ fn render_on(h: &mut Harness, gpu: bool, zoom: f32, doc: u32, black: bool, grid:
     let rendered = h.render().expect("render");
     let (width, height) = (rendered.width(), rendered.height());
     let img = Shot { w: width, px: rendered.into_raw() };
+    if black {
+        // View geometry also works on scaled displays, independently of grid colour.
+        let origin = photocraft_ui_egui::canvas::ViewXform::active(h.state()).expect("view").to_screen(0.0, 0.0) * h.ctx.pixels_per_point();
+        return (img, origin.x.round() as u32, origin.y.round() as u32, (doc as f32 * zoom).round() as u32);
+    }
     let r = h.state().last_canvas_rect;
     let (cx, cy) = (r.center().x as u32, r.center().y as u32);
-    // Black fill is 0 (64 on a grid line), the pasteboard is 39.
-    // (Two CPU grid lines crossing blend twice: about 112.)
-    let on_doc = |p: [u8; 4]| if black { p[0] < 12 || (58..=70).contains(&p[0]) || (105..=120).contains(&p[0]) } else { is_checker_grey(p) };
-    let (x0, w) = longest_run((0..width).map(|x| on_doc(img.at(x, cy))));
-    let (y0, hgt) = longest_run((0..height).map(|y| on_doc(img.at(cx, y))));
+    let (x0, w) = longest_run((0..width).map(|x| is_checker_grey(img.at(x, cy))));
+    let (y0, hgt) = longest_run((0..height).map(|y| is_checker_grey(img.at(cx, y))));
     let doc_px = (doc as f32 * zoom).round() as i64;
     assert!((w as i64 - doc_px).abs() <= 1 && (hgt as i64 - doc_px).abs() <= 1, "zoom {zoom}: found a {w}x{hgt} document, want {doc_px}");
     (img, x0 as u32, y0 as u32, w as u32)
@@ -210,18 +216,20 @@ fn pixel_grid_is_not_drawn_over_empty_checker() {
 #[test]
 fn cpu_pixel_grid_shows_above_500_percent_over_content() {
     let _gpu = photocraft_testkit::gpu_lock();
-    let Some(mut h) = harness_with(false) else { return };
-    h.run_steps(4);
-    let (flat, x0, y0, _) = render_on(&mut h, false, 5.0, 48, true, true);
-    assert!(lit_columns(&flat, x0, y0 + 20, 100).is_empty(), "no grid at 500%");
-    for zoom in [6.0f32, 8.0, 12.0] {
-        let (img, x0, y0, _) = render_on(&mut h, false, zoom, 48, true, true);
-        let y = y0 + (zoom * 3.5) as u32;
-        let lit = lit_columns(&img, x0, y, (zoom * 10.0) as u32);
-        assert_eq!(lit.len(), 10, "zoom {zoom}: grid columns {lit:?}");
-        assert!(lit.windows(2).all(|p| p[1] - p[0] == zoom as u32), "zoom {zoom}: spacing of {lit:?}");
-        let v = img.at(x0 + lit[2], y)[0];
-        assert!((60..=68).contains(&v), "zoom {zoom}: a grid line over black is {v}, want about 64");
+    for ppp in [1.0, 2.0] {
+        let Some(mut h) = harness_with_scale(false, ppp) else { return };
+        h.run_steps(4);
+        let (flat, x0, y0, _) = render_on(&mut h, false, 5.0, 48, true, true);
+        assert!(lit_columns(&flat, x0, y0 + 20, 100).is_empty(), "no grid at 500%");
+        for zoom in [6.0f32, 8.0, 12.0] {
+            let (img, x0, y0, _) = render_on(&mut h, false, zoom, 48, true, true);
+            let y = y0 + (zoom * 3.5) as u32;
+            let lit = lit_columns(&img, x0, y, (zoom * 10.0) as u32);
+            assert_eq!(lit.len(), 10, "scale {ppp}, zoom {zoom}: one physical pixel per line, columns {lit:?}");
+            assert!(lit.windows(2).all(|p| p[1] - p[0] == zoom as u32), "zoom {zoom}: spacing of {lit:?}");
+            let v = img.at(x0 + lit[2], y)[0];
+            assert!((60..=68).contains(&v), "zoom {zoom}: a grid line over black is {v}, want about 64");
+        }
     }
 }
 
@@ -295,3 +303,47 @@ fn pixel_grid_does_not_flip_colour_across_mid_tones() {
         assert!(c >= 20, "grey {grey:#04x}: grid line differs from its pixel by only {c} levels");
     }
 }
+
+#[test]
+fn pixel_grid_is_solid_and_visible_on_white_and_black_at_both_display_scales() {
+    let _gpu = photocraft_testkit::gpu_lock();
+    use photocraft_color::{ColorMode, PixelFormat, SampleType};
+    use photocraft_doc::{Document, Layer, LayerContent, Size};
+    use photocraft_geom::Rect;
+    use photocraft_raster::Surface;
+
+    for gpu in [true, false] {
+        for ppp in [1.0, 2.0] {
+            let Some(mut h) = harness_with_scale(gpu, ppp) else { return };
+            for depth in [SampleType::U8, SampleType::U16, SampleType::F32] {
+                for v in [0.0, 1.0] {
+                    let mut doc = Document::new("grid contrast", Size::new(32, 16), ColorMode::Rgb, depth);
+                    let mut surface = Surface::new(PixelFormat::new(ColorMode::Rgb, depth, true));
+                    surface.fill_rect(Rect::new(0, 0, 32, 16), &[v, v, v, 1.0]);
+                    doc.layers.push(Layer::new("opaque", LayerContent::Raster(surface)));
+                    let app = h.state_mut();
+                    app.session.add_document(doc, None);
+                    app.sync_views();
+                    app.ui.view.show.pixel_grid = true;
+                    for zoom in [7.119, 8.0, 22.825] {
+                        control(&mut h, "ui.set", json!({"zoom": zoom, "center": [16.0, 8.0]}));
+                        assert_eq!(h.state().perf.gpu, gpu);
+                        let img = h.render().expect("render opaque grid");
+                        let center = h.state().last_canvas_rect.center() * ppp;
+                        let x0 = center.x - 16.0 * zoom;
+                        let y = (center.y + 3.25 * zoom).floor() as u32;
+                        for x in 2..30 {
+                            let edge = (x0 + x as f32 * zoom).floor() as u32;
+                            for sy in y..y + 3 {
+                                let inside = img.get_pixel((x0 + (x as f32 + 0.5) * zoom).floor() as u32, sy)[0];
+                                assert_eq!(inside, (v * 255.0) as u8);
+                                let contrast = (edge - 1..=edge + 1).map(|sx| img.get_pixel(sx, sy)[0].abs_diff(inside)).max().expect("line");
+                                assert!(contrast >= 28, "{gpu:?}/{depth:?}, scale {ppp}, zoom {zoom}, fill {v}, ({x}, {sy}): invisible grid ({contrast})");
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/crates/ui-egui/tests/it/custom_print_paper.rs b/crates/ui-egui/tests/it/custom_print_paper.rs
index 4aa53eb96d..036393b95a 100644
--- a/crates/ui-egui/tests/it/custom_print_paper.rs
+++ b/crates/ui-egui/tests/it/custom_print_paper.rs
@@ -1,9 +1,6 @@
 //! #3820: edit custom paper through the real Print dialog, preview it, and print safely to PDF.
 use egui::{Event, Key, Modifiers, PointerButton, vec2};
-use egui_kittest::{
-    Harness,
-    kittest::{NodeT, Queryable},
-};
+use egui_kittest::{Harness, kittest::Queryable};
 use photocraft_ui_egui::{PhotocraftApp, file_ui::open_print};
 use serde_json::{Map, Value, json};
 
@@ -47,12 +44,13 @@ fn click(h: &mut Harness<'_, PhotocraftApp>, label: &str) {
 }
 
 fn shown(h: &Harness<'_, PhotocraftApp>, text: &str) -> bool {
-    h.query_by_label(text).is_some() || h.query_by_value(text).is_some()
+    // A form caption and its control both expose the same accessible name.
+    h.query_all_by_label(text).next().is_some() || h.query_all_by_value(text).next().is_some()
 }
 
 fn enter_length(h: &mut Harness<'_, PhotocraftApp>, label: &str, value: &str) {
-    // Use the editor's actual accessibility bounds rather than a fixed offset from its label.
-    let pos = h.get_by_label(label).parent().unwrap().get_by_role(egui::accesskit::Role::SpinButton).rect().center();
+    // The caption is a separate Label node with the same text; use the accessible SpinButton.
+    let pos = h.get_by_role_and_label(egui::accesskit::Role::SpinButton, label).rect().center();
     h.event(Event::PointerMoved(pos));
     h.event(Event::PointerButton { pos, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
     h.run_steps(1);
@@ -73,7 +71,7 @@ fn fields(h: &Harness<'_, PhotocraftApp>, id: u64) -> Map<String, Value> {
 /// so drag assertions detect visible lag in the same frame as a Center transition.
 fn painted_image(h: &Harness<'_, PhotocraftApp>) -> egui::Rect {
     let active = h.state().session.active().unwrap();
-    let key = egui::Id::new(("print-thumb", active.doc.id.0, active.revision));
+    let key = egui::Id::unique(("print-thumb", active.doc.id.0, active.revision));
     let tex = h.ctx.data(|d| d.get_temp::<std::sync::Arc<egui::TextureHandle>>(key)).unwrap();
     h.output()
         .shapes
@@ -210,8 +208,8 @@ fn remembered_custom_paper_is_shown_without_becoming_a_preset() {
     app.ui.dialog_mut(id).unwrap().fields.insert("paper".into(), json!([432.0, 576.0]));
     let h = harness(app);
     assert!(shown(&h, "Custom"), "an array paper size must not display as letter");
-    assert!(shown(&h, "Paper Width"));
-    assert!(shown(&h, "Paper Height"));
+    assert!(h.query_by_role_and_label(egui::accesskit::Role::SpinButton, "Paper Width").is_some());
+    assert!(h.query_by_role_and_label(egui::accesskit::Role::SpinButton, "Paper Height").is_some());
     assert_eq!(fields(&h, id)["paper"], json!([432.0, 576.0]));
 }
 
diff --git a/crates/ui-egui/tests/it/export_as_scaling.rs b/crates/ui-egui/tests/it/export_as_scaling.rs
index c984f11447..fb14ebee4f 100644
--- a/crates/ui-egui/tests/it/export_as_scaling.rs
+++ b/crates/ui-egui/tests/it/export_as_scaling.rs
@@ -90,15 +90,9 @@ fn export_as_scales_a_narrow_image_without_editing_the_source() {
         let ctx = h.ctx.clone();
         menus::invoke(h.state_mut(), &ctx, "file.export.exportAs", json!({})).expect("open Export As");
         h.run_steps(6);
-        let label = h.get_by_label("Scale").rect();
-        let field = h
-            .query_all_by_role(egui::accesskit::Role::SpinButton)
-            .find(|n| {
-                let r = n.rect();
-                r.left() >= label.right() && r.left() < label.right() + 100.0 && (r.center().y - label.center().y).abs() < 3.0
-            })
-            .expect("Scale numeric field");
-        field.click();
+        // The caption is a separate Label node with the same text; the accessible SpinButton
+        // name identifies the actual field.
+        h.get_by_role_and_label(egui::accesskit::Role::SpinButton, "Scale").click();
         h.run_steps(2);
         // Clicking a numeric field selects its current value; type through egui's text input.
         h.event(egui::Event::Text("50".into()));
@@ -163,26 +157,12 @@ fn export_as_resample_menu_writes_nearest_neighbor_blocks() {
     menus::invoke(h.state_mut(), &ctx, "file.export.exportAs", json!({})).expect("open Export As");
     h.run_steps(6);
 
-    let label = h.get_by_label("Resample").rect();
-    h.query_all_by_role(egui::accesskit::Role::ComboBox)
-        .find(|n| {
-            let r = n.rect();
-            r.left() >= label.right() && (r.center().y - label.center().y).abs() < 3.0
-        })
-        .expect("Resample dropdown beside its label")
-        .click();
+    h.get_by_role_and_label(egui::accesskit::Role::ComboBox, "Resample").click();
     h.run_steps(3);
     h.get_by_label("Nearest Neighbor").click();
     h.run_steps(3);
 
-    let label = h.get_by_label("Scale").rect();
-    h.query_all_by_role(egui::accesskit::Role::SpinButton)
-        .find(|n| {
-            let r = n.rect();
-            r.left() >= label.right() && r.left() < label.right() + 100.0 && (r.center().y - label.center().y).abs() < 3.0
-        })
-        .expect("Scale numeric field")
-        .click();
+    h.get_by_role_and_label(egui::accesskit::Role::SpinButton, "Scale").click();
     h.run_steps(2);
     h.event(egui::Event::Text("200".into()));
     h.run_steps(3);
diff --git a/crates/ui-egui/tests/it/workspace_presets.rs b/crates/ui-egui/tests/it/workspace_presets.rs
index 1e6fc335e3..a26006f328 100644
--- a/crates/ui-egui/tests/it/workspace_presets.rs
+++ b/crates/ui-egui/tests/it/workspace_presets.rs
@@ -63,7 +63,7 @@ fn presets_select_expected_panels_and_reset_every_dock_group() {
         app.ui.panels.character = !app.ui.panels.character;
         app.ui.panels.navigator = !app.ui.panels.navigator;
         app.ui.timeline.open = !timeline;
-        app.ui.dock.move_group(Group::Layers, Some(Group::Color));
+        app.ui.dock.order = vec![Group::Layers, Group::Color];
         app.ui.dock.set_collapsed(Group::Layers, true);
         app.ui.dock.heights.insert(Group::Properties, 99.0);
         app.ui.dock_tabs.color = 2;
@@ -131,7 +131,7 @@ fn custom_workspaces_restore_timeline_visibility_and_dock_after_presets() {
     let mut app = app();
     for (name, suffix) in [("Custom still", "pixelArt"), ("Custom motion", "motion")] {
         select(&mut app, suffix);
-        app.ui.dock.move_group(Group::Navigator, Some(Group::Color));
+        app.ui.dock.order = vec![Group::Navigator, Group::Color];
         app.ui.dock_tabs.color = 1;
         app.ui.dock.set_collapsed(Group::Properties, true);
         let expected = layout(&app);
diff --git a/docs/brush-parity.md b/docs/brush-parity.md
index 16eeb07198..23d0b422c3 100644
--- a/docs/brush-parity.md
+++ b/docs/brush-parity.md
@@ -1,6 +1,6 @@
 # Brush and painting parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-16 · **Change:** minor (named, stateful Brush Settings locks and visible keyboard focus; independent Brush Pose tilt-axis overrides; Transfer Wetness/Mix tool applicability; dragged preset tip preview; Hue Jitter amount track; Brush Settings minimum fields follow their Control; checkbox-only rows and non-destructive Smoothing switch; shaped-tip cursor follows the view; Color Replacement is a live toolbar tool; no brush-feel estimate changed; 2026-10-11: Pattern Stamp and Background Eraser draw live, TOOL-213-7) · **Target:** Adobe Photoshop 2026
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-25 · **Change:** minor (Art History Brush row added as partial, 8 of 10 styles, TOOL-213-20, #1610; hard-round built-in presets use 5% spacing to remove stacked-tip outlines and reduce pressure-opacity bands, #8842; Mode for Clone Stamp, Pattern Stamp, History Brush, Healing and Paint Bucket; named, stateful Brush Settings locks and visible keyboard focus; independent Brush Pose tilt-axis overrides; Transfer Wetness/Mix tool applicability; dragged preset tip preview; Hue Jitter amount track; Brush Settings minimum fields follow their Control; checkbox-only rows and non-destructive Smoothing switch; shaped-tip cursor follows the view; Color Replacement is a live toolbar tool; no brush-feel estimate changed; 2026-10-11: Pattern Stamp and Background Eraser draw live, TOOL-213-7) · **Target:** Adobe Photoshop 2026
 
 Painting is where Photoshop users notice differences first, so it gets its own checklist: the
 brush engine (`crates/paint/src/brush.rs`), the Brush Settings UI
@@ -55,7 +55,7 @@ tablets against Photoshop side by side.
 | Behaviour | Status | Evidence |
 |---|---|---|
 | No seams, hard edges stay hard, zero-scatter defaults, ABR tips never black | done | TOOL-213-13 |
-| Smooth line weight along a pressure ramp | partial | stair-steps (#1776) |
+| Smooth line weight along a pressure ramp | partial | stair-steps (#1776); 2026-10-23: the five hard-round built-in presets use 5% spacing (#8842), with rendered 150 px outline and pressure-opacity continuity regressions at 8/16/32-bit and 0/49% smoothing. Other brush-feel gaps remain open. |
 | Interpolation and smoothing match Photoshop | partial | #2138, #2057 |
 | Soft-edge falloff matches Photoshop's curve | partial | #2149, #1619 |
 | Brush preview and cursor crisp, not pixelated | partial | #1433 |
@@ -94,10 +94,11 @@ tablets against Photoshop side by side.
 |---|---|---|
 | Brush, Pencil (aliased, Auto Erase), Eraser (Brush/Pencil/Block) | done | Pencil 1 px quality #2139 |
 | Mixer Brush (Wet, Load, Mix, Flow, Sample All Layers, Current Brush Load with Load Brush and Clean Brush, automatic Load and Clean) | partial | No live result while dragging, no Alt-click loading (#2247) |
-| Clone Stamp (opacity, flow, aligned, sample, overlay) | partial | Clone Source W/H link and Alt target cursor (TOOL-213-8) |
-| Pattern Stamp (aligned, impressionist) | done | |
-| History Brush | done | Art History Brush missing |
-| Spot Healing, Healing | partial | grain not matched on flat colour (#2104), "horrible in general" (#1092), stops responding after switching (#1751) |
+| Clone Stamp (mode, opacity, flow, aligned, sample, overlay) | partial | Clone Source W/H link and Alt target cursor (TOOL-213-8) |
+| Pattern Stamp (mode, aligned, impressionist) | done | |
+| History Brush (mode) | done | |
+| Art History Brush (styles, Area, Tolerance) | partial | 8 of 10 styles (no Tight Curl Long / Loose Curl Long); Area scales spacing, not Photoshop's coverage; no Mode/Opacity on the options bar, no pen pressure (TOOL-213-20) |
+| Spot Healing, Healing (Healing mode: Normal, Multiply, Screen, Darken, Lighten, Color, Luminosity) | partial | Healing's Replace mode and Spot Healing's Mode missing; grain not matched on flat colour (#2104), "horrible in general" (#1092), stops responding after switching (#1751) |
 | Blur, Sharpen, Smudge (premultiplied, Sample All Layers, spacing) | done | BUG-207-2/3, #2171 |
 | Dodge, Burn, Sponge | done | |
 | Background Eraser, Magic Eraser | done | |
@@ -118,6 +119,8 @@ tablets against Photoshop side by side.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-25 | minor | Art History Brush row added as partial (8 of 10 styles, TOOL-213-20, #1610). No brush-feel estimate changed. |
+| 2026-10-23 | minor | Hard-round built-in presets use 5% spacing (#8842); rendered large-tip outline and pressure-opacity continuity tests cover 8/16/32-bit and 0/49% smoothing. Other presets and user settings retain their spacing; percentages and estimates unchanged. |
 | 2026-10-14 | minor | Brush Pose tilt overrides are independent end to end (#3825 partial); ABR flags, legacy JSON/commands, presets and three pixel depths covered; no readiness percentage or estimate changed |
 | 2026-10-13 | minor | Stale "missing tool" row corrected against main: Color Replacement (`paint.colorReplacement`) is a live toolbar tool; no brush-feel estimate changed |
 | 2026-10-11 | minor | Pattern Stamp and Background Eraser draw live (#3754); live retouch row now partial (Mixer Brush left) |
@@ -129,4 +132,5 @@ tablets against Photoshop side by side.
 | 2026-10-13 | minor | Hue Jitter uses the same themed amount slider as other jitter controls (#3825, partial). No brush-feel estimate changed. |
 | 2026-10-13 | minor | Transfer Wetness/Mix controls follow the active tool and retain their settings while disabled (#3825, partial). No brush-feel estimate changed. |
 | 2026-10-14 | minor | The 12 existing Brush Settings section locks expose translated names and locked state to AccessKit and show themed keyboard focus (#3477 workflow); icons, hit targets and command behavior retained. No brush-feel estimate changed. |
+| 2026-10-14 | minor | Options-bar Mode for Clone Stamp, Pattern Stamp, History Brush and Healing (kept in each tool's brush) and Paint Bucket (with Clear); each tool's first brush starts in Normal. No brush-feel estimate changed. |
 | 2026-10-13 | minor | Dragging a brush preset shows its cached tip thumbnail and name in the Brushes panel and preset picker (#4225, partial). No brush-feel estimate changed. |
diff --git a/docs/context-menu-parity.md b/docs/context-menu-parity.md
index 6663cf0b00..1ef971ef33 100644
--- a/docs/context-menu-parity.md
+++ b/docs/context-menu-parity.md
@@ -1,6 +1,6 @@
 # Context-menu parity contract
 
-> **Last reviewed:** 2026-10-18 · **Last updated:** 2026-10-20 · **Change:** minor (Zoom tool menu order, #6005; Type tool menu over committed type, #7324; earlier: Path Selection canvas menu, #1056; pasteboard row: the menu exists, #2462) · **Target:** Adobe Photoshop 2026
+> **Last reviewed:** 2026-10-18 · **Last updated:** 2026-10-21 · **Change:** minor (Crop tool menu on a pending crop, #6561; Zoom tool menu order, #6005; Type tool menu over committed type, #7324; earlier: Path Selection canvas menu, #1056; pasteboard row: the menu exists, #2462) · **Target:** Adobe Photoshop 2026
 
 Status: implementation contract, updated 2026-10-09. Scope: canvas, document tabs, and panels. “Right-click” means a secondary pointer click; macOS Control-click should also open the same menu where the platform sends a context-menu gesture. Photoshop changes a context menu with the active tool, selection, and panel item. Adobe documents that principle but does not publish a complete current menu catalog. **Documented** means an Adobe source explicitly names the gesture or action. **Inferred** means a PhotoCraft design target or an item known from a main menu whose presence in a Photoshop context menu still needs a current-product capture. Do not present inferred rows as exact Photoshop menus. [Adobe: panels and menus](https://helpx.adobe.com/photoshop/using/panels-menus.html), [Adobe: shortcuts and context menus](https://helpx.adobe.com/sa_en/photoshop/using/customizing-keyboard-shortcuts.html).
 
@@ -22,7 +22,7 @@ The “PhotoCraft at branch point” column records behavior before this PR. Pic
 |---|---|---|---|
 | Move | Choose a layer at the point; an auto-select choice also exists in the options bar | Layers | P0; [Adobe layer movement](https://helpx.adobe.com/photoshop/using/moving-stacking-locking-layers.html); exact pop-up layout requires capture |
 | Rectangular/Elliptical Marquee, Lasso, Polygonal Lasso, Magnetic Lasso, Magic Wand, Quick Selection, Object Selection | Active selection: the 2026 selection menu (see *Selection canvas reference* below); no selection: making a selection | Quick Selection: Picker (a brush tool, as in Photoshop); the other six: the selection menu below (#614, #738) | P1; no-selection variant still needs a dated capture |
-| Crop | During crop: ratio/preset, overlay, clear/reset, commit/cancel **(inferred context placement)** | No tool menu | P1; pending crop target |
+| Crop | During crop: ratio/preset, overlay, clear/reset, commit/cancel **(inferred context placement)** | On a pending crop (canvas_tool_menu.rs `crop_rows`, #6561): the options bar's preset dropdown in its order (Ratio, W x H x Resolution, the ratios, the size presets, saved crop presets, Front Image), Clear, New/Delete Crop Preset…, the six overlays and Auto/Always/Never Show Overlay (checked as in the bar), Cancel and Crop; also outside the image while a crop is pending. The untouched default frame has no menu. Esc closes only the menu. Reset remains open (no reset of frame, rotation and ratio yet, nor the options bar's ↺). Photoshop's menu also lists Reset Crop and Rotate Crop Box ([Kost](https://jkost.com/blog/2017/05/essential-tips-for-cropping-in-photoshop-cc.html)); both missing | P1; pending crop target; item list still needs a dated Photoshop capture |
 | Eyedropper | Sample-size/source choices **(inferred)** | No tool menu | P2; [Adobe illustration uses Eyedropper](https://helpx.adobe.com/photoshop/using/panels-menus.html), but does not publish item text |
 | Ruler, Note, Count | Unit / measurement, note edit/delete, count-group operations **(inferred)** | No tool menu | P2 |
 | Brush, Pencil, Eraser, Background Eraser, Spot Healing, Healing, Clone Stamp, History Brush, Blur, Sharpen, Smudge, Dodge, Burn, Sponge | Brush preset, size and hardness where applicable | Picker | P0; [Adobe Brush Settings](https://helpx.adobe.com/photoshop/desktop/apply-painting-techniques/brushes-presets/create-brush-set-painting-options.html). Alt+secondary-drag on Windows and Control+Option-drag on macOS adjust size/hardness ([Adobe cursor shortcuts](https://helpx.adobe.com/in/photoshop/desktop/get-started/settings-and-preferences/change-tool-pointers.html)) |
@@ -100,6 +100,7 @@ Each slice needs pure model tests (including every item dispatching a known comm
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-21 | minor | Crop tool menu on a pending crop (#6561) |
 | 2026-10-20 | trivial | Zoom tool menu order (#6005) |
 | 2026-10-18 | minor | Type tool menu over committed type (#7324) |
 | 2026-10-15 | trivial | Pasteboard row: the colour menu exists since #2462 |
diff --git a/docs/control-protocol.md b/docs/control-protocol.md
index 3d4d601b30..d291f45d3b 100644
--- a/docs/control-protocol.md
+++ b/docs/control-protocol.md
@@ -47,14 +47,15 @@ The transport is `apps/photocraft/src/control_server.rs`, and the handlers are i
 - `engine.execute {command, params}`: run any engine or UI command by id. Engine commands run directly with their default params and never open a dialog. Use `ui.menu.invoke` for menu-click behaviour, which opens a command's dialog when no params are given. `params` must be a JSON object (omit it or pass `null` for none); an array, string, number or boolean is an error naming the command, in every transport (control channel, `serve`, MCP and the CLI)
 - `engine.commands`: list commands with enablement; the `result` is a JSON array of command objects (see [Command list replies](#command-list-replies))
 - `ui.inspect`: full UI state (tool, panels, views, dialogs, windows, window size). The menu tree is not included; use `ui.menu.list`. `brushPicker` is `null` while closed and `{pos: [x, y], size: [w, h]?, list: {collapsed, filter, renaming, showName, showStroke, showTip, scale}}` while the Brush Preset picker is open (coordinates in screen points; `size` is the picker's content size once its corner grip was dragged, `null` before that, and the drag remembers both dimensions; the three `show*` flags pick the parts of each preset's card — at least one is always on; `scale` is the footer slider, 0.15–2 with 1 the standard, multiplying the cards' width and height — the heights stop at half size and the name and tip-size text hold their 1.0 size — and dropping the tips' size numbers at 0.40 and below; the parts and the scale are remembered across restarts, while the search, collapsed groups and a rename in progress are not). `view` holds the View/Window/Type preferences: `screen_mode`, `extras`, `show` and `snap_to` flags, `flip_horizontal`, `arrange` (Window › Arrange layout), pixel aspect, font preview size, language options. `perf.timings.gpuInfo` holds the graphics adapter, backend, driver, the backend chosen at launch and why, the canvas renderer (`gpu`/`cpu`) and, after a device loss, `lost` (`help.systemInfo` returns the same as `info`)
-- `ui.set {tool?, panels?, dockTabs?, dock?, dockWidth?, colorPanel?, maskTarget?, vectorMaskTarget?, selectionMode?, zoom?, center?, rotation?, fit?, theme?, brushSize?, brushSection?, brushTab?, brushesView?, brushPicker?, brushPickerName?, brushPickerStroke?, brushPickerTip?, brushPickerScale?, gradientBlendMode?, gradientClassic?, shapeStroke?}`: change UI state; any other field is an error, checked before anything changes (`zoom` is the canvas zoom where 1 = 100%, one document pixel per physical display pixel, so a scaled display doesn't magnify the image; `theme` is `pro`, `proMedium`, `studio`, `studioLight` or `classic`; `selectionMode` is the selection tools' options-bar mode, 0 New, 1 Add, 2 Subtract, 3 Intersect; `brushSection` indexes the Brush Settings sections, `brushTab` 0 = Brush Settings, 1 = Brushes; `brushesView` is `list` or `grid` for the Brushes panel; `brushPickerName`, `brushPickerStroke` and `brushPickerTip` are the Brush Preset picker's card parts (booleans, at least one on), and `brushPickerScale` its footer card-scale slider (0.15 to 2, 1 the standard); `brushPicker` is `[x, y]` in screen points to open the Brush Preset picker there (as a right-click with a painting tool does) or `null` to close it, and picking a preset in it is `tools.setBrush {"preset": name}`; `dock` is `{order: ["layers", …], heights: {"properties": 180}, collapsed: ["color"], tabOrder: {"layers": ["Paths", "Layers", "Channels"]}}`, the right-dock groups top to bottom, their heights in points, the groups collapsed to their tab strip and each group's tab order left to right by panel name (a group left out keeps its default order, unknown names are ignored and tabs not listed follow in their default order; `dockTabs` keeps indexing tabs in their default order); `dockWidth` sets the right dock width in points, clamped to 250..520; `colorPanel` is `{background?, mode?, ramp?, webSafeRamp?}`, merged into the Color panel's state: `background` is whether it edits the background colour, `mode` its panel-menu display (`hueCube`, `brightnessCube`, `colorWheel`, `grayscaleSlider`, `rgbSliders`, `hsbSliders`, `cmykSliders`, `labSliders` or `webColorSliders`), `ramp` the colour ramp under the sliders (`rgbSpectrum`, `cmykSpectrum`, `grayscaleRamp` or `currentColors`) and `webSafeRamp` Make Ramp Web Safe; `maskTarget` targets the active layer's mask, which, like Photoshop, swaps in the foreground/background pair kept for masks (white/black until one is picked) and swaps the pixels' pair back when the pixels are targeted again)
+- `ui.set {tool?, panels?, dockTabs?, dock?, dockWidth?, colorPanel?, maskTarget?, vectorMaskTarget?, filterMaskTarget?, selectionMode?, zoom?, center?, rotation?, fit?, theme?, brushSize?, brushSection?, brushTab?, brushesView?, brushPicker?, brushPickerName?, brushPickerStroke?, brushPickerTip?, brushPickerScale?, gradientBlendMode?, gradientClassic?, shapeStroke?}`: change UI state; any other field is an error, checked before anything changes (`zoom` is the canvas zoom where 1 = 100%, one document pixel per physical display pixel, so a scaled display doesn't magnify the image; `theme` is `pro`, `proMedium`, `studio`, `studioLight` or `classic`; `selectionMode` is the selection tools' options-bar mode, 0 New, 1 Add, 2 Subtract, 3 Intersect; `brushSection` indexes the Brush Settings sections, `brushTab` 0 = Brush Settings, 1 = Brushes; `brushesView` is `list` or `grid` for the Brushes panel; `brushPickerName`, `brushPickerStroke` and `brushPickerTip` are the Brush Preset picker's card parts (booleans, at least one on), and `brushPickerScale` its footer card-scale slider (0.15 to 2, 1 the standard); `brushPicker` is `[x, y]` in screen points to open the Brush Preset picker there (as a right-click with a painting tool does) or `null` to close it, and picking a preset in it is `tools.setBrush {"preset": name}`; `dock` is `{order: ["layers", …], heights: {"properties": 180}, collapsed: ["color"], tabOrder: {"layers": ["Paths", "Layers", "Channels"]}}`, the right-dock groups top to bottom, their heights in points, the groups collapsed to their tab strip and each group's tab order left to right by panel name (a group left out keeps its default order, unknown names are ignored and tabs not listed follow in their default order; `dockTabs` keeps indexing tabs in their default order); `dockWidth` sets the right dock width in points, clamped to 250..520; `colorPanel` is `{background?, mode?, ramp?, webSafeRamp?}`, merged into the Color panel's state: `background` is whether it edits the background colour, `mode` its panel-menu display (`hueCube`, `brightnessCube`, `colorWheel`, `grayscaleSlider`, `rgbSliders`, `hsbSliders`, `cmykSliders`, `labSliders` or `webColorSliders`), `ramp` the colour ramp under the sliders (`rgbSpectrum`, `cmykSpectrum`, `grayscaleRamp` or `currentColors`) and `webSafeRamp` Make Ramp Web Safe; `maskTarget` targets the active layer's mask, which, like Photoshop, swaps in the foreground/background pair kept for masks (white/black until one is picked) and swaps the pixels' pair back when the pixels are targeted again; `filterMaskTarget` targets the active smart object's filter mask (an error without smart filters), so painting, fills, filters and adjustments edit it (`"target":"filterMask"`) while Move and Edit › Transform still act on the smart object)
   - `typeTransform` is `null` outside a temporary Ctrl/Cmd Type-tool drag. During a drag it reports its source document/revision, original affine, oriented `frame` (layer, local bounds, document-space corners and pivot), and captured `gesture`. Drive it with `ui.pointer` and `command: true` at `down`; `move`/`up` may release the modifier. The document/history remain unchanged during preview, and `up` applies one `type.edit` within `textEdit`'s session. Pressing Escape during the drag cancels only the preview. This pointer state is never restored from saved UI state.
-- `ui.menu.invoke {id, params?, wait?}` / `ui.menu.list`: activate a menu item by id; list the menu tree. A menu item that starts a background job (a filter without a dialog, such as Blur More) replies with the job's result once it has been applied; with `"wait": false` the reply is `{job, pending: true}` at once. Window ends with the open documents as `window.document.<index>` (tab order, the active one checked, #2991); invoking one brings that document to the front and replies `{document: index}`
+- `ui.menu.invoke {id, params?, wait?}` / `ui.menu.list`: activate a menu item by id; list the menu tree. A menu item that starts a background job (a filter without a dialog, such as Blur More) replies with the job's result once it has been applied; with `"wait": false` the reply is `{job, pending: true}` at once. Window ends with the open documents as `window.document.<index>` (tab order, the active one checked, #2991); invoking one brings that document to the front and replies `{document: index}`. Camera Raw and the full-window workspaces (Liquify, Content-Aware Fill, Filter Gallery, Adaptive Wide Angle) are modal: while one is open, `ui.menu.invoke` refuses every other menu item ("menu command is unavailable while a modal dialog is open") and accepts only that workspace's own `{"ui": {...}}` requests (`filter.liquify`, `edit.contentAwareFill`, `filter.filterGallery`, `filter.adaptiveWideAngle`, `filter.cameraRaw`; `params` must hold only the `ui` object), so finish it with `{"ui":{"commit":true}}` or `{"ui":{"cancel":true}}` first. Those requests are refused too while a dialog, an unsaved-changes prompt or a crop that blocks the command is open: resolve that first, then commit or cancel the workspace. `ui.menu.list` reports the same gate: an item the modal state refuses is listed with `enabled: false`. `engine.execute` is not a menu click and is not gated
 - `ui.set` also accepts `gradientBlendMode` (a layer blend mode name, such as `Difference`) and `gradientClassic` (boolean) for the Gradient tool options bar.
 - `ui.set` also accepts `camTransformOnDrop` (boolean), the Content-Aware Move tool's Transform On Drop checkbox: a drop then puts a scale/rotate box on the patch (`ui.inspect` › `camTransform`: its document/revision, drag `offset` and `frame`), driven with `ui.pointer` (handles as Free Transform's; outside the box rotates), committed with `ui.key Enter` (one `paint.contentAwareMove` with `scaleX`, `scaleY`, `rotate`) or dropped with `Escape`.
 - `ui.set` also accepts `tileGrid` (boolean), a developer overlay of the active layer's storage tiles: the tile grid over the document, every stored tile filled and labelled `tx,ty`, tiles with identical pixels in a shared colour and unique ones in blue. It has no menu item and View › Extras doesn't hide it. `ui.inspect` reports it as `view.tile_grid`.
 - `ui.set` also accepts `strokeTrace` (`true`, `false`, `"stderr"` or `"off"`): turn the stroke latency trace on or off at runtime; each stroke's summary is in `ui.inspect` `perf.strokeTrace`. A CSV file of every frame is set only at launch (`PHOTOCRAFT_STROKE_TRACE=<file.csv>` / `--stroke-trace <file.csv>`): the control channel doesn't write files outside the automation write root
 - `ui.set` also accepts `layerFilter` (#5048), the Layers panel filter row: `{by?, kinds?, name?, mode?}`, any subset. `by` is `kind`, `name` or `mode` (the filter-type dropdown); `kinds` lists the Kind toggles that are on (`pixel`, `adjustment`, `type`, `shape`, `smart`); `name` matches part of a layer name, ignoring case; `mode` is a blend mode name (`Multiply`, `Pass Through`). Kind and Name filter only once a kind is on or text is typed; Mode always filters, by Normal at first, as in Photoshop. Fields left out keep their value; a bad one is an error and changes nothing.
+- `ui.set` also accepts the Histogram panel: `histogramPanel` `{view?, channel?, showChannelsInColor?, showStatistics?, source?}` (any subset, kept with the preferences): `view` is `compact`, `expanded` or `allChannels`; `channel` is `composite`, `red`, `green`, `blue`, `cyan`, `magenta`, `yellow`, `black`, `a`, `b`, `luminosity` or `colors` (one the document's mode lacks shows as its composite); `source` is `entireImage`, `selectedLayer` or `adjustmentComposite` (Entire Image is counted in Compact View, when the document has one layer, or when no adjustment layer is selected for Adjustment Composite). `histogramRange` is `[from, to]` (levels 0..255) or `null`: the dragged tonal range whose Count and Percentile the statistics show. `histogramRefresh: true` is Uncached Refresh: the current state is recounted at cache level 1. `ui.inspect` › `histogram` reports the options, the channel and source as they apply, the channels the document offers, whether the shown histogram is `current` (counted for the document's revision, source and cache level the panel wants now), its `cacheLevel`, `maxCacheLevel` (Preferences › Performance › Cache Levels), `preview` (an adjustment's preview is counted) and `stats` (`mean`, `stdDev`, `median`, `pixels`, `level`, `count`, `percentile`, `clipped` percent at 0 and 255). Histograms are counted while the panel is shown.
 - Each painting tool keeps its own brush, as in Photoshop: `tools.setBrush` and `ui.set {brushSize}` change the active tool's brush, and switching tools swaps in that tool's own (size, hardness, mode, opacity, flow, dynamics, smoothing). A tool used for the first time starts from the brush in hand. The colours, the erase flag and the stroke seed stay shared. So `ui.set {tool: "eraser", brushSize: 12}` sets the Eraser's size, and `ui.set {tool: "brush"}` afterwards brings the Brush's own size back.
 - Brush Pose's `pose.overrideTiltX` and `pose.overrideTiltY` are independent booleans. For example, `engine.execute {"command":"tools.setBrush","params":{"pose":{"enabled":true,"tiltX":45,"overrideTiltX":true,"overrideTiltY":false}}}` fixes X at 45° while Y follows the stylus. Pose tilts are degrees (±90); the Brush Settings panel displays percentages (±100). Old stored `overrideTilt` values migrate to both axes. In command patches, `overrideTilt` sets both axes unless an explicit axis field in the same patch overrides it. `brush.get` includes both axis flags and the legacy combined readback (`overrideTilt` is true only when both flags are true). Axis-only journals omit that derived combined key so replay retains the other axis. Present flag values must be booleans; null and other types return an error.
 - `ui.set` also accepts the Eyedropper options bar (#1649): `eyedropperSampleSize` (`"point"` or 1, 3, 5, 11, 31, 51, 101: the side of the averaged square, shared by the Eyedropper, a painting tool's Alt-click eyedropper, the Curves/Color Picker eyedroppers and the Info panel), `eyedropperSample` (`current`, `currentAndBelow`, `all`, `allNoAdjustments`, `currentAndBelowNoAdjustments`) and `eyedropperRing` (boolean, Show Sampling Ring). `ui.inspect` reports them under `toolOptions` (`eyedropper_size`, `eyedropper_sample`, `eyedropper_ring`). The engine command `document.sampleColor {x, y, size, sampleLayer}` returns the colour such a sample picks, as four floats 0..1 (not 0..255).
@@ -89,7 +90,19 @@ The transport is `apps/photocraft/src/control_server.rs`, and the handlers are i
 - `ui.gpu.simulateLoss {error?}`: act as if the wgpu device was lost (or reported an error with `error: true`). The app switches to the CPU image compositor (after a loss for the rest of the session; after an error until a successful Retry GPU) and shows the same recovery warning as on a real loss. `gpuFallbackNotice` in `ui.inspect` contains the reason while the warning is open. Keep Using CPU saves CPU compatibility for the next launch. Retry GPU saves GPU mode; after an error (`error: true`) it also builds a new GPU canvas on the same device at once (`gpuInfo.canvas` is `gpu` again, #6577), and after a loss it asks the user to save and restart. The window renderer still requires a working graphics or software adapter. Returns `wasActive` and `gpuInfo`. For testing the fallback. With `destroy: true` it destroys the window's real wgpu device instead, as a driver reset does (see `docs/development.md` › device loss): the app saves every unsaved document for recovery and closes. Returns `destroyed`
 - `ui.screenshot {path?, focus?}`: capture the main window (PNG). With no path the reply contains
   base64 PNG data; a path is relative to the automation write root. Raises the window first
-  (default) because occluded macOS windows stop rendering
+  (default) because occluded macOS windows stop rendering. A request sent before the first frame
+  is queued (within the same limits and deadline) and captures once the window geometry is known,
+  as on 0.15. At most four captures may be outstanding (waiting for geometry, rendered or awaiting
+  collection), one image may use at most 128 MiB and all of them at most 256 MiB; the budget is
+  re-checked when the window changes before a queued request is captured, and an over-budget
+  request is refused before it is captured. A request gives up after 8 s (including retries after
+  a resize/DPI/zoom change), and a result that arrives after it was cancelled or timed out is
+  discarded without a file or a second reply. Any size, scale, zoom, texture-side or minimized
+  change between issuance and collection retries the capture even if the values change back, and
+  a minimized window fails with an error instead of waiting for the timeout. The
+  document (and its activation: a switch away and back) is fixed when the request is accepted: if
+  another document becomes active before the capture, the request fails with an error rather than
+  saving the wrong document
 - `ui.focus`: bring the main window to the front
 - `app.open {path}` / `app.save {path?, tgaBits?, ddsCompression?, ddsMipmaps?, quality?, jpegFormat?}` (JPEG: `quality` on the 0–12 scale, `jpegFormat` `baseline`, `optimized` or `progressive`; automation never shows JPEG Options): relative file I/O through the configured automation roots (`app.open` reads under the read root, `app.save` writes under the write root; absolute paths, `..` and paths escaping the root are refused, and both fail closed when no root was granted). Both reply with `warnings` (import/export notes such as "adjustment layer flattened"; `[]` when none), also shown to the user in the status bar and as a notice (`notices` in `ui.inspect`); `app.open` also returns the `path` and document `name` (directory `.pcraft` — the native on-disk form — loads through the read root's capability; the single-file (zip) form takes the bytes path), `app.save` the `path` written. `app.save` without `path` writes back only to the document's own PSD, PSB or `.pcraft` file, like File › Save. `tgaBits` (24 or 32) sets a TGA's bits per pixel: 32 writes the alpha channel (or else the transparency) as its alpha, 24 none; without it, 32 with an alpha channel or transparency, else 24. `ddsCompression` (`none`, `bc1`, `bc2` or `bc3`) and `ddsMipmaps` (bool) set a DDS texture's compression and mip chain; without them, uncompressed without mipmaps. Automation saves never show TGA, DDS, JPEG or TIFF options. Automation opens and saves never fire script events. Use these two rather than `file.open`, `file.save`, `file.saveAs` or `file.saveACopy`, which the control channel refuses (see [Engine commands](#engine-commands))
 - `app.quit`
@@ -118,7 +131,7 @@ store expose and persist the same setting; scripts keep using canonical command
 | `layer.newAdjustmentLayer.hueSaturation` | `{"hue":30,"saturation":10}` |
 | `paint.stroke` | `{"points":[[x,y,pressure],…],"size":20,"color":"#ff0000"}` |
 | `select.rect` | `{"x":0,"y":0,"width":100,"height":50,"mode":"add","ellipse":false}` |
-| `document.inspect` | `{}`: layer tree, history, snapshots (`[{id, name}]`, for `history.selectSnapshot`), selection bounds |
+| `document.inspect` | `{}`: layer tree, history, snapshots (`[{id, name}]`, for `history.selectSnapshot`; id 0 is the document as opened), selection bounds |
 | `layer.list` | `{"document":index?,"flat":bool?}`: just the layers, top-down: `id`, `name`, `kind`, `visible`, `bounds` (`[x,y,w,h]` or null), `selected`, `active`; groups list their `children`, or with `flat` every layer is one row with its `depth` and `parent` group id |
 | `document.pixel` | `{"x":10,"y":10}`: composite RGBA, four floats 0..1 (not 0..255) |
 | `document.presets.list` | `{}` → `{presets:[{name,settings}]}`: saved New Document configurations |
@@ -498,15 +511,26 @@ viewports, so the dialog is drawn over the main window and appears in the image.
 RGB/Grayscale layer. `params: {"smartFilter": {"layer": id, "index": i}}` opens it on an existing
 Camera Raw smart filter instead (as double-clicking the filter in the Layers panel does): the
 stored settings over the pixels below that filter, previewed through the filter mask; commit
-then runs `layer.smartFilter.setParams` with every setting. `params.ui` accepts `set` (filter settings), `before`, `scope`, `view`, `commit` and
+then runs `layer.smartFilter.setParams` with every setting. `params.ui` accepts `set` (filter settings), `before`, `scope`, `view`, `auto` (true: the Light
+sliders from the image's histogram, the panel's Auto button), `commit` and
 `cancel`, and while a raw file opens also `demosaic` (below). All parts of one request are validated before any is applied; a rejected request
 leaves the settings, view state, preferences and document unchanged (and closes a dialog it
-opened). Unknown `ui` or settings properties, non-boolean `before` / `commit` / `cancel`, and
+opened). Unknown `ui` or settings properties, non-boolean `before` / `auto` / `commit` / `cancel`, and
 `commit` together with `cancel` are errors. Point curves (`pointCurve`, `pointCurveRed`,
 `pointCurveGreen`, `pointCurveBlue`) are empty or 2–16 finite points in 0–255 with inputs at
 least one level apart. Commit dispatches one `filter.cameraRaw` engine command; a failed commit
 keeps the dialog open for correction. Nothing else writes document history.
 
+A raw file opened from a path reads its sidecar (`IMG_0001.xmp` beside `IMG_0001.CR2`, Camera
+Raw's `crs:` settings) into the open-time dialog, and Open writes changed settings back
+(Preferences › Camera Raw Defaults › Write xmp sidecars). It never writes beside a DNG, over a
+sidecar another application wrote (a notice says it was kept), or for a control or MCP request.
+Open also applies the other Camera Raw Defaults (Sharpen For as part of the Camera Raw step, then
+colour space, bit depth and Open as Smart Object, so the step works on the pixels the dialog
+previewed; Apply auto tone fills the dialog), reported as `defaults` in the commit's reply; the
+resolution is set when the file opens. With "Open in Camera Raw" off the sidecar and the defaults
+apply without the dialog.
+
 **Opening a raw file.** An interactive open (File › Open, Open Recent, drag and drop, the
 command line) of a camera raw developed from its sensor data shows this dialog first, titled
 "Camera Raw (name)", with **Open** and **Cancel**, as Photoshop opens raws in Adobe Camera Raw.
@@ -646,21 +670,37 @@ layer names. Selection is captured before opening the dialog; an unselected laye
 ## Shared panel docking
 
 Panel arrangements support tab grouping and reordering, horizontal and vertical splits,
-and movable, resizable floating groups inside the application window. Drag a panel tab,
-or use its context menu. Floating groups remain within the application viewport.
+and movable, resizable floating groups. Drag a panel tab or a group's drag bar, or use its
+context menu. On the desktop a floating group opens in its own OS window; on Wayland, in the
+web build and for the Studio Properties card it stays inside the application window.
 
 The shared layout begins with the existing workspace on the first docking operation.
-Workspace saves retain its groups, active tabs, split sizes, floating geometry, and the
+Workspace saves keep its groups, active tabs, split sizes, floating geometry, and the
 positions of hidden panels. Resetting a built-in workspace restores its default dock.
 
-- `window.panel.move {panel, anchor, zone?, before?}` moves a panel into the target group.
-  `zone` is `tab` (default), `center`, `left`, `right`, `top`, or `bottom`; `before` reorders
-  tabs by panel ID. The destination must already be visible.
-- `window.panel.float {panel, x?, y?, width?, height?}` detaches a panel.
-- `window.panel.dock {panel, anchor?, zone?, before?}` returns a panel to its previous
-  dock placement when possible, or to the supplied destination.
+The docking commands are craft-ui's shared vocabulary (`DockCommand`). Panels may be named
+by ID or label, and `onto` is accepted for `anchor`.
+
+- `window.panel.move {panel, anchor, zone?, before?, group?, placement?}` moves a panel into the
+  target group. `zone` is `tab` (default), `center`, `left`, `right`, `top`, `bottom`, `above`
+  or `below`; `before` reorders tabs by panel ID; `group: true` moves the panel's whole group.
+- `window.panel.float {panel, x?, y?, width?, height?, group?, column?}` detaches a panel (at
+  400, 140 and 300x400 by default) or its group.
+- `window.panel.dock {panel, anchor?, zone?, before?, group?, side?}` returns a floating panel to
+  the dock place it floated from when possible, or to the supplied destination.
 - `window.panel.activate {panel}` reveals and selects a panel, restoring its saved
-  position when possible. `window.panel.close {panel}` hides it.
+  position when possible. `window.panel.close {panel}` hides it; `window.panel.closeGroup` and
+  `window.panel.closeOthers` close its group or the group's other panels.
+- `window.panel.minimize {panel, minimized?}` collapses a floating window to its title bar.
+- `window.panel.window {panel, native?}` floats a docked panel's group and gives its floating
+  window its own OS window. On the desktop every floating window has one, except the Studio
+  themes' Properties card, which stays over the canvas, and on Wayland, where floating windows
+  stay in the main window. The web refuses the command: floating panels stay in the page.
+- `ui.dock {operation, …}` takes the shared `ui.dock` operations (`open`, `close`, `activate`,
+  `float`, `moveFloating`, `move`, `setStackOpen`, `resizeStack`, `resizeSplit`) or `{action}`.
+- `window.workspace.lock {locked?}` sets Lock Workspace; `window.workspace {name}`,
+  `window.workspace.new {name}`, `window.workspace.delete {name}` and `window.workspace.reset`
+  run the Window › Workspace commands.
 
 Panel IDs are stable across themes. Invalid IDs, non-finite or invalid geometry, and
 invalid destinations return an error without changing the arrangement.
@@ -676,6 +716,13 @@ resizes the root divider (`false`/`true` path entries select first/second childr
 The UI dispatches these same commands. Unknown panel IDs, invalid geometry, and stale
 split paths return an error without changing the workspace.
 
+The `docking` object in `ui.state` and in saved workspaces is craft-ui's `Workspace`:
+`version` (2), `layout`, `hidden` (each closed panel with its return place), `saved` and
+`locked`. `dockingReturns` holds where each floating panel docks back, and
+`dockingCollapsed` the panels of collapsed custom groups. Any other saved `docking` value,
+such as a bare layout with `dockingHidden`, loads as the default layout, built from the
+saved `panels`, `dockTabs` and `dock`.
+
 The existing `ui.set` panel visibility, `dockTabs` selection and `dockWidth` controls
 remain available after customization. Width keeps its 250–520 point clamp. Named
 `dock.hidden_tabs` and intact native-group collapse settings are also preserved. A
@@ -690,7 +737,7 @@ or `down` to the panel's entire current group. With `operation:"move"`, provide
 `anchor` and optional `zone`/`before` (as for panel.move), or a serialized `placement`,
 to transfer all members atomically while preserving their order and selecting the
 requested `panel`.
-The floating group's header grip also transfers the whole group when dropped on a
+A floating group's drag bar or title bar also transfers the whole group when dropped on a
 dock target. The panel menu and icon rail remain
 available in custom workspaces. `window.panel.<id> {show:true}` always reveals, selects
 and expands the panel, including when another tab is selected. Workspace snapshots
diff --git a/docs/development.md b/docs/development.md
index f94d55958e..4cb7161ab0 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -424,6 +424,8 @@ cargo xtask perf --update-baseline   # also write perf/baseline.json from this r
   `cargo xtask perf --update-baseline`, with the machine (CPU, RAM, GPU adapter, OS), its machine
   class, commit, date and load average.
 - `crates/io/tests/it/corpus.rs`: the corpus floors (every `Source { .. }` constant).
+- `xtask/*-corpus.sha256`: file counts for pinned corpora, so stale counts in doc comments cannot
+  change the reported denominators. No downloaded corpus is needed to generate the scorecard.
 - The prefs audit: `Preferences` fields that no code reads (target 0, #204), plus counts taken
   from the tree (never-crash attribute coverage, `docs/parity-checklist.md`).
 
@@ -609,7 +611,7 @@ against committed **sha256 manifests**. All pins are in one place:
 
 | Directory | What | Source | Manifest |
 |---|---|---|---|
-| `corpus/photoshop/` | 256 PSDs we authored with Photoshop: smart filters, layer-style effect shapes, the text engine, adjustments in every mode and depth | https://github.com/storytold/photocraft-corpus (ours, MIT OR Apache-2.0) | `xtask/photoshop-corpus.sha256` |
+| `corpus/photoshop/` | 258 PSDs we authored with Photoshop: smart filters, layer-style effect shapes, the text engine, adjustments in every mode and depth | https://github.com/storytold/photocraft-corpus (ours, MIT OR Apache-2.0) | `xtask/photoshop-corpus.sha256` |
 | `corpus/gimp/` | 14 XCF files written by GIMP 3.2.6 with GIMP's merged rendering of each as a PNG (28 files), the oracles of the XCF reader | https://github.com/storytold/photocraft-corpus (ours, MIT OR Apache-2.0; its own pin) | `xtask/gimp-corpus.sha256` |
 | `corpus/psd/` | 170 small psd-tools and ag-psd files, the mix most PSD tests use | psd-tools and ag-psd upstreams (MIT) | `xtask/psd-corpus.sha256` |
 | `corpus/psd-tools/` | the complete psd-tools test set (309 files) | psd-tools upstream (MIT) | `xtask/psd-tools-corpus.sha256` |
diff --git a/docs/egui-037-migration-plan.md b/docs/egui-037-migration-plan.md
new file mode 100644
index 0000000000..767820e84e
--- /dev/null
+++ b/docs/egui-037-migration-plan.md
@@ -0,0 +1,1636 @@
+# PhotoCraft: egui 0.37 migration plan
+
+Status update (2026-10-25): local implementation includes main `b278ff72459cbf9754863365edd822ba2248aa07`, preserving its JPEG dependency, Affinity import and raster changes. All nine CI stages passed: 11,590 passing test executions, zero failed, 91 ignored across 93 summaries; the ignored panic hunt, strict lint and WASM compilation passed. The current-main integration received independent review. Native/browser GUI, native IME, PRIMARY, packaged WASM size, real-world 0.36 settings and paired application performance remain open. Publication requires separate explicit approval; human review and human merge are required.
+
+The original planning record below is historical.
+
+Current status — 2026-10-25: the port is implemented and reconciled with main
+`486afd82cce99255e999224bcfe28de00fd766aa`. The full managed CI run passed all nine stages:
+formatting, strict clippy, layers, scorecard, workspace tests, the ignored panic hunt,
+doctests, WASM compilation and the translation report. It recorded 11,580 passed and
+91 ignored test executions across 93 summaries, with zero failures. These totals include
+overlapping test invocations and are not a count of unique tests.
+
+The production graph uses canonical GitHub sources: egui `6d518fc799681571963842f95b55a6b68431b15a`,
+winit `a517b3846ee8457d84ee4975110bfda6797c44dc`, and shared UI/print
+`25da1314d443171b4adeaad2cd9454b273f35c6f`. The checked-in Cargo-generated lock has SHA256
+`714ce3bc78f32bc35bd69e27c4a785ac2f38983c77df9896dcddc8e5fa79ccb2`; no absolute path
+patch is required. The lifecycle/capture port, Type-tool surrounding-text and byte-deletion
+adapter, reset acknowledgement handling, and selection-action changes are implemented.
+
+The research and progress entries below retain their original sequence. Their statements
+about missing APIs, private path patches, unresolved pins and absent build results are historical
+and superseded by this status. Native/browser GUI and IME acceptance, PRIMARY behavior, packaged
+WASM size, broad visual/accessibility sweeps and paired app performance remain open. The synthetic
+settings fixtures qualify migration rules, not a captured real-world 0.36 save. Human review
+and human merge are required.
+Revision 2 (2026-10-23): resolves the independent review at
+`plan-reviews/photocraft-v1.md`, incorporates the shared E21b/W15P contracts and the
+lifecycle source audit, and removes the superseded sampling, PRIMARY, screenshot and
+rollback wording. The reviewed v1 document hash is retained in the evidence ledger;
+this revision needs its own independent review before publication.
+Baseline: `ff4738810134d7f7e68b49f2e4f231b686282ff3` ("Release 0.14.0", 2026-10-22).
+`Cargo.lock` baseline: sha256 `36a1de83fea16781dc7186d33d8064cb5dfa878a2a0847228737640b1e64e2d0`,
+git blob `5c96f56119b6ddb0feb2da9cff3e23232f2dc63c`.
+
+Target: egui/eframe/epaint family **0.37.0**, not upstream `main`. Upstream tag object
+`418687fa18fdac8a9b1b6c8f4a2eb1afd2df4c47` points at commit
+`841a328ba2dd8f6996beb7189ebb7fc00e668a2a`. The audited Craft fork candidate is
+`aiongg/egui` `craft/0.37` at `a4f9a17f64a6bae61350fb85804c9df0d9865916`; the audited
+winit candidate is `aiongg/winit` `craft/0.30.13-lang` at
+`8b35388bd719e8cc86a95971ba0bc026c9a8f058`, based on `storytold/winit`
+`craft/0.30.13` `ffae5198770d7730e718043f035a772b7dbc3b1b`.
+
+Those revisions are **historical, read-only evidence**. They are not accepted revisions and
+are not publication authority. Every implementation claim below must be re-run against the
+final published revisions.
+
+Research basis: upstream tag `0.37.0` source and changelogs in the read-only
+checkout `/home/codex/work/CraftApps/egui037-migration-20261022/egui`, the
+candidate fork commits and `PATCHES.md`, and the PhotoCraft source at the
+baseline SHA. No web research was needed for the API facts below; upstream
+release notes and source are the primary evidence. Historical fork/audit notes
+were used only to locate refs, not as acceptance evidence.
+
+Capture acceptance follows the suite contract: a queued-not-issued hidden request and
+each settling frame must request `RequestPaintWhileHidden` from logic; only an issued
+screenshot command forces paint itself. Callback arrival has no implicit wake, so the
+live request owns the viewport waker. Record known issuance UI bounds and a geometry
+epoch, reject/retry any intervening resize/DPI/zoom/surface change even if it changes
+back, and derive pixel scale from returned dimensions only under an unchanged epoch.
+Default limits are 4 requests, 128 MiB/image and 256 MiB aggregate. Count reserved
+in-flight and completed images together.
+
+
+## 1. Decision summary
+
+1. Move directly to 0.37.0; do not port 0.36.2 patches to a new 0.36.x branch.
+2. Keep the existing `App::logic` / `App::ui` split. PhotoCraft already uses it
+   (`crates/ui-egui/src/lib.rs:2244` and `:2371`), so there is no blanket
+   `Context`-bridge migration. The work is preserving the split across hidden
+   windows, screenshots, control input and multiple passes.
+3. Pin the whole egui family and winit by immutable git revisions. A consumer's
+   `[patch]` section does not propagate to dependency manifests, so the root
+   workspace must patch every family crate it resolves.
+4. Keep the existing `eframe` opt-out from default features. Add only the features
+   PhotoCraft actually needs: `wgpu`, `accesskit`, `wayland`, `x11`, `persistence`,
+   and the new `clipboard`. Add `monochrome_emoji_fonts` to the
+   `epaint_default_fonts` build-dependency. Do not enable `system_fonts` in the first
+   cut; the existing `cjk_fonts` system-provider path is measured separately (#8512).
+5. Reproduce 0.37's `egui-icons` face and family order. The current build script
+   fails at once because `NOTO_EMOJI_REGULAR` and `EMOJI_ICON` are now
+   feature-gated (`crates/ui-egui/build.rs:42`, `:44`), and `EGUI_ICONS` is
+   unconditional. The glyph, accessible-name and feature fixes are part of the
+   first green PR, not a later fixture sweep.
+6. Migrate `WidgetType` to `accesskit::Role` (the old name is a deprecated alias;
+   several variants were renamed), `Id::new` to `Id::unique`, `Ui::id` to
+   `Ui::scope_id`, panel IDs to `AsIdSalt`, screenshots to a bounded
+   `ScreenshotCallback` completion slot, and remove `UserData` /
+   `Event::Screenshot`. `Ui::scope_id` is the renamed old `Ui::id`;
+   `Ui::unique_id` is a new globally unique but **unstable** id and must never be
+   used for persisted state.
+7. Migrate two persisted schemas deliberately, in the first compatible PR:
+   `egui::PanelState` IDs and `egui_winit::WindowSettings`. `PanelState` gains a
+   parent-scoped id; `WindowSettings` changes from flat fields to
+   `normal_geometry`. The panel migration is additive (the old key stays), but the
+   window rewrite is one-way. Preserve panel widths and window size/fullscreen/
+   maximized state explicitly; document the rollback loss of window position.
+8. Adopt the language fork as a second, separately reviewed stage. E5/E12/E13/E16/
+   E17/E20 change text layout and AccessKit semantics; `bidi_text.rs` must not
+   pre-reorder text once E5 is active. This stage also adopts E21b: `IMEOutput`
+   gains a bounded logical surrounding-text payload, and the Type tool supplies a
+   real model adapter. E21b is new work, not existing E21/W27 capability.
+9. Treat E11 as optional. PhotoCraft does not enable `epaint/multithreading`; the
+   patch's forced single-threaded glyph context is a suite fix for Servo/VectorCraft,
+   not a PhotoCraft requirement.
+10. No PR may contain an absolute `path` patch. Final production manifests pin the
+    reviewed, published `storytold` full 40-hex SHAs for the whole family and winit,
+    including E21b and W15P. Stock 0.37.0 and the aiongg candidate revisions are
+    research controls, never staged release pins.
+11. Every performance comparison is paired on one machine. The committed
+    `perf/baseline.json` is a macOS M4 Pro measurement and must not be used as a
+    cross-machine verdict for this Linux/Windows work.
+12. Both native and web run `App::logic` and `App::ui` inside `Context::run_ui`,
+    once per layout pass. Logic-only ticks leave events and time stale, and a
+    completed `run_ui` resets `current_pass_index` to zero. Fresh input is
+    interpreted only in a known UI phase, with a forced hidden paint when the host
+    is hidden. Background timers use monotonic clocks, not
+    `ctx.input(|i| i.time)`, and every queue is consumed exactly once.
+13. The before/after harness exists on the 0.36.2 baseline before any production
+    edit. The baseline PR adds the text-tessellation, renderer-construction,
+    selection-action and screenshot-lifecycle probes and records the paired
+    baseline; it does not change production behavior.
+
+## 2. Dependency model and publication
+
+### 2.1 Current resolved family
+
+`Cargo.toml:55-59` pins `eframe`, `egui`, `egui_kittest` at `0.36`;
+`crates/ui-egui/Cargo.toml:33` pins `egui_extras` `0.36`;
+`crates/ui-egui/Cargo.toml:73` pins `epaint_default_fonts` `0.36`;
+winit is `=0.30.13` (`apps/photocraft/Cargo.toml:86`) and the lock resolves
+egui-family `0.36.2`, winit `0.30.13`, wgpu `30.0.1`, accesskit `0.24.1`.
+`craft-ui` is pinned to `5c874d51eeb3de70e735c8ce87a59a7dedd47675`,
+`craft-print` to `3d37da389a3618ab9b76109da11416e9ca4ea719`, and
+`craft-docpath` to `82a24b006eefa036b43c09a67fb9a3fbd17ffe63`
+(`Cargo.toml:13`, `:42-43`).
+
+### 2.2 Target family
+
+Target the whole compatible set together:
+
+| Package | Target | Source |
+|---|---|---|
+| `egui`, `eframe`, `egui-winit`, `egui-wgpu`, `egui_glow`, `egui_extras`, `egui_kittest`, `epaint`, `emath`, `ecolor`, `epaint_default_fonts` | 0.37.0 | one reviewed, published `storytold/egui` full 40-hex final P8 revision containing E1-E21, P2b/P7/P7b/E21b and P7c |
+| `winit` | 0.30.13 | one reviewed, published `storytold/winit` full 40-hex revision containing W1-W27 **and W15P** |
+| `wgpu` | 30.0.1 | registry (unchanged; `egui-wgpu` 0.37 is built for wgpu 30) |
+| `accesskit` / `accesskit_winit` | 0.25.1 / 0.34.1 | registry, pulled by egui 0.37 |
+
+The root workspace needs a `[patch.crates-io]` entry for **each** of those egui-family
+packages and `winit`; patching only `egui` splits the graph. The same revision for all
+egui crates is required because the fork's workspace crates depend on each other by
+path. `epaint_default_fonts` is a build-dependency and must be patched too.
+
+`egui_extras` must be `version = "0.37"`; do not assume crate version numbers match
+the release name (`egui_plot`, if ever added, is independently versioned).
+
+The candidate fork currently uses a **mutable branch**:
+`aiongg/egui` commit `137398e6` sets `winit = { git = ".../aiongg/winit", branch =
+"craft/0.30.13-lang" }`. The plan requires replacing that with an exact `rev`. A branch
+pin is not reproducible and can change between two CI runs.
+
+Pin identities are deliberately split:
+
+- **production pins**: reviewed, published `storytold/egui` and `storytold/winit`
+  full SHAs, reachable from the public URLs, carrying every selected E/W patch,
+  E21b and W15P, with `PATCHES.md` and removal conditions;
+- **research controls**: upstream `0.37.0` (`841a328b...`), upstream `0.36.2`
+  (`49682f8b...`), aiongg `a4f9a17f...`/`8b35388b...` and any stock-only experiment
+  used to attribute #8731/#8736. These are benchmark controls and are never a
+  staged release, a consumer pin or a rollback baseline.
+
+### 2.3 Targets and feature matrix
+
+| Target | Package / binary | egui work |
+|---|---|---|
+| Desktop app | `photocraft` binary (`apps/photocraft`) | eframe 0.37 native, wgpu, accesskit, wayland, x11, persistence, clipboard; no `default_fonts`, no `system_fonts` in the first cut |
+| Browser app | `photocraft-web` binary (`apps/photocraft-web`) | eframe web 0.37, wgpu (WebGPU + WebGL2), accesskit; browser glyph rasterizer; `web_file` |
+| Browser bootstrap | `photocraft-web-boot` binary | no egui dependency; only wasm-bindgen/web-sys; keep out of the UI changes |
+| Headless CLI | `photocraft-cli` | no egui dependency; control bridge/MCP only |
+| UI library | `photocraft-ui-egui` | egui 0.37, eframe 0.37 (wgpu + accesskit + clipboard), `egui_extras` 0.37 (svg), `craft-ui` at the reviewed PR 199 port |
+| Tests/benches | `crates/ui-egui/tests/it`, `examples/*`, `photocraft-testkit` | kittest 0.37 (wgpu, snapshot, eframe), `snapshot`, `perf_scenarios`, `interactive_bench`, `fx_bench`, `bevel_bench`, `camera_raw_bench`, `type_bench`, `large_image_bench`, `large_file_bench` |
+| Platform helper | `photocraft-tablet` | no egui dependency; keep its winit-independent X11/AppKit/Windows path; E1 is only an enabler for a future native Wayland pen |
+
+`apps/photocraft` is the only target with the direct Linux `winit` dependency
+(`=0.30.13`, x11 feature, for `EventLoopBuilderExtX11`). It must resolve to the
+same patched winit revision as eframe. `apps/photocraft-web` must not add a
+native winit dependency.
+
+### 2.4 Manifest and workspace audit
+
+- The root workspace is `resolver = "3"`, edition 2024, MSRV 1.95;
+  members are `crates/*`, `apps/*`, `xtask`; default members include the
+  desktop app, CLI and xtask (`Cargo.toml:1-6`).
+- `crates/*/fuzz/Cargo.toml` are independent fuzz workspaces. None depends on
+  egui, eframe, winit, epaint or craft-ui; no change is expected. Verify with
+  `rg` after the bump.
+- `examples/plugins/invert-rs/Cargo.toml` is a separate `[workspace]` for a
+  wasm plugin and has no UI dependency.
+- `apps/photocraft-web-boot` and `apps/photocraft-cli` have no egui dependency.
+- There is no `vendor/` directory, `[source]` replacement, or machine-local
+  `.cargo/config.toml` patch in this checkout. The only `.cargo/config.toml`
+  defines the `xtask` alias. Do not introduce a vendor tree for this migration.
+- `[profile.wasm-release.package.egui|epaint|eframe]` entries remain valid
+  because the package names do not change; re-check wasm size after the bump.
+
+### 2.5 Publication and rollback
+
+Publication gates, in order:
+
+1. Canonical public `storytold/egui` `craft/0.37` revision, one commit per E-patch
+   (including E21b), with `PATCHES.md`, tests and removal conditions.
+2. Canonical public `storytold/winit` `craft/0.30.13` revision, one commit per W-patch
+   (including W15P), with `PATCHES.md`, tests and removal conditions.
+3. `storytold/craft-libs` revision on `main` containing only the reviewed port
+   hunks (`8614e4a`/`1764bca`) applied to current `main`. Do not pin a PR ref or
+   merge the stale `b68de8c`/`ec8840a` trees.
+4. PhotoCraft PRs below, each with a `Cargo.lock` generated by `--locked` resolution
+   from the public revisions.
+
+Rollback is the previous coherent pair: old `Cargo.lock` plus the 0.36.2 registry
+family and winit 0.30.13. Keep that exact lockfile under evidence before the first
+bump. A revert of the dependency commit restores the source graph.
+
+Persistence is not symmetric. The `PanelState` migration is additive: the old
+`Id::unique(name)` key remains in `ui.ron` and 0.36.2 continues to read it. The
+`WindowSettings` rewrite is **one-way**: 0.36.2 cannot deserialize the nested
+`normal_geometry` value and opens with default geometry after a rollback. The first
+0.37 run therefore keeps a pre-migration `ui.ron.pre-0.37` backup, and the plan
+documents the window-geometry/position loss rather than calling both migrations
+additive. Add a reverse-compatibility test with a 0.36-shaped settings struct and
+fixtures for old macOS `inner_position_pixels`, old outer position, maximized and
+fullscreen.
+
+Reachability checks before publication:
+
+- `git ls-remote` returns the exact revision from the public URL.
+- `cargo tree -d` shows one egui, one eframe, one winit.
+- `rg 'path\s*=\s*"/' Cargo.toml` is empty.
+- Every `[patch]` URL is `https://github.com/storytold/...` with `rev = "<40 hex>"`.
+
+## 3. What the source actually does
+
+### 3.1 Native entry point
+
+`apps/photocraft/src/main.rs:720` calls `eframe::run_native`. The app creator
+installs fonts/theme through `PhotocraftApp::setup_context`
+(`crates/ui-egui/src/lib.rs:2850`), attaches the GPU canvas, control server,
+native menu, single-instance service and platform services, then returns
+`PhotocraftApp`.
+
+`native_options` (`apps/photocraft/src/main.rs:104`) sets a custom viewport,
+`persistence_path` `ui.ron`, and a `window_builder` hook `restored_window`
+(`:132`) that enforces minimum size and disables restored fullscreen.
+`options.centered` is decided from `ui_state::has_saved_position`
+(`apps/photocraft/src/main.rs:667`, `apps/photocraft/src/ui_state.rs:33`).
+
+`gpu_startup` configures `options.wgpu_options`; `presentation` applies present
+mode and frame-latency overrides. `eframe::Error::Wgpu(_)` is the signal for the
+CPU-retry path (`apps/photocraft/src/main.rs:934`,
+`apps/photocraft/src/gpu_startup.rs:477`). E2/E3 add `WgpuError::ConfigureSurface`
+and `CreateRenderer`; the existing `Error::Wgpu(_)` match keeps working, but the
+retry decision must be tested with the new variants.
+
+### 3.2 Web entry point
+
+`apps/photocraft-web/src/web.rs:47` starts `eframe::WebRunner`. `WebShell`
+implements `raw_input_hook`, `logic` and `ui` (`:325`, `:332`, `:362`); its
+`logic` drains dropped files, serves fonts, calls the app's `logic`, and saves
+presets. Its `ui` adds a browser preset-storage banner and calls the app's `ui`.
+
+`apps/photocraft-web/index.html` is Trunk-based and the wasm is gzipped and split
+into parts by `packaging/web/package.sh`. Its 24 MiB limit applies to **each shipped
+file**, not to the raw wasm; the boot module inflates the parts. 0.37 adds
+`send_wrapper` and changes `epaint`/`vello_cpu`; the raw wasm and the gzipped total
+must both be measured against baseline, not assumed to fit a raw-wasm cap.
+`docs/development.md:459` is the reference.
+
+### 3.3 Logic versus UI, and the pass model
+
+The pass model is the one verified in
+`/home/codex/work/ssd2/task-evidence/egui037-migration-20261022/lifecycle-source-audit.md`
+against 0.37.0:
+
+- Native (`crates/eframe/src/native/epi_integration.rs::update`) and web
+  (`crates/eframe/src/web/app_runner.rs`) both call `App::logic` and `App::ui`
+  **inside `Context::run_ui`**. Each can run once per layout pass, and
+  `request_discard` adds passes. Logic is not once per rendered frame.
+- A hidden/occluded window may be ticked through `update_logic_only` ->
+  `Context::run_logic`. That path still calls `prepare_raw_input` and
+  `App::raw_input_hook`, but does **not** begin a pass: `ctx.input().events`,
+  `time`, `screen_rect` and viewport geometry remain from the previous UI pass.
+  `ViewportCommand::RequestPaintWhileHidden` can force a real UI pass while
+  `visible()` is false, so visibility does not identify a logic-only callback.
+- After a normally completed `run_ui`, `current_pass_index()` is zero because
+  `end_pass` takes the output. Do not build a first-pass guard on a stale nonzero
+  index. A guard may protect genuinely once-per-layout-frame work only with a
+  regression proving normal hidden calls still run; it must not suppress fresh
+  async results, control commands or widget actions.
+
+Consequences for PhotoCraft:
+
+`PhotocraftApp::logic` (`crates/ui-egui/src/lib.rs:2244`) does stateful work that
+must survive a hidden window: frame accounting, `sync_views`, GPU checks, control
+drain, native menu, commit/end operations, screenshot issue/collect, preferences
+tick, monitor polling, i18n sync, work-area fit, close guard, job tick, shortcuts,
+file drops, file dialogs. Because it runs per pass, every item must consume its
+queue once, use a revision/generation or monotonic deadline, and tolerate a
+second pass with no new input. `self.frame += 1` (`:2257`) is a logic-pass count,
+not a rendered-frame identity; screenshot settling and GPU startup checks must use
+`ctx.cumulative_frame_nr()` (or an equivalent UI-phase rendered-frame counter).
+
+`PhotocraftApp::ui` (`:2371`) draws panels, windows, dialogs, notices and the
+central canvas, and does UI-local persistence (`brush_picker::persist`,
+`last_brush::persist`, `tool_memory::persist`, `view_cmds::persist`) plus
+`native_menu::sync`, `gpu_status::check_window`, and the current synthetic-input
+wakeup. Re-running a sizing pass must not duplicate persistence, commands or
+notices; move work that must happen with no paint to `logic`, and make the rest
+idempotent.
+
+`raw_input_hook` (`:2338`) normalizes synthetic input, clipboard key events,
+legacy pinch, pen-hold, titlebar resize and stroke tracing. It runs for the root
+and deferred viewports, not immediate viewports (unless E1 is installed), and it
+also runs before a hidden `run_logic`. `take_synthetic_step` (`:2356`) removes
+events from the app queue even on a logic-only tick; eframe preserves the events it
+appends in `pending_raw_input`, but PhotoCraft must set a `synthetic_in_flight`
+flag in the hook and send `RequestPaintWhileHidden` from `logic` (which runs
+after the hook in the same tick) so a UI pass consumes them. Do not start stroke
+tracing or interpret fresh input as if a paint occurred: either gate it on that
+flag or move the start to `App::ui`. `egui-winit` turns
+Cmd/Ctrl+C/X/V into `Event::Copy`/`Cut`/`Paste`; PhotoCraft maps those back to key
+presses in `shortcuts::clipboard_keys` (`crates/ui-egui/src/shortcuts.rs:282`).
+
+### 3.4 Panels, docking and the root Ui
+
+The root Ui is passed to `App::ui`; panels are shown on it:
+`panels::title_bar` (`crates/ui-egui/src/panels.rs:592`),
+`options_bar` (`:969`), `status_bar` (`:1726`), `toolbar` (`:93`),
+`right_dock` (`:1792`), and `dock_panels` (`:1866`). The custom docking surface
+uses `craft_ui::docking::DockArea` with the stable ID
+`photocraft-panel-docking` (`crates/ui-egui/src/panel_docking.rs:424`) and an
+`egui::Panel::right("shared-panel-dock")` (`:448`).
+
+`craft_ui` is a real runtime dependency (`panel_docking.rs:4-5`,
+`tab_strip.rs:11`), not a stale manifest entry. `craft_ui`'s docking and tab
+components are in the 0.37 API blast radius; PR 199 is required.
+
+### 3.5 Fonts and text
+
+`theme::install_fonts` (`crates/ui-egui/src/theme.rs:847`) builds a
+`FontDefinitions` from `egui_fonts::definitions`, prepends Inter/JetBrains Mono,
+adds named `medium`/`semibold` families, scales faces with `UiFontSizePlugin`
+(`:946`), calls `ctx.set_fonts`, then installs the lazy CJK/script fallback
+(`crates/ui-egui/src/cjk_fonts.rs:352`, `:375`). The fallback is app-specific:
+script order follows the UI locale, reads at most one system font per frame, and
+tracks its own `tried`/`loaded` state. It reads system fonts even when eframe's
+`system_fonts` feature is off, so #8512's discovery cost is still on PhotoCraft's
+startup/first-use path and must be measured separately.
+
+`cjk_fonts::add_to_all_families` reads `FontData.font` as bytes
+(`cjk_fonts.rs:354`, `:355`, `:358`) and a test compares the pointer
+(`:879`). In 0.37 `FontData.font` becomes
+`Arc<dyn AsRef<[u8]> + Send + Sync>` (`epaint::text::FontData`), so those four
+uses do not type-check as written.
+
+### 3.6 Screenshots and control
+
+`control.rs:1265` handles `ui.screenshot`; `PhotocraftApp::drain_control`
+(`lib.rs:2156`) queues `(token, earliest_time, frames)` in
+`queued_screenshots`; `issue_screenshots` (`:2183`) sends
+`ViewportCommand::Screenshot(UserData::new(token))`; `collect_screenshots`
+(`:2196`) reads `Event::Screenshot { user_data, image }` and calls
+`control::save_screenshot` (`control.rs:1410`). This is exactly the API 0.37
+removes: `ViewportCommand::Screenshot` now takes a `ScreenshotCallback`, and
+`Event::Screenshot` / `UserData` no longer exist. The current records are removed
+only by a matching callback, so a zero-sized surface, hidden viewport, device
+loss or dropped capture leaves the reply pending until the 60 s deadline and
+retains its image path. Section 9.3 replaces that with a bounded, cancelable
+slot and an explicit timeout drain.
+
+### 3.7 Persistence
+
+`ui.ron` contains two independently versioned payloads:
+
+- eframe window geometry, restored by `egui_winit::WindowSettings`;
+- egui memory, including `PanelState` entries and persisted widget data.
+
+`apps/photocraft/src/ui_state.rs` sanitizes the file before eframe reads it and
+decides whether a saved position exists. `saved_position` is platform-dependent:
+macOS looks for `inner_position_pixels`, everywhere else for
+`outer_position_pixels` (`ui_state.rs:41-44`). 0.37 replaces the flat
+`WindowSettings` with `normal_geometry: WindowGeometry` containing
+`outer_position_pixels`, `scale_factor` and `inner_size_points`. The old value
+does not deserialize, eframe ignores it, and a top-level probe becomes a false
+positive: the window opens uncentered at the OS default. Section 9.2 specifies the
+explicit pre-load rewrite and the new platform-independent position key.
+
+`PanelState` is keyed by an `Id`. In 0.36 `Panel::left("dock")` used
+`Id::new("dock")`; in 0.37 the panel ID is
+`parent_ui.scope_id().with_salt(IdSalt::new("dock"))` (`Id::with`, not
+`Id::with_salt` + an `AsIdSalt`). For the root Ui that is
+`ctx.viewport_id().root_ui_id().with(salt)`. Existing saved panel widths are under
+the old IDs and will not be restored unless migrated. Tests that read
+`PanelState::load(&ctx, Id::unique("dock"))` also break
+(`apps/photocraft/src/main.rs:1004`, `crates/ui-egui/src/panels.rs:6604`,
+`:6934`, `crates/ui-egui/src/workspace_ui.rs:594`,
+`crates/ui-egui/src/panel_docking_tests.rs:569`). `Id::unique(name)` has the same
+hash as the old `Id::new(name)`, so the old key can still be read.
+
+### 3.8 Tests and performance infrastructure
+
+The repository already has the right harnesses:
+
+- `crates/ui-egui/examples/snapshot.rs` renders the full UI offscreen with
+  `egui_kittest` + wgpu, deterministic `RendererOptions`, scripts, themes and
+  scales.
+- `crates/ui-egui/src/panel_docking_tests.rs:179` captures theme/width/scale
+  docking fixtures when `CRAFT_UI_DOCKING_FIXTURES` is set.
+- `crates/ui-egui/src/panels.rs:6904` captures compact chrome fixtures under
+  `CRAFT_UI_VISUAL_FIXTURES`.
+- `perf/budgets.toml` maps P1…Pn rows to `perf_scenarios`, `interactive_bench`,
+  `fx_bench`, `bevel_bench`, `camera_raw_bench`, `type_bench`,
+  `large_image_bench`, `large_file_bench`, plus the new `text_tessellation`
+  row; `xtask perf` runs them in release and writes p50/p95 (and p99 for frame
+  rows with enough samples), peak RSS, GPU bytes and load averages.
+- `crates/ui-egui/tests/it` has wgpu kittest tests for canvas, GPU loss,
+  color management, exports and workspace presets.
+- `apps/photocraft/tests/mac_menu_appkit.rs` is the existing real-macOS menu
+  check; it is not a substitute for IME/focus testing.
+
+There are 481 `Harness::builder()` uses (source count at
+`ff473881`). They will inherit 0.37's `check_accessibility: true` and
+`missing_glyph_policy: Panic` (`egui_kittest/src/builder.rs:50-51`). Both defaults
+are good, but they turn latent UI defects into test failures. The minimal
+accessible-name, glyph-policy and feature fixes therefore belong in the first
+green PR; do not disable either check globally and do not defer them to a later
+fixture sweep.
+
+### 3.9 Multiple viewports
+
+PhotoCraft creates extra document windows with
+`ctx.show_viewport_immediate(ViewportId::from_hash_of(("docwin", w.id)), ...)`
+(`crates/ui-egui/src/canvas.rs:6551`). These are immediate viewports, not deferred
+ones. The implications are:
+
+- `App::raw_input_hook` does not run for immediate viewports; E1's
+  `ViewportHooks::raw_input` is the only per-viewport hook that does. PhotoCraft
+  has no consumer today, but the extra-window path must be tested with E1 present
+  and absent.
+- The root-only services (`tool_cursor`, `monitor_status`, `caps_lock`, screenshot
+  capture, control server) correctly guard on `ViewportId::ROOT`
+  (`tool_cursor.rs:103`, `monitor_status.rs:274`); do not accidentally make them
+  viewport-global.
+- #8748 (hidden-parent deferred children) is **closed and unmerged**, so it is not
+  behavior in 0.37.0. PhotoCraft has no `show_viewport_deferred` call sites
+  (`canvas.rs:6551`, `screen_picker.rs:296`, `camera_raw_ui.rs:1224` are all
+  `show_viewport_immediate`), so the upstream deferred-child bug is not directly
+  applicable. Still test the hidden/occluded root plus an immediate child's
+  open/update/close, because that is the path PhotoCraft actually uses.
+- `ui.screenshot` is documented as main-window only (`docs/control-protocol.md`);
+  do not promise child-window screenshots in 0.37.
+- Extra windows use the same `PhotocraftApp` state; a pass for a child viewport
+  may call `canvas_view` while the root UI is not being drawn. Keep document
+  mutation and undo transactions inside `logic` or the existing single-window
+  paths; test open/close of an extra window during a stroke, a dialog and a
+  screenshot request.
+
+### 3.10 Platform cfg inventory
+
+The migration can compile on one platform and still break another; these cfg
+boundaries need an explicit check:
+
+- Native-only: `sys-locale`, `rayon`, `winsafe`, `xcap`, `x11rb`, `wl-clipboard-rs`,
+  `zbus`, `muda`, `dispatch2`, `fmv-macos-events`, `core-graphics2` in
+  `apps/photocraft` and `crates/ui-egui`.
+- macOS: `apple_events`, `mac_menu`, `mac_window`, `muda`, `dispatch2`,
+  `objc2*`, `photocraft-tablet::macos`, `tests/mac_menu_appkit.rs`.
+- Windows: `window_frame`, `cursor`, `photocraft-tablet::windows`,
+  `photocraft-ipp`, `winsafe`.
+- Linux: `portal_save`, `print_portal`, `icon_theme`, `tablet::spawn_x11`,
+  `linux_libs`, `winit` x11 event-loop builder.
+- wasm32: `apps/photocraft-web/src/web.rs`, `cjk_fonts::Sources::system` (no
+  system fonts), `file_ui/web_preview.rs`, `gpu_canvas` web adapter limits,
+  `photocraft-web-boot`.
+
+At minimum run `cargo check --target wasm32-unknown-unknown` (`cargo xtask
+wasm`), Linux native, Windows native and macOS native for the changed crates.
+Do not treat a Linux-only compile as platform acceptance.
+
+## 4. 0.37 breaking changes mapped to PhotoCraft
+
+| Change | PhotoCraft impact and exact work | Count / anchor |
+|---|---|---|
+| `WidgetType` is now a deprecated alias of `accesskit::Role`; many variants were renamed (`SelectableLabel→Button`, `Checkbox→CheckBox`, `ColorButton→ColorWell`, `CollapsingHeader→DisclosureTriangle`, `Other→Unknown`) | Mechanical mapping. `Button→Button`, `SelectableLabel→Button`, `CheckBox→CheckBox`, `RadioButton→RadioButton`, `Label→Label`, `Image→Image`, `CollapsingHeader→DisclosureTriangle`, `ComboBox→ComboBox`, `ColorButton→ColorWell`, `Slider→Slider`, `Other→Unknown`. Keep selection in `WidgetInfo::selected`. | 114 uses in 43 files, e.g. `shape_stroke_ui/editor.rs:47`, `props_layout.rs:73`; PR 199's mapping is the reference |
+| `Id::new` deprecated | `Id::new` → `Id::unique` (same hash; persisted IDs stay stable). | 394 uses in 121 files |
+| `Ui::id` deprecated | `ui.id()` → `ui.scope_id()` (a rename of the old id). Do **not** substitute `Ui::unique_id`: that is a new globally unique but unstable id used for auto ids and AccessKit identity. | 93 uses |
+| `Panel` constructors take `AsIdSalt`; IDs become parent-scoped | `direction.rs:71/76` currently takes `impl Into<egui::Id>` and passes it to `Panel::left`; change to `impl egui::AsIdSalt`. Add `panels::panel_state_id(ctx, salt) = ctx.viewport_id().root_ui_id().with(salt)` (`Id::with`, because `with_salt` takes an `IdSalt`). Migrate old `PanelState` keys in the first compatible PR and keep the old key readable. | 11 direct panel constructors; 5 `PanelState::load` sites |
+| `UiBuilder::id` → `scope_id` | No PhotoCraft call sites; `craft_ui` PR 199 has two. | `craft_ui/docking/surface.rs` |
+| `TextEdit::hint_text` requires `IntoAtoms<'static>` | `widgets::text_field`/`text_field_ex` take `hint: &str` and pass it directly; `crop_size::text_field` does too. Convert to owned atoms once (`hint.to_owned()`) or change the helper parameter to `impl IntoAtoms<'static>` and update callers. | `widgets.rs:848`, `crop_size.rs:282` |
+| `FontData.font` is a `Blob` (`Arc<dyn AsRef<[u8]>>`) | Use `data.bytes()` or `data.font.as_ref().as_ref()`; update pointer test. | `cjk_fonts.rs:354`, `:355`, `:358`, `:879` |
+| `ViewportCommand::Screenshot` callback; `Event::Screenshot`/`UserData` removed | Replace `issue_screenshots` with a bounded, cancelable per-request completion slot (section 9.3), not an unbounded `mpsc` channel. The callback holds only a weak slot reference, stores only the image, and may run on an arbitrary callback thread. Collect in `logic`; use rendered-frame identity plus a monotonic settle deadline; keep token correlation. `clipping_indicator_tests.rs:94/:99` also use the removed API and must be migrated in the same PR. | `lib.rs:2183`, `:2196`, `:2214`; `control.rs:1265`; `clipping_indicator_tests.rs:94`, `:99` |
+| `Event::PasteImage` new | egui-winit now emits image paste when the clipboard has no text. PhotoCraft's `clipboard_press` only maps `Event::Paste(_)`. Adopt it as the document paste shortcut through the existing `import_os_clipboard`/session path, never a second clipboard read; a test asserts one import and no text-paste double handling. | `shortcuts.rs:221`, `:282` |
+| `Event::MiddleClickPaste` new | Text fields handle it; verify PhotoCraft's canvas/field interaction does not double-handle it. | `shortcuts::clipboard_keys` |
+| `ScrollAreaState.offset` field private; `offset()` deprecated | Replace reads with `clamped_offset()`/`unclamped_offset()`. Replace the direct write `st.offset.y = target` with a request passed to `ScrollArea::vertical_scroll_offset` on the next frame, then clear the request. | `menu_nav.rs:504`, `:535`; `field_wheel.rs:173-174` |
+| `egui-winit` clipboard feature is no longer implicit in eframe when default features are off | Add `clipboard` to the `eframe` feature list in the app and ui-egui. Without it, OS copy/paste silently falls back to an in-app-only clipboard. | `apps/photocraft/Cargo.toml:32`, `crates/ui-egui/Cargo.toml:34` |
+| `system_font_fallback` defaults true | Workspace `eframe` has default features off, so the provider is only the "missing system fonts" warning. Set `NativeOptions::system_font_fallback = false` explicitly to preserve the existing CJK plugin and deterministic rendering; evaluate `system_fonts` separately. | `main.rs:104` |
+| `default_fonts` is no longer default; emoji fonts are feature-gated; `egui-icons` is new | Add `monochrome_emoji_fonts` to the `epaint_default_fonts` build-dependency; deflate `EGUI_ICONS`; rebuild the family stack exactly as 0.37 does (Ubuntu-Light, egui-icons, NotoEmoji, emoji-icon-font; Hack first for monospace). Update the equality test. No new font file is committed; verify `ATTRIBUTION.md` needs no row, and add one in the same PR if a packaged asset is added. | `build.rs:37-45`, `egui_fonts.rs:47-56`, `:79` |
+| `Ui::id`/`Id` semantics in tests | kittest queries by IDs still work after `Id::unique`; panel-state queries do not. `Ui::unique_id` is unstable and must not become a persisted/test key. | see persistence above |
+| `AccessKit` role/label checks in kittest | Add `Response::labelled_by`/`accessible_name` where a field has no hint; keep `check_accessibility` on. These minimal name fixes are in the first green PR because the default check runs on every harness. | all 481 harnesses |
+| `MissingGlyphPolicy::Panic` in kittest | Audit special characters (`✓`, `▲▼`, `▶◀`, `×`, `…`, `⏵`, `⋮`, `egui::special_emojis`) and add a deterministic fallback or `allow_missing_glyphs()` only where tofu is intentional. Enable `monochrome_emoji_fonts`/`EGUI_ICONS` and add the glyph-coverage test in the first green PR. | 481 harnesses |
+| `#8763` TextEdit click-away selection loss | Reproduce select-text-then-click-toolbar/context-action. The fork owns the selected fix (with pointer and keyboard regressions) or a tested app workaround preserving range and undo; do not silently accept. | `widgets.rs`, `text_field_menu.rs`, new kittest/native row |
+| `egui` 0.37 style defaults (roomier buttons, larger radii) | PhotoCraft overrides most `Visuals`/`Spacing` fields in `theme::apply`, but atom-based `Button`/`ComboBox` and popup/table internals still change. Pixel fixtures must be regenerated and reviewed, not blindly accepted. | `theme.rs:995` |
+| `ScrollArea` kinetic/rubber-band defaults | New `ScrollStyle::kinetic`; PhotoCraft's thin scrollbars keep their explicit opacity, but menu wheel/arrow scrolling and canvas pan must be re-tested. | `theme.rs:1065`, `menu_nav.rs` |
+
+## 5. E1–E21 and E21b audit
+
+Base: `841a328b`. The candidate branch is `a4f9a17f`, with one commit per topic
+and `PATCHES.md` at that revision. All rows need a final audit against the
+published commits; the notes below state what PhotoCraft specifically needs.
+
+| # | Change | PhotoCraft relevance and decision | Required evidence / removal |
+|---|---|---|---|
+| E1 | eframe `NativeOptions::viewport_hooks` (per-viewport window create/destroy and raw input, immediate viewports included) | PhotoCraft does not call it today. Keep in the shared fork because craft-tablet's native Wayland pen path needs it; do not claim pen support until craft-tablet consumes it. Verify the global hook storage does not leak between contexts/tests. | Fork unit test for install/replace; PhotoCraft full-suite run; remove when upstream offers equivalent per-viewport hooks or native Wayland pen is solved another way |
+| E2+E3 | egui-wgpu surface fit to `max_texture_dimension_2d`; configure/renderer errors returned as `WgpuError::ConfigureSurface` / `CreateRenderer` | Directly relevant to multi-monitor/large restored windows and `--safe-gpu` fallback. Adopt. Add a test with a synthetic surface size above the adapter limit and a forced configure error; assert no panic and a recoverable error. | `surface_fit` unit tests; PhotoCraft large-window test; remove when upstream closes emilk/egui#8361 and ships an equivalent |
+| E4 | egui-winit uses winit's Wayland clipboard when available; smithay not started; PRIMARY currently falls back to arboard | Regular clipboard/file drops are relevant on Hyprland and require W15, `wayland` and `clipboard`. Adopt the regular path. **PRIMARY is not accepted through arboard**: the default is the shared W15P winit-owned PRIMARY path on the existing connection/event queue and per-seat lifecycle; arboard is only a measured fallback if W15P cannot meet a proven requirement, with compositor evidence and an explicit unresolved gate. | Regular/image/drop tests; W15P PRIMARY matrix on wlroots/KWin/Mutter; remove when upstream #8657 lands |
+| E5 | epaint bidi shaping, visual row order, marks, end caret/selection; word-motion underflow fix; tests without `default_fonts` | Core for Arabic/Hebrew UI labels. Adopt only with E12/E13/E16 and with `bidi_text.rs` removed or reduced; otherwise text is reversed twice. | Arabic/Hebrew label, mixed LTR/RTL, caret/selection tests; remove when #8577 is released |
+| E6 | `request_focus` on the focused widget no longer interrupts IME | Relevant to every text field and Preferences search. Adopt. | IME preedit/commit across focus requests |
+| E7 | Windows letter keys from virtual-key code on non-Latin layouts | Relevant; PhotoCraft has layout-specific symbol logic. Adopt. | Windows layout matrix (Russian/Arabic/Hebrew/German) |
+| E8 | TextEdit no longer clips glyphs above/below the row | Relevant to Thai/Vietnamese/Arabic marks and small fields. Adopt; pixel tests. | Text field row geometry at 1x/1.5x/2x |
+| E9 | `Style::right_to_left` mirrors menus, scrollbars, headers, title bars, combo boxes, checkboxes, popups, resize grips | PhotoCraft already mirrors shell chrome explicitly in `direction.rs`. Enabling E9 while keeping those explicit layouts will double-mirror. Adopt only after a call-site audit; default `right_to_left=false` means it is inert until set. | RTL chrome fixture matrix; remove overlapping `direction` paths |
+| E10 | eframe web: named keys not typed as text; letter keys from `KeyboardEvent.code`; `lang` on hidden input/speech | Relevant to browser shortcuts and IME. Adopt. | Browser keyboard/IME workflow; no wasm size regression |
+| E11 | epaint glyphs rasterized on a single-threaded vello context (fixes `vello_cpu` multithreading panic) | PhotoCraft does not enable `epaint/multithreading`; forcing `num_threads: 0` could slow other consumers. Keep out of PhotoCraft's qualifying revision unless the shared fork requires it; if included, benchmark glyph rasterization and test all fonts. | epaint tests with/without multithreading; perf rows |
+| E12 | `LayoutJob::direction`, RTL right alignment, ellipsis at visual end, UAX #9 L1, linear reorder keeping isolate initiators/PDI/marks | Needed with E5; replaces `bidi_text::visual_ltr` and `elide`. Adopt in the language stage. | Title bar `*صورة.psd — PhotoCraft`, layer-name truncation, bidi controls |
+| E13 | caret/hit-test/Delete/Backspace by grapheme cluster | TextEdit and Type tool. Adopt; the Type tool has its own char-based editor (`type_tool.rs:562`, `:751`, `:964`), which must be audited for combining marks/emoji. | Grapheme deletion/movement tests in both TextEdit and Type tool |
+| E14 | `FontTweak::fallback_align`: fallback fonts on primary baseline, rows grow to fit; default unchanged | PhotoCraft already computes `y_offset_factor` manually. Adopt, but do not set `fallback_align` unless the manual metrics are removed; test row height and CJK/Thai/Arabic baselines. | Font fallback baseline fixtures; `cjk_fonts` tests |
+| E15 | `LineBreaker` trait (`SimpleLineBreaker` preserves rules), grapheme-safe emergency breaks, `LayoutJob::language` | Default preserves behavior; the suite uses it for craft-text line breaking, and E20 uses the language. PhotoCraft document text is parley-based, so the app impact is UI text wrapping/truncation. Adopt; test wrapping/truncation. | Wrapping fixtures with Latin/CJK/Thai |
+| E16 | visual cursor movement with affinity, Home/End in reading order, password mask per cluster, neutral paragraphs inherit direction | Needed for RTL and grapheme editing. Adopt with E5/E12/E13. | Caret affinity tests, mixed-direction paragraphs |
+| E17 | `Context::set_language`, `UiBuilder::language`, `Response::accessible_language`, AccessKit root language, one text run per bidi level | PhotoCraft's `i18n::sync_context` (`i18n/mod.rs:409`) must call `set_language`; add AccessKit language assertions. Adopt. | AccessKit root/label language; screen-reader smoke test |
+| E18 | eframe `Frame::set_ui_language` sets `Context::set_language`; web falls back to `Context::language` | Call from `PhotocraftApp::logic` when the preference changes. Adopt. | Live language switch without losing UI state |
+| E19 | one letter-key rule across Windows/macOS/Linux; `RawInput::keyboard_layout_is_latin` and `latin_layout_chars` | Relevant to non-Latin shortcuts; requires winit W25. Adopt, but keep `layout_keys.rs`'s Photoshop-specific German bracket table and test that the two rules do not fight. | Layout matrix; `layout_keys` tests |
+| E20 | widget text laid out in the language of its `Ui` | Adopt with E15/E17; PhotoCraft's `tl!` remains the source text. | Translated widget labels in AccessKit and layout |
+| E21 | `ImeEvent::DeleteSurroundingBytes`: TextEdit deletes exact bytes an IME replaces, in the commit's undo step | Relevant to macOS press-and-hold/dictation and Wayland IME. Requires winit W26/W27. The candidate emits this on macOS and Wayland only; Windows `ime_delete_surrounding` returns `None`. Restrict E21 acceptance to macOS/Wayland. The enum variant is a compile break for exhaustive matches; `type_tool.rs` has a catch-all but must implement the deletion for the Type tool. Adopt. | macOS/Wayland IME replacement tests; undo one step. A Windows IME row is general coverage, not E21. |
+| E21b | `IMEOutput` gains a bounded logical surrounding-text payload (committed text, UTF-8 byte cursor/anchor, owning widget identity; preedit excluded) and egui-winit sends it through W27 on Wayland | **New prerequisite, not existing E21/W27 capability.** The candidate never calls `set_ime_surrounding_text`; `IMEOutput` has no logical text. Adopt with E21. PhotoCraft's custom Type tool must supply a real model adapter, not `None`: `type_tool::draw_overlay` constructs the `IMEOutput`; use the layer's logical text (`current_text`/`layout`), char-to-byte via `byte_of`, exclude the `preedit` char range, clamp to the 4000-byte payload at char boundaries, remap cursor/anchor bytes, and identify the document+layer+viewport so two windows cannot share a payload. Password fields never supply text; focus loss, no IME and unavailable context clear it. | PhotoCraft adapter plus tests: delete+commit and deletion-only, preedit exclusion, reversed selection, emoji/combining/RTL logical order, caret movement, >4000-byte line, two documents, focus/reset/late serial, multipass final output, one undo; native Wayland predictive/Vietnamese trace. Revert with the custom-editor adapters as one API set. |
+
+The E-patches are **not** a blanket "merge the branch". In particular, E5/E12/E13/E16
+form a dependency cluster; E14/E15/E20 depend on text-layout changes; E9 must not
+be enabled with the current explicit RTL mirroring; E11 has no PhotoCraft consumer.
+E21b depends on E21/W27 and is a separate reviewed change (egui P7b), not a
+retroactive description of E21.
+
+## 6. Winit patch audit and compatibility
+
+Base: upstream `v0.30.13` `e9809ef5`; candidate
+`8b35388b` (storytold `craft/0.30.13` `ffae5198` + W17–W27). W15P is **new
+work** in the reviewed published revision, not part of the candidate; the final
+production pin must include it.
+
+| # | Change | PhotoCraft decision |
+|---|---|---|
+| W1 | Windows 11 `WM_DPICHANGED` suggested rect | Adopt; custom title bar and mixed-DPI drags |
+| W2 | Wayland destroy seat text input only when seat is removed | Adopt |
+| W3 | Windows IME caret from `GCS_CURSORPOS` only when set | Adopt |
+| W4 | Windows hidden maximized windows | Adopt |
+| W5 | X11 focus replacement IME context | Adopt as part of W20; audit whether W20 supersedes and remove W5's refocus path |
+| W6 | macOS `NSTextInputClient` commit flow | Adopt |
+| W7 | macOS discard marked text when IME disabled | Adopt |
+| W8 | macOS emoji picker text as `Ime::Commit` | Adopt |
+| W9 | macOS Korean space not duplicated | Adopt |
+| W10 | macOS first Apple Korean key | Adopt |
+| W11 | X11 server DPI before panel physical DPI | Adopt |
+| W12 | macOS `mouseDownCanMoveWindow` from `movable_by_window_background` | PhotoCraft calls `NSWindow::setMovable(false)` (`apps/photocraft/src/mac_window.rs`) and drags only its own gap; keep suite-wide but not PhotoCraft-required. Verify no regression. |
+| W13 | Wayland pixel/continuous scroll phases report `Moved` | Adopt; zoom/pan latch tests |
+| W14 | macOS opt-in cancelable termination | PhotoCraft quits via `NSApplication terminate:` (`mac_window.rs`); not required, harmless if opt-in. |
+| W15 | Wayland file drops + winit clipboard data device | Adopt; needed by E4 regular clipboard and the app's drop support |
+| W15P | winit-owned PRIMARY selection on the existing connection/event queue, with per-seat `PrimarySelectionManagerState`/device/source/offer lifecycle | **Required shared path.** Distinct PRIMARY protocol object; do not bind a second regular `wl_data_device`. Adopt before E4's PRIMARY acceptance. Keyboard-only focus, serial freshness, owner/seat changes, empty/absent offers, self-paste, canceled/slow transfer, password exclusion and unchanged-selection reclaim policy are native gates on wlroots/KWin/Mutter. |
+| W16 | Wayland pinch/rotation gestures | Defer; PhotoCraft has `wheel_nav::fold_legacy_pinch`, which must be re-tested |
+| W17 | Regression tests for W2/W3/W5–W10/W12/W13 | Adopt with the branch |
+| W18 | Windows hidden system caret for IME | Adopt |
+| W19 | Windows IME `VK_PROCESSKEY` not sent as key press | Adopt |
+| W20 | X11 one input context per window (replaces W5 refocus) | Adopt; resolves W5 duplication |
+| W21 | X11 IME spot after 100 ms quiet | Adopt |
+| W22 | macOS `ImeDocument`, replacement ranges, typed text without composition | Adopt |
+| W23 | macOS ⌘ key names from layout's ⌘ table | Adopt |
+| W24 | `Window::reset_ime()` | Adopt; expose through eframe if a PhotoCraft call site needs it (currently none) |
+| W25 | X11/Wayland `KeyEventExtLatinLayout` | Adopt; required by E19 |
+| W26 | macOS delete replaced text by UTF-8 byte count | Adopt; required by E21 |
+| W27 | Wayland text-input-v3 surrounding text + delete-surrounding | Adopt; required by E21 and E21b. The winit state/serial/payload tests are part of the E21b acceptance, not optional coverage. |
+
+Compatibility notes:
+
+- Winit 0.30.13 is the last 0.30 release; the 0.31 port is not a migration target.
+  The fork must keep the package version `0.30.13` so `=0.30.13` and
+  `egui-winit`'s dependency unify.
+- W14 takes `dpi` from crates.io so git consumers do not get a second `dpi`.
+- The fork's `rwh_06` and `x11`/`wayland` features must remain compatible with
+  `accesskit_winit` and eframe.
+- The app's direct Linux `winit` dependency exists only for
+  `EventLoopBuilderExtX11` (`apps/photocraft/src/main.rs:658`); it must resolve to
+  the same patched revision as eframe's winit.
+- Do not add `wayland-csd-adwaita` here; it is a suite feature decision, not a
+  PhotoCraft migration requirement.
+
+## 7. craft-libs PR 199
+
+PR 199 is an open API-port, not a mergeable tree. Its head
+`b68de8c5f4f1c060904d211a7b1320aa0f7bce78` and the historical audit tree
+`ec8840a` are stale relative to current `main` `49190884278f16c9a9f5823d7698a8ffb5deb062`:
+they omit `craft-platform` and revert security, settings, docking and printing
+fixes. Take only the reusable port hunks from
+`8614e4a04fae516fba16c22b31ff1008cb6be10b` plus the relevant README changes from
+`1764bca` and apply them on current `main`; never merge `b68de8c`/`ec8840a` as
+trees and never revert the intervening fixes.
+
+The relevant `craft-ui` port changes are:
+
+- `crates/ui/src/buttons/mod.rs`: `WidgetType::Button` → `Role::Button`.
+- `crates/ui/src/docking/surface.rs`: `WidgetType` → `Role`, `UiBuilder::id` →
+  `scope_id`, plus a clippy `collapsible_match` fix.
+- `crates/ui/src/layout/resize.rs`, `tabs/mod.rs` and tests: `Id::new` →
+  `Id::unique`, `Ui::id` → `scope_id`, `WidgetType` → `Role`.
+- `crates/ui/Cargo.toml`: `egui_extras`/`egui_kittest` 0.37.
+
+PhotoCraft uses `craft_ui::docking::{DockArea, Layout, Node}`,
+`craft_ui::tabs::{Tab, fit}`, and `craft_ui::layout` in
+`panel_docking.rs`, `tab_strip.rs`, `dock.rs` and `state.rs`. The port must be
+present before PhotoCraft can compile. There is no additional shared UI helper
+needed for the mechanical Role/Id migration: PhotoCraft's `WidgetInfo` calls are
+local and the mappings are direct. Do not invent a compatibility shim in
+`craft-ui`.
+
+Pin policy: update **only** `craft-ui` to the published revision containing those
+port hunks. `craft-print` (`3d37da389a3618ab9b76109da11416e9ca4ea719`) and
+`craft-docpath` (`82a24b006eefa036b43c09a67fb9a3fbd17ffe63`) are not egui
+consumers and keep their current pins; bumping all three to one `main` would pull
+the unrelated printer-name/description change between `3d37da3` and the port. If
+the suite later requires one craft-libs revision, audit that diff and run
+PhotoCraft's print tests before changing these pins. Unaffected local vendors
+(`krilla`, `hayro*`, `lopdf`, `vello_common`) and unrelated source fixes are
+preserved.
+
+## 8. Lifecycle and root-Ui design
+
+### 8.1 Logic and hidden iterations
+
+The verified model is section 3.3, not "logic when hidden, ui when visible".
+Native and web both run logic and ui inside `run_ui`, once per pass; hidden hosts
+may call `update_logic_only`, which invokes `raw_input_hook` and `App::logic`
+without beginning a pass. `run_logic` leaves events, input time and layout stale.
+A forced hidden paint (`RequestPaintWhileHidden`) runs the normal UI phase.
+
+| Work | Current site | Decision |
+|---|---|---|
+| Control requests, synthetic input queue | `logic` `drain_control`; `raw_input_hook` `take_synthetic_step` | Keep the queue in logic. `take_synthetic_step` may consume on a hidden logic tick, so set `synthetic_in_flight` in the hook, send `RequestPaintWhileHidden` from `logic` until a real UI pass consumes the preserved events, and clear the flag in `App::ui` after that pass. Do not use the end of `ui` as the only wake. |
+| Screenshots | `logic` issue/collect | Keep in logic; bounded slot; the screenshot command itself requests paint while hidden, so a hidden screenshot pass is not evidence that synthetic input would have woken the app. Use rendered-frame identity + monotonic settle deadline. |
+| Job polling | `jobs_ui::tick` in logic; `jobs_ui::keep_polling` at end of ui | Move `keep_polling` to logic or call from both. Consume job results by revision/sequence exactly once per pass; a repeated pass must not re-apply a result. |
+| Autosave/recovery | `format::Autosaver` background thread; `on_exit` saves tool memory | Use `std::time::Instant` (or `web_time::Instant`) for intervals and deadlines, never `ctx.input(\|i\| i.time)` in logic. Ensure `on_exit` runs for both renderers. |
+| Preferences/theme/fonts | `logic` syncs language and calls `install_fonts`; `ui` applies theme on first frame | Keep setup in `setup_context` when possible; `logic` must finish setup if the creator did not. |
+| File drops | `logic` drains OS/web inboxes and dropped files | Keep; `RequestPaintWhileHidden` when a drop arrives with no visible frame. |
+| Native menu | `logic` runs menu; `ui` syncs it | `native_menu::sync` is UI-dependent; leave in ui, but queue menu events for the next paint. |
+| GPU status/device loss | `logic` calls `check_gpu`; `ui` calls `check_window` | `check_gpu` stays in logic; `check_window` can stay in ui because it reports a painted frame, not a logic-pass count. |
+| UI-local persistence (`tool_memory`, `last_brush`, `view_cmds`) | end of `ui` | Only runs when UI runs; acceptable because no user edit happened while hidden, but `on_exit` must flush the last state. A second pass must not write twice. |
+
+`shortcuts::handle`, `drain_control`, `file_ui` drops and `jobs_ui::tick` all run
+per pass. Give each a consumed queue (drain once), a revision/generation check, or
+a monotonic deadline; do not count logic calls as rendered frames. Do not start
+stroke tracing or interpret fresh input on a logic-only tick: gate it on
+`synthetic_in_flight`/a real UI phase, or move the start to `App::ui`.
+
+Avoid a blanket `Context` bridge. Use `ctx.input`, `ctx.data`, `ctx.memory` only
+where the existing code already does; do not replay the whole UI from `logic`.
+Do not poll a prior UI event twice in `run_logic`; the events there are stale.
+
+### 8.2 Multiple passes
+
+`Context::run_ui` and `Context::run_pass` share the root Ui; plugins run inside
+`root_ui`. PhotoCraft's `setup_context` registers `CursorLifecycle`,
+`SingleLineDrag`, `TextFieldMenu`, `UiFontSizePlugin`, `CjkFontPlugin`.
+`on_begin_pass`/`on_end_pass` and popup sizing passes can execute content more
+than once per frame. `current_pass_index` is not a durable "first pass" flag: a
+completed `run_ui` leaves it at zero. Guard all side effects in `ui`:
+
+- `self.frame += 1` stays in `logic`, but is a pass count; use
+  `ctx.cumulative_frame_nr()` for rendered-frame delays;
+- control/screenshot queues stay in `logic`;
+- `notices::show` and persistence must be idempotent for repeated content passes;
+- no counters inside popup/window closures that change on a sizing pass.
+
+Action playback (`actions.rs`) and autosave (`format::Autosaver` /
+`RecoveryStore`) are not UI loops: playback advances through engine commands,
+and autosave is a background thread. Still, a playback step must not run twice
+because a menu/popup content closure was re-run, and an autosave request must
+not be duplicated by a repeated `ui` pass. Undo is engine-owned
+(`photocraft-engine` history); the rule is one user action → one command → one
+history step, never a command in a sizing pass with no user event.
+
+Add tests for: a forced popup sizing pass (`Popup::sizing_pass`) with unchanged
+document, undo stack and control replies; a playback step whose dialog content
+pass repeats with unchanged step/history counts; a forced second `ui` pass with
+one command; and a background completion between passes applied once.
+
+### 8.3 Hidden-window and control input
+
+`ui.pointer` and `ui.key` must work while the window is occluded or minimized.
+Screenshots must work while occluded; while *minimized* the window has no surface
+that can be trusted, so the request fails with an actionable "the window is
+minimized" error instead of saving a blank/stale surface. The minimized flag is
+part of the geometry epoch, so a minimize/restore between issuance and collection
+retries. Send `ViewportCommand::RequestPaintWhileHidden` when synthetic input
+is in flight, `input_waiters` is non-empty, or a screenshot/control reply waits on
+a pass. Keep the existing reply deadlines (60 s) and `Dispatch`/`AfterInput`
+semantics. A hidden window must not turn a queued request into a `timeout: not
+run` error.
+
+Test the real host order, not a once-per-frame fiction:
+
+- visible single- and multi-pass frames;
+- repeated hidden `update_logic_only` ticks after a completed multi-pass frame;
+- a hidden forced UI paint with queued synthetic input, then a visible pass;
+- a background completion between passes, applied once;
+- bare `run_logic` followed by `run_ui` proving stale input is not replayed.
+
+Screenshots request their own paint; a passing hidden screenshot does not prove
+`RequestPaintWhileHidden` for synthetic input. The mutation check for that is
+section 13.6.
+
+## 9. Panels, docking and screenshots
+
+### 9.1 Panel state
+
+0.37 derives a panel id from its parent scope: for the root Ui,
+`ctx.viewport_id().root_ui_id().with(salt)`. `Id::with` takes an `AsIdSalt`;
+`Id::with_salt` takes an `IdSalt`, so the v1 helper's `with_salt(salt)` did not
+compile. Add one helper in `panels.rs`:
+
+```rust
+pub fn panel_state_id(ctx: &egui::Context, salt: impl egui::AsIdSalt) -> egui::Id {
+    ctx.viewport_id().root_ui_id().with(salt)
+}
+```
+
+Add a compile-level unit test for the helper (and for the `direction.rs`
+`AsIdSalt` bounds), then use it in `main.rs:1004`, `panels.rs:6604`,
+`panels.rs:6934`, `workspace_ui.rs:594`, `panel_docking_tests.rs:569`, and in an
+idempotent first-frame migration:
+
+```rust
+for name in ["dock", "title_bar", "options_bar", "status_bar", "toolbar", "rail", "shared-panel-dock"] {
+    let new_id = panel_state_id(ctx, name);
+    if PanelState::load(ctx, new_id).is_none() {
+        if let Some(old) = PanelState::load(ctx, egui::Id::unique(name)) {
+            ctx.data_mut(|d| d.insert_persisted(new_id, old));
+        }
+    }
+}
+```
+
+This migration belongs to the **first compatible PR**: it is the same PR that
+changes the constructors to `AsIdSalt`. The old `Id::unique(name)` key (same hash
+as the old `Id::new(name)`) stays untouched, so 0.36 rollback still reads panel
+widths; the new key is what 0.37 reads. `Ui::scope_id` is the renamed old
+`Ui::id`; `Ui::unique_id` is unstable and must not be used for a persisted key.
+Test old and new `ui.ron` fixtures, including a real 0.14.0 save with `dock`
+width 410 and `shared-panel-dock` 290; then resize in 0.37, save and restart twice,
+asserting the new width survives even though the old key remains. Also test the
+helper/old-key equality and partially migrated state; existing new keys always win.
+
+### 9.2 Window settings
+
+Current `ui_state.rs` reads the old flat schema and is platform-dependent:
+macOS checks `inner_position_pixels`, others `outer_position_pixels`
+(`ui_state.rs:41-44`). 0.37's `WindowSettings` is:
+
+- `normal_geometry: { outer_position_pixels, scale_factor, inner_size_points }`
+  (`inner_size_points` is a plain `Vec2`, not `Option<Vec2>`);
+- `fullscreen`, `maximized`.
+
+The old value does not deserialize into 0.37. Merely "understanding both schemas"
+is insufficient because eframe reads the file before PhotoCraft runs. Add an
+explicit pre-load rewrite in `ui_state::sanitize` (called from
+`apps/photocraft/src/main.rs:664` before `run_native`):
+
+1. Parse the outer map of key -> RON string; leave a non-RON file alone.
+2. If `window` is the old flat schema, write a new `normal_geometry` value:
+   preserve valid `Some(inner_size_points)` using pattern matching (never `unwrap`);
+   when missing, use PhotoCraft's existing configured default 1440×900 points (`native_options`, `main.rs:110`) and
+   record that fallback; reject non-finite/oversize values without rewriting,
+   `fullscreen`, `maximized`; set `scale_factor = 1.0` for the Windows position
+   path. Preserve `outer_position_pixels` only on Windows (physical pixels; 0.37
+   re-applies the physical position after creation). On macOS/Linux drop the old
+   position and let the window center: the old macOS `inner_position_pixels` is
+   not an outer position, and the old file has no scale factor for a logical
+   Linux restore. Never guess a scale factor or move the window after first paint.
+3. Keep a one-time `ui.ron.pre-0.37` backup before rewriting; log and leave the
+   file untouched if the rewrite fails.
+
+`has_saved_position` must look for `normal_geometry.outer_position_pixels` on
+every OS and return true only when eframe actually restores that position (the
+Windows path). It must stop looking for macOS `inner_position_pixels`.
+
+Fixtures: old macOS inner position, old Windows/macOS outer position,
+maximized and fullscreen, a `Some`/missing `inner_size_points`, and 0.36-schema
+round-trip. Test that `(616,430)`/`1100x760` yields a 1100x760 window without a
+startup failure, and that macOS/Linux center while preserving size/maximized/
+fullscreen. Document the rollback loss: after 0.37 writes the nested schema,
+0.36 ignores the window entry unless the backup is restored; add a
+reverse-compatibility test using a 0.36-shaped settings struct.
+
+### 9.3 Screenshot callback
+
+Replace the UserData/Event path with a **bounded, cancelable per-request
+completion slot**, not one unbounded `mpsc` channel per request. Use the shared
+`craft-ui` capture-slot API at the approved CL-2F revision, a P0/P1 prerequisite.
+There is no local-slot alternative for PhotoCraft. Keep tokens,
+paths, settle delays, deadlines and reply schemas app-owned.
+
+Design:
+
+```text
+PendingCapture record (app-owned)
+  token, path, reply, deadline, issued_at, viewport_id,
+  document/revision generation,
+  issued_geometry: { logical_rect, pixels_per_point, expected_surface_size, geometry_epoch },
+  slot: Arc<CaptureSlot>               // bounded, one result, canceled flag
+CaptureSlot
+  result: Mutex<Option<Arc<ColorImage>>>,
+  canceled: AtomicBool,
+  wake: egui::Context                  // live record only
+callback = move |image| {
+  let Some(slot) = weak_slot.upgrade() else { return }; // late/canceled: drop image
+  if slot.store_if_pending(image) { slot.wake.request_repaint_of(viewport_id); } // after unlock
+}
+```
+
+- The callback holds only `Weak<CaptureSlot>`; the live record holds the `Arc`.
+  The slot may hold a `Context` clone for wakeup, but the callback must not hold a
+  `Context`, `PhotocraftApp`, the pending record, or a channel sender. No
+  callback -> Context -> callback cycle.
+- Admit at most 4 pending requests, at most 128 MiB of image bytes per request and
+  256 MiB in aggregate across reserved in-flight and completed images. Use checked
+  width × height × 4 arithmetic and reject before issuance with a clear size/queue
+  error. Test equality and one-over boundaries, arithmetic overflow and cancellation
+  releasing capacity. Transient GPU readback/encoder RSS is measured separately;
+  a late oversized result is dropped, not counted as proof of a pre-allocation bound.
+- The callback supplies pixels only, not frame metadata. Record issuance geometry
+  from the target viewport's UI and a monotonically increasing geometry epoch (resize,
+  DPI/zoom/surface changes), plus document/revision identity. Revalidate before issuing
+  and before saving. Any intervening epoch change, even a change back to the original
+  size, rejects/retries within the deadline; never label the image with guessed geometry.
+  If the epoch is unchanged, derive x/y pixel scale from returned image dimensions
+  versus the recorded logical bounds, check aspect/rounding and apply region cropping
+  with those scales. E2 can fit the surface smaller. Do not use current DPI alone to
+  label an older image. A native resize/DPI race must show that stale metadata cannot
+  produce a saved image; callback-only tests assert the same rejection policy.
+
+- On timeout/close/cancel, mark the slot canceled and drop the record; a late
+  callback upgrades `Weak` to `None`, drops the image, writes no file and sends
+  no reply. There is no "late file/reply" path.
+- Keep PNG encoding and the existing `ColorImage` -> PNG path on the app/UI
+  thread in `control::save_screenshot`; never encode or write on the callback
+  thread. The callback thread is arbitrary: `egui-wgpu` completes it from a
+  `map_async` callback (`egui-wgpu/src/capture.rs:193`), not a guaranteed render
+  thread.
+- While a capture is pending, `logic` keeps a hidden-paint request alive. A
+  screenshot command itself requests paint while hidden
+  (`ViewportCommand::Screenshot` docs), so a hidden screenshot test does **not**
+  prove synthetic-input `RequestPaintWhileHidden`; section 13.6 tests that
+  separately.
+- Settle with `ctx.cumulative_frame_nr()` plus a monotonic animation deadline,
+  not `app.frame` (a logic-pass counter) and not a 3-pass count.
+
+Tests: two concurrent captures with distinct tokens/paths and exactly one reply
+each; callback exactly once; a callback after timeout/cancel writes no file and
+sends no reply; close/shutdown drains to zero retained bytes; zero-sized surface
+(`egui-wgpu` returns without calling the callback) times out cleanly with an
+actionable error; unsupported capture format (also returns without callbacks)
+times out; delayed GPU readback; out-of-order completion; reused viewport does
+not bind an old capture to a new document; admission count and aggregate memory
+caps (4 requests, 128 MiB/request, 256 MiB aggregate); a 4K resize/DPI race; `focus: true` raises first and correlates; `path:
+null` base64; bad path/authority is an error, not a panic.
+
+For distinct-image/out-of-order tests, intercept emitted screenshot callbacks and
+complete them manually with different synthetic images in reversed order. Kittest's
+normal renderer sends the same single rendered image to all callbacks and cannot prove
+that correlation. Use an adapter-qualified native/GPU row for actual capture timing,
+readback and viewport pixels; keep ordinary kittest for single-frame rendered checks.
+
+### 9.4 Docking
+
+`craft_ui::docking` remains the owner of the layout tree; PhotoCraft keeps
+`UiState.docking` serialization. The 0.37 migration must not change
+`Layout<String>`/`Location<String>` serde. Test:
+
+- float a tab, move it, redock, split resize, close/reopen, save workspace,
+  reload `UiState`; layout equality and panel rects;
+- `Escape` during a first drag restores the legacy workspace;
+- `workspace_locked` rejects moves atomically;
+- floating group strip is opaque in Studio themes;
+- panel IDs stay unique after tabs reorder.
+
+### 9.5 GPU resource behavior
+
+PhotoCraft's canvas is a custom `egui_wgpu` paint callback
+(`crates/ui-egui/src/gpu_canvas.rs`), not an egui image. 0.37 changes the
+surface integration, not the callback contract, but these must be checked:
+
+- E2/E3: a root or child window larger than `max_texture_dimension_2d` is
+  configured at a fitted size and drawn at a matching scale; a configure or
+  renderer error returns `WgpuError::ConfigureSurface`/`CreateRenderer` and
+  reaches the CPU-retry path, not a panic.
+- `GpuCanvas::new` reads the device's `max_texture_dimension_2d` and tile size;
+  `use_adapter_limits` requests the adapter limits on web/desktop. Confirm the
+  egui surface limit and the canvas texture limit are independent.
+- Texture deltas: assert `TexturesDelta::set/free` are applied once per frame, no
+  texture leaks after a dialog closes, and screenshot readback does not retain a
+  full-window buffer.
+- Device loss: `gpu_status`/`DeviceHealth` still switches to the CPU canvas; no
+  egui-wgpu panic on a lost device; `ui.gpu.simulateLoss` test remains green.
+- Intel/DX12 texel guard: `texel_guard::install` still sees the same adapter;
+  zeroed texels are not exposed after the 0.37 vertex/format changes.
+- #8736: measure Windows `Renderer::new`/pipeline creation separately from the
+  first frame, with ≥20 fresh processes. The reported 0.37 cost is around 57 ms vs
+  14 ms for renderer construction and 197 ms -> 258 ms first frame on an
+  Intel/DX12 system; this is an external report, not our measurement. Do not use
+  a 200 ms startup allowance to hide it and do not accept clamp-only shader
+  filtering changes for Repeat/MirroredRepeat.
+
+### 9.6 Accessibility
+
+Map all 114 `WidgetInfo` calls as in §4. Keep `check_accessibility` on and add
+`Response::labelled_by`/`accessible_name` for fields without hints. Add a
+screen-wide `unnamed_widgets().is_empty()` assertion for the main screen and
+each dialog. After E17/E18, assert AccessKit root language and
+`Response::accessible_language`.
+
+## 10. Fonts, glyph coverage and text
+
+### 10.1 Build and definitions
+
+Required edits:
+
+- `crates/ui-egui/Cargo.toml:73`: `epaint_default_fonts = { version = "0.37", features = ["monochrome_emoji_fonts"] }` (or the git-patched package with that feature).
+- `crates/ui-egui/Cargo.toml:57`: dev `egui` features `["default_fonts", "monochrome_emoji_fonts"]` so the oracle test matches.
+- `build.rs:37-45`: add `("egui-icons", epaint_default_fonts::EGUI_ICONS)`; keep the two emoji fonts behind the feature.
+- `egui_fonts.rs:47-56`: add `egui-icons` at 0.90; preserve 0.37 family order:
+  - monospace: `Hack`, `Ubuntu-Light`, `egui-icons`, `NotoEmoji-Regular`, `emoji-icon-font`
+  - proportional: `Ubuntu-Light`, `egui-icons`, `NotoEmoji-Regular`, `emoji-icon-font`
+- `egui_fonts.rs:79`: compare to `FontDefinitions::default()` with the same features.
+
+Do not enable `default_fonts` in production; the web size gate depends on the
+deflated fonts. No new font file is committed by this change: `egui-icons`,
+NotoEmoji and emoji-icon-font come from `epaint_default_fonts`. Verify
+`ATTRIBUTION.md` needs no new row; if a packaged font asset is added, add its
+path/author/title/source/license row in the same first PR. The font feature,
+equality test, glyph coverage and accessible-name fixes are all part of the first
+green PR.
+
+### 10.2 Lazy fallback
+
+`cjk_fonts.rs` remains the app's fallback owner. Set
+`NativeOptions::system_font_fallback = false` in the first cut. If
+`system_fonts` is enabled later, remove or reconcile `cjk_fonts` in the same
+change; two providers would produce non-deterministic font choices.
+
+#8512 is still on PhotoCraft's path: `cjk_fonts` reads at most one system font per
+frame even with `system_fonts` off. Measure font discovery and first-use
+separately from renderer construction: cold/warm startup with `system_fonts`
+off, with the app's lazy CJK fallback, and with an explicitly configured system
+provider; record glyph coverage before/after. Do not assume disabling the
+eframe feature removes system-font discovery cost.
+
+`ctx.add_font` / `set_fonts` now apply immediately when no text has been laid out
+in the pass. Re-check `defer_after_reset`, `fonts_ready`, and the
+`UiFontSizePlugin::defer_after_install` one-frame assumptions; add a test where
+fonts are installed from inside the first pass and where a language change
+rebuilds fonts mid-run.
+
+### 10.3 Glyph coverage
+
+Add a test that loads every `tl!`/menu-catalog/catalog string and asserts
+`Fonts::has_glyphs` for each character after `install_fonts` (with test fonts).
+Include `✓ ▲ ▼ ▶ ◀ × … ⏵ ⋮`, `egui::special_emojis`, Arabic/Hebrew/Devanagari/
+Thai samples, and the CJK samples already used by `cjk_fonts` tests. A missing
+glyph must fail the test, not render tofu. This test and the minimal
+`allow_missing_glyphs()` exceptions (only intentional tofu) ship in the first
+green PR; do not let 481 harnesses inherit `MissingGlyphPolicy::Panic` without
+the glyph decisions.
+
+## 11. Input, IME, clipboard and RTL
+
+- `raw_input_hook` stays; add `latin_layout_chars` handling only if E19 is in the
+  qualifying revision. Fresh input is interpreted only in a known UI phase; the
+  hook may move queued synthetic events into eframe's preserved input, but it
+  sets `synthetic_in_flight` so `logic` forces a hidden paint and no other code
+  treats the logic-only tick as a paint.
+- `shortcuts::clipboard_keys` handles `Event::PasteImage` as the document paste
+  shortcut through the existing `import_os_clipboard`/session clipboard path, not
+  a second clipboard read; add a test for one import.
+- Middle-click PRIMARY paste is new; verify text fields and the canvas do not
+  both act on it.
+- E4 regular clipboard and PRIMARY are separate acceptance rows. PRIMARY's
+  default is the shared W15P winit-owned path on the existing connection/event
+  queue with per-seat lifecycle and distinct PRIMARY protocol objects; never bind
+  a second regular `wl_data_device`. The arboard PRIMARY fallback in the candidate
+  is not adopted as the default. If a fallback is retained, record exact
+  compositor/capability evidence and keep PRIMARY an unresolved gate.
+- PRIMARY native matrix (wlroots, KWin, Mutter): keyboard-only focus, serial
+  freshness, owner/seat changes, empty/absent offers, self-paste, canceled/slow
+  transfers, password selection never offered, unchanged selection not reclaimed,
+  and no second regular data device. Test regular/image/drop separately.
+- With E21, add `ImeEvent::DeleteSurroundingBytes` to the Type tool's event match
+  (`type_tool.rs:964-967`) and to any other exhaustive match; implement deletion
+  in bytes with char-boundary checks, one undo step. E21 acceptance is
+  macOS/Wayland only; Windows `ime_delete_surrounding` returns `None` in the
+  candidate, so a green Windows IME test is not E21 coverage.
+- With E21b, extend the Type tool's custom `IMEOutput` producer
+  (`type_tool::draw_overlay`, `type_tool.rs:1255`) with the bounded logical
+  surrounding-text payload: committed model text, preedit excluded, UTF-8 byte
+  cursor/anchor, owning document+layer+viewport identity. Use
+  `current_text`/`layout` and `byte_of` (char-to-byte); do not pass visually
+  reordered display text. Resolve `TextEdit.document` (`active_doc_id` when
+  `None`) and `layer` into the payload identity. When removing the preedit char
+  range, a caret/anchor inside or at the end of it maps to the range start.
+  Clamp to the payload's 4000-byte limit at char boundaries; if the selection
+  cannot fit, emit explicit unavailable context.
+  Owner/context generation is present even for `Unavailable`; `Available` empty text
+  is a distinct case. Clear cached and compositor state with W27's committed
+  disable/enable transition on owner change/unavailable/focus loss/reset/no IME;
+  normal updates preserve composition. Clear old pending batches. In the current
+  focus epoch, a mismatched `done` serial still applies incoming edits once and defers
+  outgoing state until a match; old epochs never edit the new owner. Latest completed
+  UI-pass output, including None, is authoritative. Password fields never supply text. Built-in
+  `TextEdit` fields inherit the upstream producer. E21b's payload is not
+  `Copy`; audit every `IMEOutput` constructor/destructure in PhotoCraft (the
+  Type tool is the only custom one) and keep `Clone`/`Eq` semantics.
+- With E5/E12/E13/E16, remove `bidi_text::visual`/`visual_ltr` use
+  (`layer_row_ui.rs:132/137`, `panels.rs:719`) and the `unicode-bidi` dependency,
+  or reduce `bidi_text` to non-reordering helpers. Double reordering is the
+  most likely user-visible RTL regression.
+- With E9, audit `direction.rs` call sites before setting `Style::right_to_left`.
+  Do not mirror twice.
+- #8763 selection loss: reproduce "select text, click a toolbar/context action"
+  in PhotoCraft's custom text fields/menu. The fork owns the selected fix with
+  pointer and keyboard regressions (fork P7c, prerequisite in P0). A local workaround
+  requires a demonstrated app-specific gap and removal condition; it is not an undecided
+  alternative to the shared fix.
+- Test keyboard/focus: Tab order, Escape, Enter, focus after dialog close,
+  IME preedit/commit, dead keys, grapheme deletion, RTL caret affinity, and the
+  selection-action row.
+
+## 12. Implementation stages
+
+### P0 — fork qualification (outside PhotoCraft)
+
+Publish/qualify canonical egui and winit revisions, including P2b bounded transfers, P7 key pairing, E21b/P7b with W27 clear/lifecycle,
+W15P and P7c selection/viewport regression fixes, and publish the craft-libs port
+and CL-2F capture helper on current `main`. Acceptance: `PATCHES.md` complete;
+each patch and W15P/E21b/P7c test; native Linux/Windows/macOS compile and targeted
+tests; public immutable full SHAs; no path/branch patches. Stock 0.37 and aiongg
+candidates remain research controls. No PhotoCraft PR can claim 0.37 until this
+exists.
+
+### P0b — baseline harness and measurement (before production)
+
+On `ff473881` / 0.36.2, add or extend the harnesses that will judge the migration,
+without changing production behavior:
+
+- the fixed 120-label plain-text tessellation scene and a benchmark row;
+- Windows renderer-construction/first-frame timing around `Renderer::new`;
+- the select-text-then-click-action regression (kittest and native);
+- screenshot lifecycle probes (timeout, cancel, late callback, zero-size surface)
+  against the 0.36 API, adapted to the 0.37 slot contract later;
+- panel/window migration fixtures containing a real 0.14.0 `ui.ron`;
+- the paired baseline measurements and raw JSON/machine fingerprint.
+
+This PR and its evidence land before P1. A harness invented after production
+changes is not a before/after control. Record pre-existing baseline failures
+separately; do not fabricate a baseline from a failing binary.
+
+### P1 — first green 0.37 PR (atomic compatibility)
+
+This is the first change set that must pass its own tests, assets, glyph,
+accessibility, feature and gate checks. It includes:
+
+- root/app/ui `Cargo.toml`, `Cargo.lock`, root `[patch.crates-io]` for the whole
+  family and winit; features `wgpu`, `accesskit`, `wayland`, `x11`, `persistence`,
+  `clipboard`; `epaint_default_fonts` with `monochrome_emoji_fonts`; dev
+  `default_fonts` for the oracle;
+- `crates/ui-egui/build.rs`, `egui_fonts.rs`, `cjk_fonts.rs` `FontData` uses,
+  `TextEdit::hint_text` helpers, `theme.rs` family order;
+- accessibility names and minimal glyph-policy decisions required by kittest's
+  default `check_accessibility`/`MissingGlyphPolicy::Panic`;
+- mechanical `WidgetType`/`Id::new`/`ui.id`/panel/direction migration, including
+  the `panel_state_id` helper and the first-frame panel migration in this same PR;
+- `lib.rs` screenshot slot, `control.rs`, `shortcuts.rs` paste handling,
+  `menu_nav.rs`/`field_wheel.rs` scroll offsets, `main.rs` NativeOptions,
+  `clipping_indicator_tests.rs`;
+- `ui_state.rs` window-settings rewrite and backup, with old/new fixtures;
+- E21b Type-tool producer and compatible `IMEOutput` literal, E21 byte deletion,
+  owner/clear/final-pass semantics, with native evidence tracked explicitly;
+- screenshot completion slot and its lifecycle tests; panel/window persistence
+  fixtures; no duplicate replies; no lost panel widths;
+- any `ATTRIBUTION.md` change needed by a packaged asset (none expected), and the
+  corrected perf/snapshot/wasm gate commands.
+
+Acceptance: `cargo fmt --all -- --check`, `cargo check --workspace --all-targets`,
+`cargo clippy --workspace --all-targets -- -D warnings`, `cargo xtask layers`,
+`cargo xtask wasm`, `cargo test -p photocraft-ui-egui --lib --tests`,
+`cargo test -p photocraft --tests`, the build.rs font equality test, glyph
+coverage test, explicit expected roles/names on the main screen and every opened dialog,
+`unnamed_widgets` empty as a supplementary check, `Event::PasteImage` one-import regression,
+and `packaging/web/package.sh`
+(per-file limit). No deprecation warnings and no globally disabled kittest check.
+
+### P1b — visual fixture expansion (follow-up, not a green requirement)
+
+Files: `snapshot.rs` scripts/fixtures, `panel_docking_tests.rs`,
+`panels.rs` visual capture, kittest harness helpers.
+
+Acceptance: baseline vs candidate images for 6 representative themes × 3 scales,
+exact geometry JSON; deliberate broken probe fails. This expands coverage; it does
+not carry the names/glyph/feature fixes that P1 already needs to be green.
+
+### P2 — extended language and native IME qualification
+
+Files: `bidi_text.rs` removal/reduction; `direction.rs`/E9 audit;
+`i18n::sync_context` + `Frame::set_ui_language`; `layout_keys.rs`; AccessKit language
+and extended native tests. The final fork pin and required E21/E21b model adapter
+already land atomically in P1; P2 does not introduce a second dependency stage.
+Acceptance: E5/E12/E13/E16/E17/E18/E19/E20/E21/E21b tests; RTL/grapheme/IME
+matrix; E21b outgoing text after commit/deletion, preedit exclusion, byte
+indices, long selection, field/window switch and multipass final output; native
+Wayland predictive/Vietnamese trace or an explicit unresolved gate; no wasm size
+regression.
+
+### P3 — web browser qualification
+
+Files: `apps/photocraft-web` only if API changes; `WebShell` behavior tests.
+Acceptance: `cargo xtask wasm`, `packaging/web/package.sh`, browser workflow
+(open/type/paste/drop/screenshot); every shipped file ≤24 MiB and gzipped total
+plus raw wasm within a stated tolerance (+3%) of baseline.
+
+### P4 — performance and cleanup
+
+Files: benchmark additions only if needed; devlog and parity/localization docs.
+Acceptance: paired perf protocol below; cleanup of temporary shims; no production
+change without a review.
+
+Dependency DAG:
+
+```text
+P0 forks/craft-libs (E21b, W15P)
+   └── P0b baseline harness/measurement
+          └── P1 first green compatibility (names/glyph/features/panel/window)
+                 ├── P1b visual expansion
+                 └── P2 extended language/native qualification ── P3 web
+                                                   └── P4 perf/cleanup
+```
+
+Rollback: revert P1 → old lock and 0.36 family plus the preserved `ui.ron`
+backup (panel keys remain readable; window geometry needs the backup); P1b is
+additive tests/fixtures; P2 reverts to the P1 fork rev, restores `bidi_text.rs`
+and removes the E21b adapters as one API set; P3 is web-only; P4 is
+evidence/docs.
+
+### 12.5 Required gates
+
+Run through the server task wrapper with one resource task and a fresh job ID per
+command; do not run these directly as a delegated worker:
+
+```sh
+cargo fmt --all -- --check
+cargo clippy --workspace --all-targets -- -D warnings
+cargo test -p photocraft-ui-egui --lib --tests
+cargo test -p photocraft --tests
+cargo test -p photocraft-web
+cargo test -p photocraft-tablet
+cargo test -p photocraft-automation
+cargo xtask layers
+cargo xtask wasm
+cargo xtask parity
+cargo xtask scorecard --check
+cargo test -p photocraft-engine --test panic_hunt -- --ignored
+```
+
+Conditional gates: `cargo xtask test-corpus` if `io`, `psd`, `codecs`, `compose`,
+`gpu`, `text` or `format` change (not expected in the UI-only stages);
+`cargo xtask perf --quick` after each stage; full `cargo xtask perf` before the
+performance sign-off, including `text_tessellation` and the Windows renderer row.
+Windows/macOS native checks follow the corresponding server workflow and their own
+VM/helper procedures.
+
+Do not claim a gate passed from a compile-only run. A skipped optional test
+(e.g. missing `CRAFT_FONTS_DIR`) is recorded as skipped, not passed. Baseline
+evidence for P0b (raw samples, machine fingerprint, lock/source hashes) must exist
+before any P1 production edit is measured.
+
+## 13. Test plan: user-observable assertions
+
+### 13.1 Stable fixtures
+
+- Synthetic documents with fixed seeds: 1440×900 UI; a 400×300 document; a
+  20 MP layered document; a 36 MP photo; a 14000×14000 document. Store fixture
+  generation seed and SHA256.
+- Themes: `ProMedium`, `Studio`, `Classic`, `Adwaita`, `BreezeDark`,
+  `SoftLight` (representative; full 14-theme matrix nightly).
+- Scale factors: 1.0, 1.5, 2.0; viewports 800×480, 1440×900, 3840×2160.
+- Persistence fixtures: a real baseline `ui.ron` saved by 0.14.0, plus a
+  hand-edited old-schema file.
+
+### 13.2 Geometry and hit tests
+
+- Panels are shown in the expected order (title/options/status/toolbar/dock,
+  then central); no overlap; each panel is nested in the root Ui, not a child;
+  central canvas rect positive; clipping contains the canvas; panel state IDs
+  unique; panel sizes restore from both old and new `ui.ron` keys.
+- Dock: float/redock/split/resize/close/reopen; exact rects within 0.5 pt.
+- Menus: long menu scrolls to last row; arrows and wheel; submenu hidden-row
+  behavior; taskbar-aware placement.
+- Toolbars: options bar controls hit at 1x/1.5x/2x; no dead zones from new
+  atom padding.
+- Canvas: brush stroke, pan, zoom, crop box, transform handles; document pixels
+  and overlays.
+
+### 13.3 Pixel comparisons
+
+Use `snapshot --out <png> --size <w>x<h> --scale <s> --system-theme <light|dark|none>
+--script <json>` for each fixture. `--system-theme` only selects the OS
+appearance; select a PhotoCraft theme through the control script, e.g.
+`--script '[["ui.set",{"theme":"studio"}]]'`. Compare baseline and candidate with
+the same wgpu adapter/driver/DPI. Proposed tolerance:
+
+- 99.5% of pixels have per-channel delta ≤ 3;
+- no pixel has delta > 12;
+- geometry JSON (panel rects) equals within 0.5 pt;
+- text antialiasing may differ only inside this tolerance; a larger diff is a
+  font/style decision, not noise.
+
+Justify any wider tolerance with the exact font/renderer change. Do not update
+goldens to make a test pass.
+
+### 13.4 Accessibility and semantics
+
+- `unnamed_widgets()` empty for main screen and every dialog.
+- Roles: buttons, checkboxes, radio buttons, sliders, spin buttons, combos,
+  color wells, text inputs, disclosure triangles.
+- Names/labels: icon-only buttons have accessible names; text fields have labels
+  or placeholders; selected state is reported.
+- After E17/E18: AccessKit root language and `Response::accessible_language`.
+- RTL: reading order and label language; no double-reversed Arabic.
+
+### 13.5 Keyboard, focus, selection and IME
+
+- Tab/Shift+Tab through every field; Enter/Escape; focus returns after dialogs.
+- Selection regression (#8763/#8764): select text, click a toolbar/context action;
+  the intended selected range reaches the action, pointer and keyboard paths
+  agree, and undo restores one step. Run both kittest and a real native workflow.
+- IME: Japanese/Korean/Chinese preedit and commit; macOS press-and-hold;
+  Wayland text-input-v3; Windows IME. `DeleteSurroundingBytes` deletion and one
+  undo step are E21 coverage on macOS/Wayland only; Windows IME is general
+  coverage, because the candidate returns `None` there.
+- E21b: outgoing surrounding text immediately after delete+commit and
+  deletion-only batches; preedit excluded; reversed selection; supplementary/
+  combining/RTL logical order; cursor movement; >4000-byte line; two documents;
+  field/window switch; focus/reset/late serial; password/no-IME clears; multipass
+  final output; one undo. A native Wayland Vietnamese/predictive-IME protocol trace
+  is an external gate.
+- Non-Latin layouts: Russian/Arabic/Hebrew shortcuts; German bracket keys;
+  Dvorak brackets; `⌘V` on Dvorak-QWERTY ⌘.
+- Clipboard: text copy/paste/cut, image paste (`Event::PasteImage`), PRIMARY
+  middle-click, file-list paste, empty clipboard, occupied clipboard.
+- PRIMARY: keyboard-only focus, serial freshness, owner/seat changes, empty or
+  absent offers, self-paste, canceled/slow transfer, password exclusion,
+  unchanged-selection reclaim policy. Run on wlroots, KWin and Mutter; record
+  capabilities. A green arboard-only run is not PRIMARY acceptance.
+
+### 13.6 Broken-behavior probes (mutation checks)
+
+- Temporarily remove one `widget_info` label in a test-only copy → accessibility
+  test must fail.
+- Temporarily pre-reorder an Arabic label with `bidi_text::visual` while E5 is
+  active → RTL fixture must fail.
+- Temporarily set the panel state key to the old ID → persistence test must fail.
+- Temporarily return a fixed screenshot token → correlation test must fail.
+- Temporarily disable the slot's late-callback drop → a timeout/cancel probe must
+  fail (no file/reply).
+- Temporarily disable `RequestPaintWhileHidden` for synthetic input → hidden
+  control test must time out/fail. Do this separately from a hidden screenshot:
+  the screenshot command itself requests paint, so it cannot prove the synthetic
+  path.
+- Temporarily replay a consumed screenshot/control event across a second pass →
+  the duplicate-reply/command test must fail.
+
+### 13.7 Headless `Context::run_ui` and `run_logic`
+
+Every new logic/ui boundary must be exercised without eframe, with the real
+callback order:
+
+- `Context::run_ui` with the app's `ui` body, a fixed `RawInput`, and no GPU:
+  assert panel geometry, control replies and state transitions.
+- Pass the existing `&mut Ui` to code that needs it. `Context::root_ui` **panics**
+  when the root Ui is already borrowed (0.37 `context.rs:1011-1024`); test that
+  documented panic as a negative test and test a successful `run_pass`/`root_ui`
+  call separately. Never introduce a recursive `root_ui` in production.
+- A hidden-tick driver must call `App::raw_input_hook` in eframe's order
+  (`prepare_raw_input`) before `App::logic`, not bare `run_logic`, and then run a
+  later `run_ui`: assert synthetic/control input is preserved and consumed once,
+  and that stale events/time are not replayed. Use an eframe/kittest hidden-window
+  driver or a direct `update_logic_only` equivalent; do not invent a native
+  once-per-frame host.
+- A headless pass must not be treated as proof of native focus, IME, clipboard
+  ownership or file pickers; those need the native rows below.
+
+### 13.8 Native and browser workflows
+
+- Linux X11 and Wayland (wlroots/KWin and GNOME/Mutter), Windows 11, macOS.
+- Real focus/IME/file pickers cannot be proven by kittest; record named hardware
+  rows and screenshots. macOS evidence is an unresolved gate until real hardware
+  rows exist; do not mark the migration complete on Linux-only evidence.
+- Browser: WebGPU and WebGL2; open a file, type in a field, paste, drop a file,
+  take a screenshot, resize the page; verify no JS errors in the console.
+- Extra document windows: open two, draw in each, close one during a stroke,
+  screenshot the root while a child is open, and confirm control input still
+  reaches the root; immediate-viewport raw input must not be duplicated.
+- #8748 is closed/unmerged and PhotoCraft has no deferred viewports: record that
+  explicit non-applicability, then test hidden/occluded root + immediate child
+  open/update/close (including a child left open when the root is hidden).
+
+## 14. Performance protocol
+
+### 14.1 Baseline
+
+Before P1 (the first production change), run the baseline on the **same** machine
+that will run the candidate. The P0b harness is added on 0.36.2 first; stock 0.37
+and the fork are controls, not replacement baselines.
+
+- record `uname -a`, CPU model/cores, RAM, GPU adapter/vendor/driver, wgpu
+  backend, OS build, Rust version, `Cargo.lock` SHA256, exact command lines and
+  feature set;
+- renderer: Vulkan (or Metal/DX12 as applicable), plus a separate `--cpu`
+  software-renderer run;
+- DPI: 1.0 and 2.0; viewport 1440×900, plus 3840×2160 for large-window tests;
+- profile: `--release`, `--locked`, no `CRAFT_FONTS_DIR` unless the row is
+  font-specific; record whether craft-fonts is embedded.
+
+Run each row with the shared sample protocol; keep raw JSON. The repository's
+existing 15-sample/5-sample bench counts and `interactive_bench --reps 5` are
+smoke settings, not acceptance evidence. For migration evidence use at least:
+
+- 10 warmups + 30 timed iterations for steady operations;
+- 20 fresh processes for startup and renderer/font-discovery rows;
+- at least 1,000 rendered frames for frame distributions; report p50/p95/p99 and
+  only claim a p99 from those frames (never from 20/30/50 samples);
+- 1 warmup + 5 samples for 196 MP / 2 GB rows is an exploratory smaller run, not
+  tail acceptance; label it as such and do not report its p95/p99 as acceptance;
+- interleave baseline/candidate (A/B/A/B) to control thermal drift;
+- reject a run when load average is high or another build shares the machine;
+  rerun rather than accepting a noisy result. Use a paired confidence interval
+  where suitable and record peak RSS, allocations/texture uploads and idle
+  repaint/CPU separately.
+
+### 14.2 Metrics and thresholds
+
+Thresholds are investigation triggers, not permissions to accept a regression.
+A repeatable **>5% median** or **>10% p95** change is investigated; existing
+stricter repository budgets win. Do not expand tolerance after seeing a failure;
+an exception needs a documented tradeoff and owner approval before acceptance.
+For sub-millisecond rows require the relative increase to exceed 0.05 ms or
+corroborate it with stable instruction/allocation counts.
+
+| Metric | Baseline source | Gate |
+|---|---|---|
+| UI pass p50 | new `frame_bench` or `perf` `ui_ms` | investigate >5%; no looser absolute allowance |
+| UI pass p95 | same | investigate >10% |
+| UI pass p99 | same, only from ≥1,000 rendered frames | report; investigate >10% when the sample supports it |
+| Operation p50 / p95 | `perf_scenarios` rows / `interactive_bench` | investigate >5% / >10% |
+| Peak RSS | `RssSampler` / `/usr/bin/time -l` | investigate >5%; report peak, not only completion |
+| GPU bytes held | `perf_scenarios` `gpu_bytes` | investigate >5% |
+| Texture uploads / vertices / UI allocations | new test-only counters from `FullOutput.textures_delta`, tessellation and a scoped allocator around the app pass | investigate >10% |
+| Idle repaint/CPU | 60 s with no input: frame count, process CPU %, GPU util | any continuous repaint, new busy-loop or audio underrun is a failure |
+| Startup to first frame | app log timestamps / `gpu_startup` | investigate >5% median or >10% p95; no +200 ms allowance |
+| Renderer construction (#8736) | `Renderer::new`/pipeline timestamps, 20 fresh processes | investigate >5% median or >10% p95; separate from first frame |
+| Font discovery (#8512) | cold/warm process trace with system fonts off/on | investigate >5% / >10%; report glyph coverage before/after |
+| Text tessellation (#8731) | fixed 120-label `text_tessellation` row | investigate >5% median or >10% p95; compare 0.36, stock 0.37, fork |
+| Selection action (#8763) | select-text-then-click-action regression | no lost range; pointer/keyboard agree; one undo step |
+| Wasm size | `packaging/web/package.sh` output | every shipped file ≤24 MiB; gzipped total and raw wasm ≤ +3% vs baseline |
+| Click-to-pixel latency | `stroke_trace` | investigate >5% median or >10% p95 |
+
+Do not report compile duration as UI performance. Do not compare the committed
+macOS `perf/baseline.json` with a Linux/Windows run. Do not auto-accept a changed
+pixel golden or a changed budget; profile and either fix or document an explicit
+accepted regression with owner approval.
+
+### 14.3 Commands
+
+All commands run through the server task wrapper, one resource task and a fresh
+job ID per intentional execution:
+
+```sh
+python3 /home/codex/work/maintenance/task.py run \
+  --job-id <task>-perf-baseline-01 --kind build --task <task> \
+  --source /home/codex/work/CraftApps/egui037-migration-20261022/photocraft \
+  --evidence /home/codex/work/ssd2/task-evidence/<task> \
+  -- bash -c 'cargo xtask perf --bench perf_scenarios'
+```
+
+`xtask perf` appends its own `--json <target>/perf/<bench>.json`; it rejects a
+user-supplied `--json` as an unknown option. After the run, copy
+`$CARGO_TARGET_DIR/perf/perf_scenarios.json` and `summary.md` into evidence. The
+bench's own `--json` is only for invoking the example directly.
+
+Equivalent runs for `interactive_bench`, `fx_bench`, `bevel_bench`,
+`camera_raw_bench`, `type_bench`, `large_image_bench`, `large_file_bench`, the new
+`text_tessellation` row, plus `cargo xtask perf --quick` as a smoke check. Copy
+raw JSON, `summary.md`, logs, machine fingerprint, command line, source SHA and
+lock SHA into evidence. Startup/renderer/font rows run 20 fresh processes each;
+frame rows use ≥1,000 rendered frames. Do not claim a p99 from an exploratory
+small run.
+
+## 15. Decisions and remaining gates
+
+Resolved in revision 2 (they are requirements, not open choices):
+
+- **E4 PRIMARY:** the shared W15P winit-owned path on the existing
+  connection/event queue is the default; arboard is a measured fallback and an
+  unresolved gate, never an adopted default.
+- **WindowSettings:** preserve `inner_size_points`, `fullscreen` and `maximized`
+  on every OS; preserve `outer_position_pixels` on Windows only; center on
+  macOS/Linux; rewrite before eframe loads and keep a backup. Document the
+  rollback loss.
+- **PanelState:** migrate in the first compatible PR; a one-time width reset is
+  not an accepted substitute.
+- **craft-libs:** port only the `8614e4a`/`1764bca` hunks onto current `main`;
+  keep `craft-print`/`craft-docpath` pins and unrelated vendors. Do not merge
+  `b68de8c`/`ec8840a` trees.
+- **PasteImage:** treat as document paste through the existing import path.
+- **E21 and E21b:** implement both for the custom Type tool; E21 is
+  macOS/Wayland-only, E21b adds the bounded logical surrounding-text producer.
+- **E21b:** new prerequisite; `None` placeholders are not acceptance.
+- **Screenshot:** bounded, cancelable weak-slot completion with capture-time
+  geometry, no unbounded channel and no late file/reply.
+- **Performance:** shared 10/30/20/1,000 sample minimums and >5% median /
+  >10% p95 investigation; no looser absolute allowance.
+
+Remaining open gates:
+
+1. **Fork publication/ownership.** Canonical `storytold/egui` and
+   `storytold/winit` full SHAs do not yet exist as published immutable commits
+   containing E21b and W15P. Choosing aiongg branches as canonical would make an
+   individual fork a required public dependency; choosing storytold requires
+   pushing there. No approval is granted in this plan.
+2. **E11 inclusion.** No PhotoCraft consumer enables `epaint/multithreading`.
+   Decide whether the shared fork carries E11 for VectorCraft or whether
+   PhotoCraft's qualifying revision excludes it.
+3. **E9/`direction.rs` overlap.** Keep explicit shell mirroring and leave
+   `Style::right_to_left` off, or switch to E9 and remove overlapping manual
+   mirroring. Needs RTL fixtures first.
+4. **System fonts / color emoji.** Keep bundled monochrome emoji and no
+   `system_fonts`, or enable `system_fonts` (fontique + color fonts) and retire
+   the custom CJK fallback. The latter needs a separate design and size/perf
+   review; #8512 is measured either way.
+5. **Final winit patch list.** W12/W14/W16 are not PhotoCraft-required.
+   Confirm whether the shared published revision includes them; W15P, W26 and
+   W27 are required regardless.
+6. **External evidence gates.** Real macOS IME/focus, Windows native GUI and
+   renderer timing, Wayland compositor/IME/PRIMARY, and browser runtime evidence
+   remain gates. Cross-compilation, kittest and software-renderer VM results do
+   not satisfy them.
+
+## 16. Historical planning limitations (superseded by current status above)
+
+- Planning only: no build, test, clippy, wasm, GUI, IME, screenshot or performance
+  command was run. The historical audit log in the evidence directory shows the
+  same first font build failure, but it is not fresh validation.
+- Revision 2 addresses the v1 findings by source inspection, but it has not been
+  re-reviewed. A fresh independent review of this exact document is required
+  before any publication approval.
+- The E/W patch audit is based on the candidate commits and `PATCHES.md`;
+  every patch, including E21b and W15P, still needs a line-by-line review against
+  its upstream PR/proposal and a test audit before publication.
+- E21b has no existing implementation. Its egui payload, TextEdit producer,
+  egui-winit Wayland adapter, PhotoCraft Type-tool adapter and native IME trace
+  are all future work; no claim of existing surrounding-text support remains.
+- Windows, macOS, Wayland and browser behavior are unverified. Headless kittest
+  is not proof of native focus, IME, file pickers or compositor behavior.
+- No final fork revision or `Cargo.lock` hash exists yet; the target lock cannot
+  be produced until P0 is published with the reviewed full SHAs.
+- The performance baseline machine and exact adapter/driver are not chosen; the
+  thresholds above are pre-registered, not measured. P0b must add the before
+  harness on 0.36.2 before P1.
+- No commit, push, PR, comment or external message was made. Publication still
+  requires explicit human approval for every push/new PR, with the exact
+  publication and validation shown first.
+
+
+## Local implementation update — 2026-10-23
+
+The user clarified that reviewed plans remain local and implementation proceeds before publication. The earlier requirement to publish/land this plan first is superseded; pushes and PR publication still require explicit approval.
+
+Canonical `storytold/photocraft` `main` now resolves to `e6d6fb45a40250f518d2e824236a8fdcaa4472c8`. The owned checkout was fast-forwarded to this revision. Earlier baseline SHAs and line anchors above are retained as historical review evidence; use this new revision and its exact lockfile for current-main integration and paired measurements. The original refs remain reachable.
+
+Use release0.15.0 and its lockfile as integration baseline; preserve same-origin served fonts and encoded-path rejection, cumulative glyph raster budgets, Select and Mask tile-based edits/undo and new catalog keys. Retain0.14 upgrade fixtures too.
+
+The complete static delta review and exact old/new object identities are retained in the task evidence: `canonical-diffs-refresh-20261023.json` and `overnight-consumer-review-20261023.md`. This amendment claims no new build, native GUI or performance acceptance.
+
+## Local implementation progress — first compatibility/lifecycle stage (2026-10-23)
+
+Local, uncommitted work only. No build, test, format, clippy, GUI or performance command
+was run for this stage; compile and runtime results are pending the parent's managed
+`task.py` jobs. Nothing is published.
+
+Repair round after `egui037-photocraft-postport-review-20261023-root-v1.md`: the test-target
+compile findings were fixed (`fonts_mut` for `has_glyphs` checks, the two missing
+`MouseWheelSource` fields, the missing-size window test), together with the runtime findings:
+geometry-change budget revalidation, monotonic epoch comparison across resize-and-back, a
+bounded pre-geometry admission queue, exact-once synthetic reinjection, withdrawal of a
+cancelled synthetic batch from preserved input, a monotonic active-document generation bound to
+captures and synthetic input, a minimized-window refusal, bounded PNG encode copies, the panel
+rollback stamp and web-shell `raw_input_hook` forwarding. The findings that remain open are
+listed at the end of this section.
+
+Implemented in this checkout (release 0.15.0 base `e6d6fb45`):
+
+- **Dependency family**: workspace `egui`/`eframe`/`egui_kittest` 0.37, `egui_extras` 0.37,
+  `epaint_default_fonts` 0.37 with `monochrome_emoji_fonts`, dev `egui` with `default_fonts`
+  + `monochrome_emoji_fonts`, `eframe/clipboard` on the app, UI library and web shell, and a
+  direct `web-time` dependency. The working tree's `Cargo.lock` is modified by the parent's
+  local path patches for `egui-implementation`, `winit-implementation` and
+  `craft-libs-implementation`; it is not a reviewable/publishable lock until the family and
+  winit are pinned to published revisions and the lock is regenerated from them. The pinned
+  `craft-ui` revision currently lacks `craft_ui::capture` (post-port review F1).
+- **Fonts**: `build.rs` deflates `egui-icons` and the feature-gated emoji faces;
+  `egui_fonts.rs` reproduces 0.37's faces, scale tweaks and family order; `cjk_fonts.rs` uses
+  `FontData::bytes()`; a glyph test covers `egui::special_emojis` in both families;
+  `NativeOptions::system_font_fallback = false` keeps PhotoCraft's own CJK/craft-fonts
+  fallback the only provider.
+- **Mechanical 0.37 API port**: `WidgetType` → `egui::Role` (with the renamed variants),
+  `Id::new` → `Id::unique` (hash-preserving), `ui.id()` → `ui.scope_id()`,
+  `Panel`/`direction` take `AsIdSalt`, `TextEdit::hint_text` takes owned text, `ScrollArea`
+  offsets use `clamped_offset()` and a request applied through `vertical_scroll_offset`,
+  `Event::PasteImage` maps to the document paste shortcut, and every `Event::MouseWheel`
+  constructor carries `MouseWheelSource::Unknown`.
+- **Panel persistence**: `panels::panel_state_id(ctx, salt)` is the 0.37 parent-scoped key;
+  `panels::migrate_panel_state` copies the old `Id::unique(name)` `PanelState` entries, leaves
+  the old keys intact for a 0.36 rollback, and stamps both keys.
+  `panels::remember_panel_state` records the 0.37 size each pass. On a later start an old key
+  that changed while the new one did not (a 0.36 rollback resize) wins; a 0.37 resize is kept.
+  If both changed the order is unknown and the new key is kept, so a 0.37 resize after a 0.36
+  rollback resize can still be lost; that ambiguity is documented and tested. Called from the
+  first UI pass; tests cover key identity, the copy, the old-key retention, a 0.37 resize after
+  migration and a 0.36 rollback resize (`panels.rs`), and panel widths across two restarts
+  (`apps/photocraft/src/main.rs`).
+- **Window settings**: `ui_state::sanitize` now rewrites a 0.36 flat `window` entry to
+  0.37's `normal_geometry` before eframe reads it, after a one-time `ui.ron.pre-0.37` backup.
+  It preserves a valid size (defaulting to 1440×900 when absent), `fullscreen` and
+  `maximized`, preserves the old physical outer position only on Windows, and centres on
+  macOS/Linux. Corrupt sizes are left untouched. `has_saved_position` reads only the nested
+  outer position. Tests cover old macOS/Windows fixtures, missing size, corrupt values, the
+  backup, the one-way reverse-compatibility loss, and maximized/fullscreen.
+- **Screenshot lifecycle** (`crates/ui-egui/src/screenshot.rs`): bounded, cancelable capture
+  requests using the shared `craft_ui::capture::CaptureSlot` with a weak callback. Admission
+  enforces 4 outstanding requests, 128 MiB per image and 256 MiB aggregate over issued,
+  completed-undrained, unissued and geometry-waiting requests, rejects before issuance with
+  checked arithmetic, and is drained before admission so a finished request releases its
+  budget. A request that
+  arrives before the first UI pass has recorded the geometry waits in a count/deadline-bounded
+  queue and is admitted on the next logic tick. When the geometry is finalized at issuance or
+  after a retry, the per-image and aggregate budgets are recomputed and the reservation updated
+  (or the request fails before any capture). The request identity is the document and its
+  monotonic activation generation (revision recorded, not an invalidation: a switch away and
+  back fails the capture). Geometry (size, scale, zoom, texture side, minimized) has a monotonic
+  epoch updated only in a real UI pass; an epoch advance between issuance and collection retries
+  even when the values change back, and the issuing pass must show the same activation at its
+  start and end. Settling counts UI passes, issuance happens only from `App::ui` after fonts are
+  ready, and deadlines use `web_time::Instant` (monotonic on native and wasm). Accepted images
+  are the issued size within a pixel or the renderer's exact texture-side fit, never an
+  arbitrarily smaller same-aspect surface. A late callback after timeout/cancel is inert;
+  encoding/writing happens on the UI thread in `control::save_screenshot_rgba`, never in the
+  callback. The retained image is dropped before the encoder allocates its RGBA copy, and that
+  copy is bounded by the same per-image limit (`finish_captures` refuses an oversized image
+  rather than allocating).
+  Same-size surface recreation with no size/scale/zoom change is not observable and remains an
+  explicit limitation.
+- **Lifecycle**: hidden `run_logic` ticks request `RequestPaintWhileHidden` for unissued
+  captures and queued synthetic input; one synthetic batch is in flight at a time, and a pass
+  that returns early re-injects the same batch exactly once (a second hidden tick does not
+  append it again). A document/focus change observed in `raw_input_hook` withdraws the batch
+  (including events eframe already preserved) and fails the waiting replies, so cancelled input
+  is never applied. A change made inside `logic` after the hook cannot withdraw events the pass
+  has consumed, so the pass delivers them and keeps `automation_input` set instead of claiming
+  cancellation while the input lands. Control replies wait for a pass that actually delivered
+  the batch. The web shell now forwards `raw_input_hook` to the app after its touch-twin
+  filter, so the clipboard `PasteImage` mapping, legacy pinch, pen-hold and titlebar
+  normalization run in the browser too; the browser has no TCP control server, so the
+  synthetic queue stays empty there and synthetic-input rows remain native-only evidence.
+  `gpu_canvas::now_ms` is now monotonic on wasm (it was a constant 0), so autosave,
+  preference retry backoff, frame caps and stroke traces measure real durations; preference
+  retry and link-watch timing no longer read stale `run_logic` input time.
+
+### Integration-test selector repair — 2026-10-24 (historical pre-validation record)
+
+The parent's managed `--lib --tests` run (`egui037-photocraft-candidate-20261024-upstream-tests-18`)
+passed 3847 UI unit tests and 116 integration tests, with 16 integration failures. All 16 were
+kittest/AccessKit selector assumptions, not production behaviour changes:
+
+- kittest 0.5 reads a `Role::Label` node's text from its AccessKit `value`, so a form caption and
+  a control that carries the same accessible name both match `get_by_label`. Batch/Image
+  Processor (`Format`, `Input`, `Quality`, `Starting serial`), custom print paper
+  (`Paper Width`, `Paper Height`, `Top`, `Left`) and Export As (`Scale`, `Resample`) now select
+  the actual `TextInput`/`SpinButton`/`ComboBox` by role and name; existing coordinate searches
+  and ambiguous name-only lookups were removed. `custom_print_paper::shown` uses `query_all`
+  because a caption and its field are both valid visible matches.
+- egui 0.37 exposes a `CollapsingHeader` as `Role::DisclosureTriangle`, not `Role::Button`.
+  Camera Raw histogram/settings and localization tests now click and assert that role; the
+  section IDs and translated labels are unchanged.
+- A Camera Raw slider row exposes both its `Slider` and its numeric `SpinButton` under the same
+  name. `camera_raw_scope::alt_drag_slider` now addresses the `Slider` track directly instead
+  of the caption, preserving the real Alt-drag and overlay/diagnostic assertions.
+
+These edits keep the real clicks, drags, exported bytes, history/revision and engine-field
+assertions; they add no sleeps, retries or relaxed checks. They do not claim a passing run: the
+parent must re-run the managed full tests and lint. The broader 481-harness accessibility
+naming/glyph sweep and visual fixture regeneration remain open.
+
+The `ui.ron` fixtures under `apps/photocraft/tests/fixtures/` are schema probes reconstructed
+from the documented layouts, not recorded machine saves (see that directory's README); they
+prove the migration rules, not eframe/egui deserialization of a real save.
+
+The compiler/API port, IME producer/adapter, byte deletion, selection-action adoption, shared
+capture dependency and canonical lockfile are now implemented and covered by the current host
+qualification above. The later fixture corrections preserve real native viewport geometry,
+transform completion order, retired document editors and foreign viewport identity; they do
+not bypass the reset acknowledgement path.
+
+Remaining acceptance work: a real 0.36 docking-layout sample, the broader accessibility/glyph
+sweep, visual fixture regeneration, packaged WASM size, native/browser/IME/PRIMARY workflows
+and paired app performance. The app-owned docking JSON still falls back to the legacy layout
+if it cannot deserialize; DockArea's transient drag/focus state is not persisted.
diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md
index fbfcfa6f9e..dc5975cc0b 100644
--- a/docs/file-format-parity.md
+++ b/docs/file-format-parity.md
@@ -1,6 +1,6 @@
 # File-format parity
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-22 · **Change:** minor (legacy PSD point text placed from the layout ink box after font resolution, #6094; `.atn`: a recorded Save As imports with its format and file (`file.saveAs`, `file.saveACopy` for As a Copy) instead of as a plain Save that wrote over the played file, #7102; folder destinations stop playback until #5430; `.asl` layer style libraries read and written, #1051; JPEG Options on File › Save, Save As and Save a Copy, FILE-215-19 partial (no Matte, progressive Scans or size preview); 32-bit Hue/Saturation unclipped and Colorize as Photoshop does them, Photoshop-oracle floor 190/258, #5781; JPEG Options on Save As and Save a Copy, FILE-215-19; TIFF compression for scripted saves, `tiffCompression`, #5301; the Nikon D4 white level follows the sample depth (12 and 14 bit), #5978; Apply Layer Comp action mapping, #7101; Cineon write: 10-bit gray/RGB; animated WebP frames load into video layers, #1198; Photoshop mixed-order TIFF type geometry, #4758; DDS textures save: uncompressed or BC1–BC3, optional mip chain, DDS Options in Save As (#1327); PSD smart filters: 53 filters (39 more: Pinch, Polar Coordinates, Ripple, Spherize, Twirl, Wave, ZigZag, Invert, Blur, Surface Blur, Smart Sharpen, Diffuse, Wind, Offset, Mezzotint, Clouds, Difference Clouds, Fibers, Lens Flare and others) plus Hue/Saturation and Perspective Warp mapped both ways, #6296, #6298, #6300, #6302, #6304, #6314, #6316, #6267, #6268, FILE-215-2; large-file fixtures: a 20 MP layered PSD, a 150-layer layout, a 2 GB PSD and a 4.4 GB PSB generated at test time and round-tripped, FILE-216-2 done, #5107; earlier: smart objects keep Photoshop's Cylinder warp through re-renders and saves, #4112; PNG `sTER` stereo pairing kept on save, #6063; PDF write one flattened page via Save As / Save a Copy / CLI, #3401; CMYK Invert, Posterize and Threshold on the inks; smart filter masks on PSD open and save; Photoshop-oracle floor 188/258; lossy DNG, compression 34892, decodes with its levels and LinearizationTable applied to the stored 8-bit samples, FILE-215-11; CMYK Hue/Saturation and Color Balance keep the black ink; CMYK Posterize on the stored values, psd-tools oracle floor 242/309; CMYK adjustment layers composite on the document's inks; Photoshop-oracle floor 165/258; CMYK Brightness/Contrast on the inks, CMYK Threshold's luma; modern Brightness/Contrast's brightness curve; Photoshop-oracle floor 151/258; Lab documents composite on their stored L, a, b; Photoshop-oracle floor 152/258; Levels on whole levels at every step with Photoshop's shadow toe; Photoshop-oracle floor 146/258, psd-tools 238/309; 32-bit adjustments unclipped; Photoshop-oracle floor 149/258; mask feathers blur with their exact variance; Threshold splits on Photoshop's luminosity; a pass-through clipping base with an adjustment renders isolated; psd-tools oracle floor 240/309; 16-bit Posterize as Photoshop bins it; psd-tools oracle floor 241/309; Gradient Map luminosity; Photoshop-oracle floor 147/258; PSD: `Mt16`/`Mt32` merged transparency read; palette PNGs open in Indexed Color mode, #4804; 16-bit Lab Invert; Photoshop-oracle floor 145/258; `.atn` import maps 112 events; DDS textures open, #1327; DPX read and write, #1049; #2465 fixed: CS2 placed layers with only a `PlLd` block open their contents; Photoshop Actions `.atn` read and write; `.shc` contour files read and write; earlier the same day: indexed BMP palette mode; Save keeps a JPEG's quality and a WebP's encoding) · **Target:** Adobe Photoshop 2026
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-24 · **Change:** minor (Photoshop's `MTrn` merged-transparency marker, from a layered TIFF saved with Save Transparency, marks the merged transparency, #8877; layered TIFF writes the TySh text version and descriptor in PSD big-endian order while the header, matrix, warp and bounds keep container order, #9098; layered TIFF writes Photoshop's 14-byte global layer mask, so Photoshop opens the layers instead of only the composite, #9095; legacy PSD point text placed from the layout ink box after font resolution, #6094; `.atn`: a recorded Save As imports with its format and file (`file.saveAs`, `file.saveACopy` for As a Copy) instead of as a plain Save that wrote over the played file, #7102; folder destinations stop playback until #5430; `.asl` layer style libraries read and written, #1051; JPEG Options on File › Save, Save As and Save a Copy, FILE-215-19 partial (no Matte, progressive Scans or size preview); 32-bit Hue/Saturation unclipped and Colorize as Photoshop does them, Photoshop-oracle floor 190/258, #5781; JPEG Options on Save As and Save a Copy, FILE-215-19; TIFF compression for scripted saves, `tiffCompression`, #5301; the Nikon D4 white level follows the sample depth (12 and 14 bit), #5978; Apply Layer Comp action mapping, #7101; Cineon write: 10-bit gray/RGB; animated WebP frames load into video layers, #1198; Photoshop mixed-order TIFF type geometry, #4758; DDS textures save: uncompressed or BC1–BC3, optional mip chain, DDS Options in Save As (#1327); PSD smart filters: 53 filters (39 more: Pinch, Polar Coordinates, Ripple, Spherize, Twirl, Wave, ZigZag, Invert, Blur, Surface Blur, Smart Sharpen, Diffuse, Wind, Offset, Mezzotint, Clouds, Difference Clouds, Fibers, Lens Flare and others) plus Hue/Saturation and Perspective Warp mapped both ways, #6296, #6298, #6300, #6302, #6304, #6314, #6316, #6267, #6268, FILE-215-2; large-file fixtures: a 20 MP layered PSD, a 150-layer layout, a 2 GB PSD and a 4.4 GB PSB generated at test time and round-tripped, FILE-216-2 done, #5107; earlier: smart objects keep Photoshop's Cylinder warp through re-renders and saves, #4112; PNG `sTER` stereo pairing kept on save, #6063; PDF write one flattened page via Save As / Save a Copy / CLI, #3401; CMYK Invert, Posterize and Threshold on the inks; smart filter masks on PSD open and save; Photoshop-oracle floor 188/258; lossy DNG, compression 34892, decodes with its levels and LinearizationTable applied to the stored 8-bit samples, FILE-215-11; CMYK Hue/Saturation and Color Balance keep the black ink; CMYK Posterize on the stored values, psd-tools oracle floor 242/309; CMYK adjustment layers composite on the document's inks; Photoshop-oracle floor 165/258; CMYK Brightness/Contrast on the inks, CMYK Threshold's luma; modern Brightness/Contrast's brightness curve; Photoshop-oracle floor 151/258; Lab documents composite on their stored L, a, b; Photoshop-oracle floor 152/258; Levels on whole levels at every step with Photoshop's shadow toe; Photoshop-oracle floor 146/258, psd-tools 238/309; 32-bit adjustments unclipped; Photoshop-oracle floor 149/258; mask feathers blur with their exact variance; Threshold splits on Photoshop's luminosity; a pass-through clipping base with an adjustment renders isolated; psd-tools oracle floor 240/309; 16-bit Posterize as Photoshop bins it; psd-tools oracle floor 241/309; Gradient Map luminosity; Photoshop-oracle floor 147/258; PSD: `Mt16`/`Mt32` merged transparency read; palette PNGs open in Indexed Color mode, #4804; 16-bit Lab Invert; Photoshop-oracle floor 145/258; `.atn` import maps 112 events; DDS textures open, #1327; DPX read and write, #1049; #2465 fixed: CS2 placed layers with only a `PlLd` block open their contents; Photoshop Actions `.atn` read and write; `.shc` contour files read and write; earlier the same day: indexed BMP palette mode; Save keeps a JPEG's quality and a WebP's encoding; Amiga IFF write: 24-plane ILBM, Save As `.iff`; PSD stores spot channels as Photoshop does, ink 0 = solid, and numbers them in 1053, #7415 split; TIFF writes and reads alpha and spot channels as extra samples with Photoshop's channel resources, PSD output unchanged, FILE-215-7, FILE-215-17's TIFF part, #7415; Photoshop's `MTrn` merged-transparency marker, from a layered TIFF saved with Save Transparency, marks the merged transparency) · **Target:** Adobe Photoshop 2026
 
 Every format Photoshop 2026 (27.11.0) reads or writes, with PhotoCraft's support, fidelity and
 tests. Photoshop's list comes from its `Info.plist` `CFBundleDocumentTypes`, the PiPL read/write
@@ -21,10 +21,10 @@ XL are missing (gap G10). Remaining: 300–500 h including PSD fidelity.
 
 | Format | Photoshop | PhotoCraft read | PhotoCraft write | Fidelity and tests |
 |---|---|---|---|---|
-| PSD | R/W | yes | yes | 1/8/16/32-bit; Bitmap, Gray, Indexed, RGB, CMYK, Multichannel, Lab, Duotone; layers, groups, masks, vector masks, adjustment and fill layers, effects, text, shapes, smart objects (SoLd/lnk2 with their warp: the bend presets, a custom mesh and, since #4112, Cylinder; CS2 PlLd/lnkD read with their warp, kept as is or re-saved as SoLd once edited), smart filters (53 mapped, among them Invert, the Distort filters but Shear, Clouds, Difference Clouds, Fibers and Lens Flare, plus Hue/Saturation, Perspective Warp, Filter Gallery with Chrome and a Camera Raw subset, rest verbatim), slices, comps, Advanced Blending, each layer's XMP packet (`layer.xmpMetadata`). Oracle floors: Photoshop-authored 190/258, io 148/170, psd-tools 249/309; round trip ≥ 169/170, 308/309, 258/256. Known failures: #1281, #2469 (#2374, text layers, closed 2026-10-10; #2465, CS2 `PlLd`-only smart objects, fixed 2026-10-12) |
+| PSD | R/W | yes | yes | 1/8/16/32-bit; Bitmap, Gray, Indexed, RGB, CMYK, Multichannel, Lab, Duotone; layers, groups, masks, vector masks, adjustment and fill layers, effects, text, shapes, smart objects (SoLd/lnk2 with their warp: the bend presets, a custom mesh and, since #4112, Cylinder; CS2 PlLd/lnkD read with their warp, kept as is or re-saved as SoLd once edited), smart filters (53 mapped, among them Invert, the Distort filters but Shear, Clouds, Difference Clouds, Fibers and Lens Flare, plus Hue/Saturation, Perspective Warp, Filter Gallery with Chrome and a Camera Raw subset, rest verbatim), slices, comps, Advanced Blending, each layer's XMP packet (`layer.xmpMetadata`); alpha and spot channels as Photoshop stores them (spot ink 0 = solid, channel identifiers in 1053), and PSDs with spot channels from PhotoCraft 0.1.0–0.16.0, which stored the ink the other way round, keep their ink. Oracle floors: Photoshop-authored 190/258, io 148/170, psd-tools 249/309; round trip ≥ 169/170, 308/309, 258/258. Known failures: #1281, #2469 (#2374, text layers, closed 2026-10-10; #2465, CS2 `PlLd`-only smart objects, fixed 2026-10-12) |
 | PSB | R/W | yes | yes | Auto-switches above 2 GB (REL-212-2); generated 20 MP, 150-layer, 2 GB PSD and 4.4 GB PSB fixtures opened, saved and re-opened by io tests/it/large_files.rs (FILE-216-2, 2026-10-13; the 4.4 GB PSB opens on Windows); > 4 GB from the app's File › Open on Windows: #375 |
 | Cloud PSD (.psdc) | R/W | no | no | Out of scope (Adobe cloud) |
-| TIFF | R/W | yes | yes | 8/16/32f, Gray/RGB/CMYK, BigTIFF, every IFD, banded parallel decode; layered TIFF both byte orders, including Photoshop mixed-order type blocks (#4758); LZW/ZIP for scripted saves by `tiffCompression`; undecodable type keeps saved pixels (FILE-215-7: extra alpha channels not written) |
+| TIFF | R/W | yes | yes | 8/16/32f, Gray/RGB/CMYK, BigTIFF, every IFD, banded parallel decode; layered TIFF both byte orders, including Photoshop mixed-order type blocks on read (#4758/#4771) and TySh text descriptors written in PSD order (#9098) and Photoshop's 14-byte `LMsk` block (#9095); LZW/ZIP for scripted saves by `tiffCompression`; undecodable type keeps saved pixels (FILE-215-7); alpha and spot channels as extra samples (at most 16) with Photoshop's names, ink colours and solidity, spot ink stored 0 = solid (#7415); no Save Transparency choice yet (channels are written as Photoshop does with it off) |
 | JPEG | R/W | yes | yes | 8-bit Gray/RGB/CMYK, ICC/EXIF/XMP; Save keeps the opened file's quality (estimated from its quantisation tables, #2399); File › Save, Save As and Save a Copy ask JPEG Options: Quality 0–12, starting at the opened file's quality or else the Export preference, and Baseline ("Standard") / Baseline Optimized / Progressive; scripts pass `quality`/`jpegFormat`, the CLI `--jpeg-format` (FILE-215-19). Baseline Optimized fits the Huffman tables only at 4:4:4 (Gray, CMYK) or progressive: RGB is written 4:2:0, which zune-jpeg 0.5.15 decodes wrongly with fitted tables, as in Save for Web. No Matte, progressive Scans (3–5) or size preview |
 | PNG | R/W | yes | yes | 8/16-bit, ICC/text; APNG first frame only; alpha channels on open (#2225); palette PNGs open in Indexed Color mode with their transparent entry (#4804); Save keeps a stereo PNG's `sTER` pairing (#6063) |
 | GIF | R/W | yes | yes | File › Open keeps the first frame; New Video Layer from File and Video Frames to Layers take every frame, with the timeline rate from the delays (#572). Per-frame delays and keeping the frames in `.pcraft` are not done |
@@ -47,7 +47,7 @@ XL are missing (gap G10). Remaining: 300–500 h including PSD fidelity.
 | DICOM | R/W | yes (#1048) | no | Read-only, uncompressed syntaxes: MONOCHROME1/2, RGB, YBR_FULL |
 | PCX | R/W | no | no | |
 | Pixar | R/W | no | no | |
-| Amiga IFF | R/W | yes | no | Read-only: 1–8 planes with CMAP, stored and ByteRun1 |
+| Amiga IFF | R/W | yes | yes (Save As `.iff`) | Read: 1–8 planes with CMAP and 24-plane RGB, stored and ByteRun1; write: 24-plane ILBM, ByteRun1, alpha as a 1-bit mask plane, 8-bit only |
 | Wireless Bitmap | R/W | no | no | |
 | MPO / JPS (stereo) | R/W | no | no | |
 | PICT | R | no | no | Legacy |
@@ -142,6 +142,12 @@ remaining gaps in #1606 stay tracked with per-sample corpus ceilings.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-24 | minor | Layered TIFF: the `LMsk` block in tag 37724 carries Photoshop's default global layer mask (14 bytes) instead of none; with an empty block Photoshop read only the composite (#9095). PSD output unchanged |
+| 2026-10-24 | minor | Layered TIFF writes the TySh text version and descriptor in PSD big-endian order while retaining container order for the block header, transform matrix, warp section and bounds (#9098); the mixed-order read path remains covered by #4758/#4771. |
+| 2026-10-23 | minor | PSD: spot channels are stored and read as Photoshop 27.11's PSDs store them (ink 0 = solid; all 7 of its spot PSDs store the 100/25/75/0 % columns as 0/191/64/255), and resource 1053 numbers the extra channels 3, 4, 5, … after 0 for the merged transparency. A PSD with spot channels whose 1057 is exactly what PhotoCraft 0.1.0–0.16.0 wrote, and with no 1053 or one kept from an opened Photoshop file that doesn't list every channel, is read as those versions stored it (straight past the channels that 1053 lists), so it keeps its ink. Multichannel is unchanged (#7415 split, part 4) |
+| 2026-10-23 | minor | TIFF: alpha and spot channels are written and read as extra samples (at most 16) with Photoshop's channel resources (1006, 1045, 1077, 1053), spot ink stored 0 = solid as Photoshop 27.11's TIFFs store it; PSD output is unchanged. FILE-215-7 done, FILE-215-17 partial (its TIFF part) (#7415, supersedes #3121) |
+| 2026-10-23 | patch | PSD and layered TIFF: the `MTrn` block Photoshop writes in a layered TIFF saved with Save Transparency (a positive layer count, `nrTM` in an `II` file) marks the merged image's first extra channel as its transparency, like `Mtrn`/`Mt16`/`Mt32`: such a file no longer opens with its transparency also as an alpha channel (named "Transparency" in Photoshop 27.11's file), and a PSD save no longer writes it twice. A PSD save with an opaque composite drops any of these markers kept from the opened file, so its first alpha channel no longer reopens as transparency and vanishes (split from #7415; credit #3121) |
+| 2026-10-23 | minor | Amiga IFF write: Save As `.iff` stores a 24-plane ILBM (ByteRun1, alpha as a 1-bit mask plane), and 24-plane ILBMs open |
 | 2026-10-22 | minor | 32-bit Hue/Saturation as Photoshop does it: the raised saturation isn't clipped (saturated colours leave 0..1), the chroma is scaled around the lightness by Photoshop's saturation factor (measured at every whole percent), so colours at or above lightness 1 keep their hue, and Colorize builds its colour with the saturation times 1 − \|Lightness\| (8 and 16 bits unchanged): photoshop rgb32 hue-saturation and hue-saturation-colorize pass; Photoshop-oracle floor 188 → 190 of 258 (#5781) |
 | 2026-10-19 | minor | JPEG Options on File › Save, Save As and Save a Copy (FILE-215-19 partial: no Matte, progressive Scans or size preview) |
 | 2026-10-18 | minor | Scripted TIFF saves take `tiffCompression` (none, LZW, ZIP), and the CLI `--tiff-compression` (#5301) |
diff --git a/docs/gaps.md b/docs/gaps.md
index d878a675f5..9168b453ba 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -1,6 +1,6 @@
 # Where PhotoCraft falls short of Photoshop
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-22 · **Change:** minor (G11: a recorded Save As imports with its format and file (`file.saveAs`, `file.saveACopy` for As a Copy) instead of as a plain Save that wrote over the played file, #7102; folder destinations stop playback until #5430; adjustment clipping stays visible in compact Properties, #5231; G9: Color panel modes, ramp and copy commands, the same in every theme, UI-217-17, #6000; G17: Help › Check for Updates and an opt-out check once per launch, DIST-220-1 partial, #5485; G10: `.asl` style libraries landed, #1051; G8: area type (TYPE-218-10); G1: smart objects keep Photoshop's Cylinder warp, #4112; G8: paragraph direction buttons in the Paragraph panel and options bar, TYPE-218-2 partial; G1: 32-bit Hue/Saturation and Colorize as Photoshop does them, Photoshop-oracle floor 190/258, #5781; G11: compound layer properties export as separate Photoshop Set events, rename last, #8304; G11: Batch and droplets take the result at the action's Save step, so actions ending in Save As and Close work; G11: `.atn` steps that switch to another open document import, play and save back, #7103; G14: the Nikon D4 white level follows the sample depth, so 12-bit D4 NEFs no longer open 2.6 stops dark, #5978; G14: a Nikon NEF's Adobe RGB preview is read as Adobe RGB (maker-note ColorSpace 0x001E), #5987; Apply Layer Comp action mapping, #7101; G10: JPEG Options dialog landed, FILE-215-19 partial (no Matte, progressive Scans or size preview); G10: Cineon write; G10: DPX read and write, #1049, Cineon and Amiga IFF read; Classical Object Finder improvement; learned segmentation remains open; G4: named, stateful section locks and visible keyboard focus in Brush Settings; G4: independent Brush Pose tilt-axis overrides, #3825 partial; G4: Transfer Mixer-only controls, #3825 partial; G9: Preferences › File Handling › Save in Background takes effect, #6207, 24 of 169 preferences do nothing; G7: Content-Aware Move previews every selection the command takes, coarse then exact, TOOL-213-4 done, #6680; G4: Pattern Stamp and Background Eraser draw live, TOOL-213-7; G9: Animated Zoom pref read: holding the Zoom tool zooms continuously, #6210, prefs that do nothing 25 of 166; G2: a cancelled 24 MP Gaussian Blur job stops in at most 44 ms, P25 under its 200 ms budget in local runs, baseline not re-run, #6205; G1: generated large-file fixtures, a 4.38 GB PSB opens on Windows through io, FILE-216-2 done, #5107; G9: fill and adjustment layers copy and paste whole, #2344; G1: smart filter masks show on PSD open, Photoshop-oracle floor 188/258; G10: DPX read and write, #1049, Cineon read; G1: CMYK Hue/Saturation and Color Balance keep the black ink; G1: CMYK Posterize on the stored values, psd-tools oracle floor 242/309; G1: CMYK adjustment layers composite on the document's inks, Photoshop-oracle floor 165/258; G1: CMYK Brightness/Contrast on the inks, CMYK Threshold's luma; G1: modern Brightness/Contrast's brightness curve matches Photoshop, Photoshop-oracle floor 151/258; G1: Lab documents composite on their stored L, a, b, Photoshop-oracle floor 152/258; G1: Levels on whole levels at every step, Photoshop-oracle floor 146/258, psd-tools 238/309; G1: 32-bit Brightness/Contrast legacy, Channel Mixer, Photo Filter and Black & White tint unclipped as in Photoshop, Photoshop-oracle floor 149/258; G1: mask feathers blur with their exact variance, psd-tools oracle floor 240/309; G1: Threshold splits on Photoshop's luminosity, psd-tools oracle floor 241/309; G1: pass-through clipping base with an adjustment renders isolated, psd-tools oracle floor 240/309; G1: 16-bit Posterize as Photoshop bins it, psd-tools oracle floor 241/309; G1: Gradient Map driven by the W3C luminosity, Photoshop-oracle floor 147/258; G7: Field Blur's on-canvas pins, #3373; G4: Hue Jitter amount track, #3825 partial; G4: minimum field interaction, #3825 partial; G1: CMYK Invert, Posterize and Threshold on the inks, 16-bit Lab Invert; Photoshop-oracle floor 145/258; G11: `.atn` import maps 112 events: Select and Mask, Filter Gallery Spatter, Ripple, Crystallize, Pattern Fill layers, mask targeting, Step Backward, nudges in points, Bitmap mode; G5: Free Transform H/V skew fields; G9: toolbar tool shortcut editing; refreshed against main: G2, G5, G7, G9, G10, G13, G14, G17 items that landed; G10: DPX read and write, #1049; G4: checkbox-only Brush Settings rows; G11: Load/Save Actions `.atn` landed, AUTO-219-2 partial; G5: hold-a-key spring-loaded tools landed, #2672; G1: #2465 fixed; stale missing-tool rows corrected: Color Replacement, Red Eye and Add/Delete Anchor Point are live tools, so only Art History Brush is missing; no estimate changed) · **Target:** Adobe Photoshop 2026
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-25 · **Change:** minor (G9: 12 of 178 preferences do nothing, as the scorecard prefs audit counts them; G6: Art History Brush landed as partial, TOOL-213-20, #1610, so no toolbar tool is missing; G4: five hard-round built-in presets use 5% spacing to remove stacked-tip outlines and reduce pressure-opacity bands, #8842; G9: Crop tool canvas menu, #6561; G2: Content-Aware Scale seam carving 1.65–3.6× faster with unchanged output, P28 row 3.3 → 1.6 s on a 4-core VM, #5236; G9: UI scale presets done, 105–120% steps, #3222; G14: lossy DNG, raw sidecars, Camera Raw Defaults live, Calibration and Auto, CR3 assessed as not clean-room feasible; G8: PSD type on a path opens on its path and saves back into the file's `Txt2`, #7962; G11: a recorded Save As imports with its format and file (`file.saveAs`, `file.saveACopy` for As a Copy) instead of as a plain Save that wrote over the played file, #7102; folder destinations stop playback until #5430; adjustment clipping stays visible in compact Properties, #5231; G9: Color panel modes, ramp and copy commands, the same in every theme, UI-217-17, #6000; G17: Help › Check for Updates and an opt-out check once per launch, DIST-220-1 partial, #5485; G10: `.asl` style libraries landed, #1051; G8: area type (TYPE-218-10); G1: smart objects keep Photoshop's Cylinder warp, #4112; G8: paragraph direction buttons in the Paragraph panel and options bar, TYPE-218-2 partial; G1: 32-bit Hue/Saturation and Colorize as Photoshop does them, Photoshop-oracle floor 190/258, #5781; G11: compound layer properties export as separate Photoshop Set events, rename last, #8304; G11: Batch and droplets take the result at the action's Save step, so actions ending in Save As and Close work; G11: `.atn` steps that switch to another open document import, play and save back, #7103; G14: the Nikon D4 white level follows the sample depth, so 12-bit D4 NEFs no longer open 2.6 stops dark, #5978; G14: a Nikon NEF's Adobe RGB preview is read as Adobe RGB (maker-note ColorSpace 0x001E), #5987; Apply Layer Comp action mapping, #7101; G10: JPEG Options dialog landed, FILE-215-19 partial (no Matte, progressive Scans or size preview); G10: Cineon write; G10: DPX read and write, #1049, Cineon and Amiga IFF read; Classical Object Finder improvement; learned segmentation remains open; G4: named, stateful section locks and visible keyboard focus in Brush Settings; G4: independent Brush Pose tilt-axis overrides, #3825 partial; G4: Transfer Mixer-only controls, #3825 partial; G9: Preferences › File Handling › Save in Background takes effect, #6207, 24 of 169 preferences do nothing; G7: Content-Aware Move previews every selection the command takes, coarse then exact, TOOL-213-4 done, #6680; G4: Pattern Stamp and Background Eraser draw live, TOOL-213-7; G9: Animated Zoom pref read: holding the Zoom tool zooms continuously, #6210, prefs that do nothing 25 of 166; G2: a cancelled 24 MP Gaussian Blur job stops in at most 44 ms, P25 under its 200 ms budget in local runs, baseline not re-run, #6205; G1: generated large-file fixtures, a 4.38 GB PSB opens on Windows through io, FILE-216-2 done, #5107; G9: fill and adjustment layers copy and paste whole, #2344; G1: smart filter masks show on PSD open, Photoshop-oracle floor 188/258; G10: DPX read and write, #1049, Cineon read; G1: CMYK Hue/Saturation and Color Balance keep the black ink; G1: CMYK Posterize on the stored values, psd-tools oracle floor 242/309; G1: CMYK adjustment layers composite on the document's inks, Photoshop-oracle floor 165/258; G1: CMYK Brightness/Contrast on the inks, CMYK Threshold's luma; G1: modern Brightness/Contrast's brightness curve matches Photoshop, Photoshop-oracle floor 151/258; G1: Lab documents composite on their stored L, a, b, Photoshop-oracle floor 152/258; G1: Levels on whole levels at every step, Photoshop-oracle floor 146/258, psd-tools 238/309; G1: 32-bit Brightness/Contrast legacy, Channel Mixer, Photo Filter and Black & White tint unclipped as in Photoshop, Photoshop-oracle floor 149/258; G1: mask feathers blur with their exact variance, psd-tools oracle floor 240/309; G1: Threshold splits on Photoshop's luminosity, psd-tools oracle floor 241/309; G1: pass-through clipping base with an adjustment renders isolated, psd-tools oracle floor 240/309; G1: 16-bit Posterize as Photoshop bins it, psd-tools oracle floor 241/309; G1: Gradient Map driven by the W3C luminosity, Photoshop-oracle floor 147/258; G7: Field Blur's on-canvas pins, #3373; G4: Hue Jitter amount track, #3825 partial; G4: minimum field interaction, #3825 partial; G1: CMYK Invert, Posterize and Threshold on the inks, 16-bit Lab Invert; Photoshop-oracle floor 145/258; G11: `.atn` import maps 112 events: Select and Mask, Filter Gallery Spatter, Ripple, Crystallize, Pattern Fill layers, mask targeting, Step Backward, nudges in points, Bitmap mode; G5: Free Transform H/V skew fields; G9: toolbar tool shortcut editing; refreshed against main: G2, G5, G7, G9, G10, G13, G14, G17 items that landed; G10: DPX read and write, #1049; G4: checkbox-only Brush Settings rows; G11: Load/Save Actions `.atn` landed, AUTO-219-2 partial; G5: hold-a-key spring-loaded tools landed, #2672; G1: #2465 fixed; stale missing-tool rows corrected: Color Replacement, Red Eye and Add/Delete Anchor Point are live tools, so only Art History Brush is missing; no estimate changed; G10: Amiga IFF write; G10: PSD spot channels in Photoshop's polarity, earlier PhotoCraft PSDs keep their ink, #7415 split; G10: TIFF alpha and spot channels written and read as extra samples, FILE-215-7 done, FILE-215-17's TIFF part, #7415) · **Target:** Adobe Photoshop 2026
 
 Every known shortfall against Photoshop 2026 (27.11.0), one entry each, ranked by user impact
 on the way to beta. This is the work list agents pick from: take the highest-ranked entry that
@@ -61,7 +61,8 @@ what an agent can't finish alone.
   scripted check there) is the only real oracle.
 
 ### G6. Missing tools
-- **Missing (1 of 68):** Art History Brush. Convert Point landed (#3204). Freeform
+- **Missing (0 of 68):** Art History Brush landed as partial (TOOL-213-20: 8 of 10 styles, Area
+  scales spacing, no Mode/Opacity on the options bar). Convert Point landed (#3204). Freeform
   Pen and Curvature Pen landed (#1054); Color Sampler landed (#1046, `view.colorSamplers.*`); Horizontal and Vertical Type Mask landed (#1055,
   `type.createSelection`); Perspective Crop landed (#1043, `image.perspectiveCrop`); Frame landed
   (#2914).
@@ -86,7 +87,9 @@ what an agent can't finish alone.
 - **Estimate:** 80–140 h.
 
 ### G8. Type depth
-- **Missing:** type on a path beyond rigid glyph placement (TYPE-218-1 partial, #4365; the Type tool's click on a shown path landed),
+- **Missing:** type on a path beyond rigid glyph placement (TYPE-218-1 partial, #4365; the Type tool's click on a shown path landed;
+  PSD path text in a new document still saves as point text, while Photoshop's path text opens on its path
+  and saves back into the file's `Txt2` since 2026-10-21, #7962),
   the visual RTL caret and PSD storage of the paragraph direction (TYPE-218-2; the paragraph
   direction buttons landed 2026-10-22), complex-script fallback fonts and golden tests
   (TYPE-218-3), OpenType Numerals and Stylistic Sets submenus
@@ -158,9 +161,15 @@ what an agent can't finish alone.
   (AGENTS.md forbids JS in the app).
 
 ### G14. Camera Raw depth
-- **Missing:** CR3 (detected, unsupported), compressed RAF, lossy DNG (FILE-215-11), .xmp
-  sidecars, masking and calibration in the Camera Raw dialog, per-camera colour for non-DNG
-  cameras, lens profiles.
+- **Missing:** CR3 sensor data (the embedded preview opens; the CRX codec has no public
+  specification, only LGPL implementations, so a clean-room decoder is not possible), compressed
+  RAF, highlight recovery modes (FILE-215-11), masking in the Camera Raw dialog, per-camera
+  colour for non-DNG cameras, lens profiles.
+- **Done 2026-10-13:** lossy DNG decodes (#5112); `.xmp` sidecars beside raw files fill the
+  open-time dialog and Open writes them back; the Camera Raw Defaults preferences (colour space,
+  bit depth, resolution, Sharpen For, Open as Smart Object, Apply auto tone, sidecars) all take
+  effect on open; the dialog has the Calibration panel (Shadows tint, primaries' hue and
+  saturation) and an Auto button, both in the `.xmp` settings and the `filter.cameraRaw` params.
 - **Evidence:** `crates/raw/src/lib.rs:228` (CR3), scorecard FILE-215-11/12, #50.
 - **Progress (2026-10-11):** on the embedded-JPEG rendering work in #2135, Camera Raw
   tuning retains the fitted look and applies user gains afterwards. Three D5100 NEFs
@@ -208,6 +217,12 @@ what an agent can't finish alone.
 - **Estimate:** 250–400 h (many overlap with other gaps; count each fix once).
 
 ### G4. Brush feel
+- **Progress (2026-10-23, #8842):** the five hard-round built-in presets use 5% spacing.
+  At 150 px, this removes the scalloped outline from the former 25% spacing and reduces
+  nested dab boundaries in pressure-opacity tapers. Pixel regressions cover 8/16/32-bit
+  and 0/49% smoothing. Other presets, explicit spacing and remembered brushes retain their
+  settings; reselect a built-in preset to take its new default. Other brush-feel and latency
+  gaps remain open; percentages and estimates are unchanged.
 - **Progress (2026-10-13, #3825 partial):** Transfer’s Wetness Jitter and Mix Jitter
   blocks are disabled outside the Mixer Brush, retaining their saved settings. Opacity
   and Flow keep their existing availability; other layout and brush-feel gaps remain open.
@@ -258,6 +273,8 @@ what an agent can't finish alone.
 
 ### G9. Panels, preferences and workspace
 - **Progress (2026-10-21):** adjustment clipping is reachable above the Properties editor in a compact dock (#5231), with all-theme layout coverage and 8/16/32-bit scope and undo/redo tests. The normal adjustment-layer scope and remaining estimate stay unchanged.
+- **Progress (2026-10-16, #3222):** UI scale presets are complete: 75–125% in 5% steps,
+  then 150–300%, remembered through preferences (UI-217-9).
 - **Progress (2026-10-15):** Preferences › General › Animated Zoom takes effect: a held Zoom
   tool press zooms continuously about the press point, ⌥ out (#6210, `ui-egui/src/zoom_hold.rs`).
 - **Progress (2026-10-14, #5556):** Character and Paragraph controls stay available without
@@ -268,10 +285,10 @@ what an agent can't finish alone.
 - **Progress (2026-10-15):** the Color panel has Photoshop's panel-menu modes (Hue Cube, Brightness
   Cube, Color Wheel, Grayscale/RGB/HSB/CMYK/Lab/Web Color sliders), its colour ramp and copy
   commands, the same in every theme (UI-217-17, #2569, #6000; `ui-egui/src/color_panel_ui.rs`).
-- **Missing:** 24 of 171 preferences do nothing (scorecard prefs audit, 2026-10-15: Save in
-  Background now takes effect, #6207); panel groups can't
+- **Missing:** 12 of 178 preferences do nothing (scorecard prefs audit, 2026-10-25); panel groups can't
   float or tear off into OS windows (UI-217-5, #1828, #1213, #2305); more themes (UI-217-11, #2661); a single pixel layer
-  copies without its mask and styles (UI-217-23; fill and adjustment layers copy whole, #2344); tool-specific context menus beyond brushes, selections and Pen
+  copies without its mask and styles (UI-217-23; fill and adjustment layers copy whole, #2344); tool-specific context menus beyond brushes, selections, Pen and
+  Crop
   ([context-menu-parity.md](context-menu-parity.md)); Libraries, Comments, Contextual Task Bar
   panels.
 - **Estimate:** 150–250 h.
@@ -291,10 +308,19 @@ what an agent can't finish alone.
   other layers gain only the strip checks. Local runs, `perf/baseline.json` not re-measured yet
   (the scorecard still shows P25 as not run); command, revision, machine and per-run numbers in
   #6206. #6205.
+- **Measured progress (2026-10-13):** Content-Aware Scale (P28) keeps its seam search across
+  seams and moves no pixels. On a 4-core cloud VM (CPU, interleaved runs), the carve of P28's
+  24 MP photo to 90 % width takes 556 ms instead of 2013 ms (3.6×), and the whole P28 row takes
+  1.64 s instead of 3.28 s, within its 3 s budget. Smaller images on the full-resolution search
+  are 1.65–2.3× faster. Output is bit-identical wherever the energy stays a number (pinned
+  hashes); NaN and infinities are now deterministic. The scorecard keeps the 2026-10-05
+  baseline's 954 s, which predates the per-seam energy updates and the reduced-height search,
+  until the reference machine reruns it. Most of the row is now `read_region`/`write_region`
+  plumbing. [Method and ranges](seam-carving-performance.md).
 - **Missing:** 22 of 25 budgeted scenarios are over budget (baseline 2026-10-05, a heavily
   loaded machine): layer move with styles 321 ms p50 against 25 ms, opacity change 276 ms
   against 20 ms, paste 12 MP 1.2 s against 100 ms, layer move on 15000×10000 16-bit 2.7 s,
-  Content-Aware Scale 24 MP 954 s against 3 s, Select Subject 559 ms against 100 ms; the
+  Content-Aware Scale 24 MP 954 s against 3 s (older code; now met, see above), Select Subject 559 ms against 100 ms; the
   150-layer nudge crashes the GPU compositor (P12); menus slow with thousands of layers (#2460); old machines lag (#2687).
 - **Estimate:** 200–350 h. Serial in places (compositor architecture).
 
@@ -304,16 +330,22 @@ what an agent can't finish alone.
 - **Missing:** JPEG Options' Matte, progressive Scans and size preview (FILE-215-19 partial), Photoshop PDF read and its vector/text/multi-page
   write (FILE-215-10, #2541; a single flattened page now saves via Save As / Save a Copy / CLI,
   2026-10-11, #3401), AVIF read (#463) and default-build AVIF write, JPEG XL, JPEG 2000 (#1047),
-  DICOM, EPS/DCS, Pixar, IFF write (read landed), WBMP, MPO/JPS, PICT, Scitex CT, Photoshop
-  Raw; layered TIFF extra alpha channels (FILE-215-7); spot plates (FILE-215-17); .atn,
+  DICOM, EPS/DCS, Pixar, WBMP, MPO/JPS, PICT, Scitex CT, Photoshop
+  Raw; spot plates beyond PSD and TIFF: spot ink preview in RGB/CMYK documents and PDF Separation
+  (FILE-215-17); .atn,
   .shc, .csh presets (.asl landed 2026-10-20) (FILE-215-15); C2PA (#1050).
 - **Detail:** [`file-format-parity.md`](file-format-parity.md).
+- **Progress (2026-10-23, #7415 split):** PSD stores and reads spot channels as Photoshop does (ink
+  0 = solid) and writes their identifiers (1053); PSDs from PhotoCraft 0.1.0–0.16.0, which stored
+  spot ink the other way round, keep their ink.
+- **Progress (2026-10-23, #7415):** TIFF writes and reads alpha and spot channels as extra samples
+  with Photoshop's names, ink colours and solidity (FILE-215-7 done; FILE-215-17's TIFF part).
 - **Progress (2026-10-15):** Cineon (`.cin`) 10-bit gray/RGB frames open and save (Save As
   `.cin`), sharing the DPX header/packing (`crates/codecs/src/codecs/dpx.rs`); a Cineon frame saved
   back keeps its code values.
-- **Progress (2026-10-13):** Amiga IFF/ILBM (`FORM ... ILBM`/`PBM `) 1–8-plane paletted bitmaps
-  open read-only, stored or ByteRun1-compressed (`crates/codecs/src/codecs/iff.rs`); writing is
-  still open.
+- **Progress (2026-10-23):** Amiga IFF/ILBM (`FORM ... ILBM`/`PBM `) 1–8-plane paletted and
+  24-plane RGB bitmaps open, stored or ByteRun1-compressed (`crates/codecs/src/codecs/iff.rs`);
+  Save As `.iff` writes a 24-plane ILBM with a 1-bit mask plane for alpha.
 - **Estimate:** 120–220 h.
 
 ## Hardware gaps
@@ -358,11 +390,18 @@ what an agent can't finish alone.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-25 | minor | G9: the count of preferences that do nothing is the scorecard's again, 12 of 178 (it still said 24 of 171, from 2026-10-15); no estimate changed |
+| 2026-10-25 | minor | G6: Art History Brush landed as partial (TOOL-213-20, #1610), so no toolbar tool is missing; no percentage or estimate changed |
+| 2026-10-23 | minor | G4: hard-round built-in presets use 5% spacing (#8842), guarded by large-stroke outline and pressure-opacity pixel regressions at 8/16/32-bit; percentages and estimates unchanged |
+| 2026-10-23 | minor | G10: PSD stores and reads spot channels as Photoshop does (ink 0 = solid) with their identifiers (1053); PSDs from PhotoCraft 0.1.0–0.16.0 keep their ink (#7415 split, part 4); FILE-215-17 stays partial; estimate unchanged |
+| 2026-10-23 | minor | G10: TIFF alpha and spot channels written and read as extra samples with Photoshop's channel resources, PSD output unchanged (#7415); FILE-215-7 leaves the list, FILE-215-17 narrows to RGB/CMYK spot preview and PDF Separation |
+| 2026-10-23 | minor | G10: Amiga IFF write landed (24-plane ILBM, Save As `.iff`) and 24-plane ILBMs open |
 | 2026-10-22 | minor | G17: Help › Check for Updates and an opt-out check once per launch (#5485), DIST-220-1 partial; estimate unchanged |
 | 2026-10-22 | minor | G1: 32-bit Hue/Saturation unclipped with Photoshop's saturation factor, bright colours keep their hue, Colorize's saturation scaled by 1 − \|Lightness\|; photoshop rgb32 hue-saturation and hue-saturation-colorize pass; Photoshop-oracle floor 188 → 190 of 258 (#5781) |
 | 2026-10-21 | minor | G9: adjustment clipping remains visible in compact Properties (#5231); no readiness percentage or estimate changed |
 | 2026-10-21 | minor | #8304: compound layer properties export as separate Set events, rename last; independent Photoshop replay pending; percentages and estimates unchanged |
 | 2026-10-21 | minor | G11: Batch and droplets take the result at the action's recorded Save / Save As step (Photoshop's "Override Action 'Save As' Commands"); estimate unchanged |
+| 2026-10-21 | minor | G9: right-click on a pending crop opens the Crop tool menu (presets, Clear, overlays, Cancel, Crop; #6561); Reset still open |
 | 2026-10-22 | minor | G8: Auto / Left-to-right / Right-to-left paragraph direction buttons in the Paragraph panel, Properties and the Type options bar (#6793); TYPE-218-2 partial (the visual RTL caret is still missing, and PSD doesn't store the direction yet) |
 | 2026-10-19 | minor | G10: JPEG Options dialog landed (FILE-215-19 partial: no Matte, progressive Scans or size preview); no readiness percentage or estimate changed |
 | 2026-10-19 | minor | G11: `.atn` steps that select another open document by offset import as `document.activate {"offset"}`, play and save back (#7103); estimate unchanged |
@@ -372,11 +411,13 @@ what an agent can't finish alone.
 | 2026-10-15 | minor | G10: Cineon write landed (10-bit log gray/RGB, Save As `.cin`) |
 | 2026-10-14 | minor | G1: 32-bit Hue/Saturation unclipped (slider on whole levels) and Colorize's saturation scaled by 1 − \|Lightness\|; photoshop rgb32 hue-saturation and hue-saturation-colorize pass |
 | 2026-10-14 | minor | G1: Lab adjustment layers' results are whole samples (native Lab path); photoshop lab8 curves passes |
+| 2026-10-21 | minor | G8: Photoshop's type on a path opens on its path (read from the `Txt2` frame) and saves back into the file's `Txt2` object (#7962); TYPE-218-1 stays partial (new documents save path text as point text) |
 | 2026-10-19 | minor | G9: Color panel modes, ramp and copy commands from its panel menu, the same in every theme (UI-217-17 done, #6000) |
 | 2026-10-15 | minor | G1 / #5972 A1: render only provably constant-RGB `GdFl` noise fills; variable noise synthesis remains open |
 | 2026-10-20 | minor | G10: `.asl` layer style library import and export landed (#1051) |
 | 2026-10-18 | minor | G9: with no selection, Copy takes fill and adjustment layers whole and Paste recreates them (#2344); UI-217-23 stays partial (a single pixel layer copies its pixels only); estimate unchanged |
 | 2026-10-17 | minor | G11: `.atn` Apply Layer Comp imports, plays and exports by comp name (#7101); other reference forms remain unsupported |
+| 2026-10-16 | minor | G9: UI scale presets done, 105–120% steps, #3222 |
 | 2026-10-15 | minor | G2: a cancelled 24 MP Gaussian Blur job stops within 44 ms max (P25, budget 200 ms; was about 400 ms; local runs, baseline not re-run), the uncancelled job on a locked-transparency layer about 40% faster; #6205 |
 | 2026-10-15 | minor | G9: Animated Zoom preference takes effect (hold the Zoom tool to zoom continuously, #6210); prefs that do nothing 25 of 166; no estimate changed |
 | 2026-10-16 | minor | G7: Content-Aware Move's live preview covers every selection the command takes (over 256 × 256: a coarse result solved scaled down, then the exact one); TOOL-213-4 done (#6680) |
@@ -410,7 +451,9 @@ what an agent can't finish alone.
 | 2026-10-13 | minor | G6: stale "missing tool" list corrected against `main` — Color Replacement (`paint.colorReplacement`), Red Eye (`paint.redEye`) and Add/Delete Anchor Point (P flyout, #4144) are live tools, so the toolbox is 67 of 68 and Art History Brush is the only one missing; no percentage or estimate changed |
 | 2026-10-13 | minor | G10: Amiga IFF/ILBM read landed (1–8 planes, CMAP, stored and ByteRun1); IFF write remains open |
 | 2026-10-13 | minor | G8: a Type tool click on the work path or the active shape layer's path starts type on it at the point clicked (TYPE-218-1, partial); no readiness percentage or estimate changed |
+| 2026-10-13 | minor | G14: lossy DNG (#5112), `.xmp` sidecars, Camera Raw Defaults wired, Calibration panel and Auto; CR3 sensor decode ruled out under the clean-room rule |
 | 2026-10-13 | minor | G4: Hue Jitter amount-track appearance (#3825, partial); no readiness percentage or estimate changed |
+| 2026-10-13 | minor | G2: Content-Aware Scale (P28) measured: carve 2013 → 556 ms, row 3.28 → 1.64 s on a 4-core VM, output unchanged; baseline, budgets and estimate unchanged |
 | 2026-10-13 | minor | G4: minimum inputs in Shape Dynamics and Transfer follow their Control (#3825, partial); no readiness percentage or estimate changed |
 | 2026-10-12 | minor | G5: Free Transform options bar H/V skew fields done |
 | 2026-10-12 | minor | G11: `.atn` import maps 112 events (Select and Mask, Spatter, Ripple, Crystallize, Pattern Fill, mask targeting, Step Backward, points, Bitmap) |
diff --git a/docs/hardware-parity.md b/docs/hardware-parity.md
index 391c92f0ce..e8f6a6da1b 100644
--- a/docs/hardware-parity.md
+++ b/docs/hardware-parity.md
@@ -1,6 +1,6 @@
 # Hardware parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (first version: GPU, pen tablets, displays, gestures per platform against Photoshop 2026) · **Target:** Adobe Photoshop 2026
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-17 · **Change:** minor (Camera Raw's preview develops its per-pixel stages on the GPU) · **Target:** Adobe Photoshop 2026
 
 Each hardware feature Photoshop 2026 (27.11.0) uses, per platform, against PhotoCraft. Photoshop
 side: its bundle (Metal and OpenCL paths, "Precise Color Management for HDR Display" and EDR
@@ -19,7 +19,7 @@ HDR display to verify.
 |---|---|---|---|
 | GPU canvas, zoom/pan, rotate view | Metal (macOS), DirectX/OpenCL (Windows) | wgpu 30: Metal, Vulkan, DX12, GL; backend selectable | done |
 | GPU compositing of layers, blend modes, effects | partial (Photoshop composites mostly on CPU) | wgpu compositor, ≤ 1/255 vs CPU oracle; Multichannel and > texture-limit regions fall back to CPU | done (ahead in places) |
-| GPU filters (Blur Gallery, Liquify, Smart Sharpen, Camera Raw) | yes | CPU (rayon) for filters; GPU for compose and effects | partial |
+| GPU filters (Blur Gallery, Liquify, Smart Sharpen, Camera Raw) | yes | CPU (rayon) for filters; GPU for compose and effects. Camera Raw's preview runs its per-pixel stages (white balance to grain) in one wgpu pass, about 2-3 ms vs 11-28 ms on the CPU for the 858×572 proxy, depending on the machine; spatial stages, Calibration and OK still develop on the CPU (#6916) | partial |
 | Documents larger than the GPU texture limit | yes (tiled) | CPU fallback; tiling in progress (#49) | partial |
 | CPU-only fallback when no GPU | yes, reduced | `cpu` canvas preference; fails to start without an adapter on some Linux systems (#2519, #2412) | partial |
 | Choosing the GPU on a multi-GPU machine | Preferences › Performance › Use Graphics Processor | Linux only: Preferences › Performance › Advanced › GPU adapter and `PHOTOCRAFT_GPU_ADAPTER` (#1885); ignored on Windows and macOS | partial |
@@ -63,4 +63,5 @@ HDR display to verify.
 | Date | Change | Summary |
 |---|---|---|
 | 2026-10-10 | major | First version |
+| 2026-10-17 | minor | GPU filters: Camera Raw's preview, per-pixel stages (#6916 step 1) |
 | 2026-10-19 | minor | Graphics Adapter choice on Linux (#1885) |
diff --git a/docs/releasing.md b/docs/releasing.md
index 81e24ba8ef..502e46b3ac 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -180,7 +180,9 @@ goes in `CARGO_TARGET_<TRIPLE>_RUSTFLAGS`, so host build scripts aren't affected
   1. a `.pfx` file (`WINDOWS_CERTIFICATE`, `WINDOWS_CERTIFICATE_PASSWORD`), timestamped by
      DigiCert, or
   2. Azure Trusted Signing (`AZURE_*`): the script downloads the
-     `Microsoft.Trusted.Signing.Client` dlib and timestamps with Microsoft's server.
+     `Microsoft.Trusted.Signing.Client` dlib and timestamps with Microsoft's server. The package
+     is pinned to a version and SHA-256 at the top of `sign.ps1` and refused on a mismatch, so an
+     upgrade is a deliberate change to both.
 
   The script is the single place to change when the Windows signing setup changes.
 
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 85c355bc5f..1745ed04dd 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -32,7 +32,7 @@ that blocks the workflow, would make PhotoCraft pre-alpha.
 | Core workflow | Works end to end? | Evidence | Hours to pass |
 |---|---|---|---:|
 | Photo retouch: open JPEG/raw, heal/clone/remove, adjustment layers, export JPEG, save and reopen | yes | Spot Healing, Healing, Clone, Patch, Remove tools; 16 adjustment layers; raw for DNG/CR2/NEF/ARW/RAF; JPEG export; MCP workflow tests (`automation/tests/it/agent_tasks.rs`). Quality complaints (#1092, #2104) and no CR3 don't stop the workflow | 0 |
-| Composite: layers, masks, selections, blend modes, smart objects; save as PSD and `.pcraft` and reopen | yes | PSD round trip ≥ 169/170, 308/309, 258/256 corpus files; `.pcraft` atomic save and crash recovery. Multi-layer Smart Object conversion (#2604) and mask targeting (#2458) are partial but have workarounds | 0 |
+| Composite: layers, masks, selections, blend modes, smart objects; save as PSD and `.pcraft` and reopen | yes | PSD round trip ≥ 169/170, 308/309, 258/258 corpus files; `.pcraft` atomic save and crash recovery. Multi-layer Smart Object conversion (#2604) and mask targeting (#2458) are partial but have workarounds | 0 |
 | Cut-out: select a subject, refine the edge, mask, export PNG with transparency | partial (not blocking) | Object/Quick Selection, Select Subject (classical), Refine Edge dialog, layer masks, PNG export. Select and Mask is a dialog, not the workspace; no Refine Hair (#2671) | 0 (depth: 80–140 h, G7) |
 | Design: type, shapes, layer styles, artboards; export PNG/JPEG; save and reopen | partial (not blocking) | Point/paragraph type, shapes with stroke controls, all 10 layer effects, artboards, Export As. One macOS report of a 60 s freeze on choosing the Type tool (#2518, not reproduced); no type on a path | 0 (fix #2518: 2–6 h) |
 | Paint with a pen tablet: pressure brushes, layers, save and reopen | partial (not blocking) | Pressure, tilt, rotation on macOS (AppKit monitor); every Brush Settings section. Lag with big brushes (#2619) and feel gaps ([brush-parity.md](brush-parity.md)) | 0 (feel: 100–180 h, G4) |
diff --git a/docs/scorecard.md b/docs/scorecard.md
index 09f8c61ab9..d025e67944 100644
--- a/docs/scorecard.md
+++ b/docs/scorecard.md
@@ -1,15 +1,15 @@
 # PhotoCraft scorecard
 
-Generated by `cargo xtask scorecard` from `perf/budgets.toml`, `perf/baseline.json`, `crates/io/tests/it/corpus.rs`, `scorecard/*.toml` and the source tree. Do not edit by hand: change the sources and regenerate (CI runs `cargo xtask scorecard --check`). Checklist statuses are verified against the code; numbers here supersede estimates elsewhere.
+Generated by `cargo xtask scorecard` from `perf/budgets.toml`, `perf/baseline.json`, `crates/io/tests/it/corpus.rs`, `xtask/*-corpus.sha256`, `scorecard/*.toml` and the source tree. Do not edit by hand: change the sources and regenerate (CI runs `cargo xtask scorecard --check`). Checklist statuses are verified against the code; numbers here supersede estimates elsewhere.
 
 ## Summary
 
 | Area | Done | Partial | Missing | Key numbers |
 |---|---:|---:|---:|---|
-| [Performance](#performance) | 3 | 22 | 30 | 64 scenarios: 3 within budget, 22 over budget or failing, 9 tracked only, 26 not run, 4 not measurable yet (baseline 2026-10-05) |
-| [File compatibility](#file-compatibility) | 9 | 13 | 5 | io corpus: oracle ≥ 148/170, round trip ≥ 169/170; psd-tools corpus: oracle ≥ 249/309, round trip ≥ 308/309; photoshop oracles: oracle ≥ 190/256, round trip ≥ 258/256 |
-| [Tools](#tools) | 36 | 8 | 0 |  |
-| [Workspace and UI](#workspace-and-ui) | 15 | 6 | 2 | settings that do nothing: 20 of 177 (target 0) |
+| [Performance](#performance) | 3 | 22 | 31 | 65 scenarios: 3 within budget, 22 over budget or failing, 9 tracked only, 27 not run, 4 not measurable yet (baseline 2026-10-05) |
+| [File compatibility](#file-compatibility) | 11 | 14 | 2 | io corpus: oracle ≥ 148/170, round trip ≥ 169/170; psd-tools corpus: oracle ≥ 249/309, round trip ≥ 308/309; photoshop oracles: oracle ≥ 190/258, round trip ≥ 258/258 |
+| [Tools](#tools) | 36 | 9 | 0 |  |
+| [Workspace and UI](#workspace-and-ui) | 15 | 6 | 2 | settings that do nothing: 12 of 178 (target 0) |
 | [Type](#type) | 5 | 5 | 0 |  |
 | [Automation](#automation) | 5 | 2 | 4 | 631 of 631 menu items live (100.0%) |
 | [Reliability](#reliability) | 5 | 2 | 0 | never-crash lints on 30 of 30 crates; panic_hunt present |
@@ -84,6 +84,7 @@ Baseline: 2026-10-05, commit `f5d2bcb54a`, Apple M4 Pro (48 GB), GPU Apple M4 Pr
 | P65 | Smart Blur r 12 on 24 MP (High quality) | ≤ 1000 ms p95 | – | – | – | – | – | not run | [#211](https://github.com/storytold/photocraft/issues/211) |
 | P66 | Relight on 24 MP | ≤ 1000 ms p95 | – | – | – | – | – | not run | [#211](https://github.com/storytold/photocraft/issues/211) |
 | P67 | Reduce Noise on 24 MP | ≤ 1000 ms p95 | – | – | – | – | – | not run | [#211](https://github.com/storytold/photocraft/issues/211) |
+| P68 | Photomerge multi-band blend, synthetic | track timing and peak RSS; no calibrated performance budget | – | – | – | – | – | not run | [#7758](https://github.com/storytold/photocraft/issues/7758) |
 
 **Not measurable yet** (the code can't do it yet; no number is recorded):
 
@@ -102,27 +103,27 @@ Corpus floors (`crates/io/tests/it/corpus.rs`): the enforced minimums; the corpu
 |---|---|---:|---:|---:|
 | io corpus | `corpus/psd` | 170 | 148 | 169 |
 | psd-tools corpus | `corpus/psd-tools` | 309 | 249 | 308 |
-| photoshop oracles | `corpus/photoshop` | 256 | 190 | 258 |
+| photoshop oracles | `corpus/photoshop` | 258 | 190 | 258 |
 
 | Id | Target | Status | Issue | Note |
 |---|---|---|---|---|
 | FILE-215-1 | Smart Objects export as embedded Smart Objects (SoLd + lnk2), not flat pixels | done | [#215](https://github.com/storytold/photocraft/issues/215) | psd_export.rs smart_blocks: PlLd + SoLd, source in lnk2 (.pcraft -> PSB); engine tests/it/smart_psd.rs; Photoshop 2026 opens 8/16-bit exports as live smart objects. Linked files are embedded |
 | FILE-215-2 | Smart Filters survive PSD save and re-open (filterFX descriptor read and written) | partial | [#215](https://github.com/storytold/photocraft/issues/215) | smart_map.rs: 49 filters plus Hue/Saturation, Perspective Warp, Filter Gallery (Chrome) and a verified Camera Raw subset mapped both ways, others kept verbatim, mask in FEid; io tests/it/smart_corpus.rs. PhotoCraft-only filters (Twirl, Liquify…) and unmapped Camera Raw settings are left out of filterFX with a warning |
-| FILE-215-3 | Filter mask can be painted directly, with undo | missing | [#215](https://github.com/storytold/photocraft/issues/215) | smart_cmds.rs:382 mask only from the selection |
+| FILE-215-3 | Filter mask can be painted directly, with undo | done | [#215](https://github.com/storytold/photocraft/issues/215) | Clicking the filter mask thumbnail on the Smart Filters row targets it (ui.filterMaskTarget, smart_ui.rs). Painting, fills, filters and adjustments with "target":"filterMask" then edit it (a white mask starts on the first stroke) and re-render the smart object, one undo step per stroke (channel_cmds Target::FilterMask, Session::edit). ⌥-click shows it (view.layerMask "mask":"filter"), ⇧-click disables it. Kept through .pcraft and PSD FEid (smart_cmds/tests/filter_mask_paint.rs) |
 | FILE-215-4 | Adjustments (Hue/Sat + Colorize, Curves, Levels, Shadows/Highlights) apply as Smart Filters | done | [#215](https://github.com/storytold/photocraft/issues/215) | Image › Adjustments on a smart object records image.adjustments.<kind> as a smart filter (adjust_cmds.rs adjust_as_smart_filter; the selection becomes the filter mask), re-rendered from the source by adjust_as_filter and re-editable with layer.smartFilter.setParams; PSD maps Levels/Curves/Shadows-Highlights both ways (smart_map.rs). Opening the editor from the smart-filter row is FILE-215-5's row work |
 | FILE-215-5 | Smart Filter rows: collapse, mask thumb, blend icon, drag reorder, context menu, live preview | partial | [#215](https://github.com/storytold/photocraft/issues/215) | smart_ui.rs:31 rows + visibility + editor; no collapse, drag or context menu |
 | FILE-215-6 | Smart Object corner skew and perspective (quad or homography transform) | done | [#215](https://github.com/storytold/photocraft/issues/215) | #426: SmartObject.perspective holds the projective map (transform keeps its affine approximation); Distort / Perspective on a smart object set it (transform_cmds.rs, smart_cmds::set_placement), it re-renders from the source through the homography, Warp composes with it, and the PSD placement reads and writes nonAffineTransform / Trnf (io/blocks.rs placed_projective, smart_map.rs); tests distort_survives_edit_contents, warp_on_a_distorted_smart_object_follows_the_corners, placement survives the save |
-| FILE-215-7 | Layered TIFF read and write (tag 37724), honouring the ask-before-saving pref | partial | [#215](https://github.com/storytold/photocraft/issues/215) | psd tiff.rs (ImageSourceData, both byte orders), io tiff_layers.rs, ui tiff_options_ui.rs (Discard Layers and Save a Copy); extra alpha channels and a Quick Mask are not written (the TIFF codec holds one transparency sample) |
+| FILE-215-7 | Layered TIFF read and write (tag 37724), honouring the ask-before-saving pref | done | [#215](https://github.com/storytold/photocraft/issues/215) | psd tiff.rs (ImageSourceData, both byte orders), io tiff_layers.rs, ui tiff_options_ui.rs (Discard Layers and Save a Copy); extra alpha/spot channels and a Quick Mask are written as TIFF extra samples (at most 16) plus Photoshop resources for name, colour and solidity; Photoshop's MTrn marker is read (#7415). The TIFF Options Save Transparency choice isn't offered: channels are written as Photoshop does with it off |
 | FILE-215-8 | Large and BigTIFF import with banded decode across all IFDs | done | [#215](https://github.com/storytold/photocraft/issues/215) | codecs tiff_ifd.rs (bounds-checked IFD chain + SubIFD walk, classic and BigTIFF, cycle-safe; tiff_info / decode_tiff_page), tiff.rs banded parallel strip/tile decode, planar 1 and 2, BigTIFF write (tiff_bigtiff or > 4 GiB); io import_tiff_page; 30 MP RGB8 Deflate 345 -> 32 ms; no page picker in the UI yet |
 | FILE-215-9 | SVG opens and places as shape layers or a vector Smart Object | done | [#215](https://github.com/storytold/photocraft/issues/215) | io svg.rs: paths, groups, text outlines as shape layers (gradients approximated; clip/mask/filter/pattern/image subtrees rasterised); smart_cmds.rs renders an SVG source at its placement scale |
 | FILE-215-10 | Multi-page PDF save, PDF presentation, layer comps to PDF, vector/text output, PDF import | partial | [#215](https://github.com/storytold/photocraft/issues/215) | io pdf.rs: Save As / Save a Copy / CLI write one flattened RGB/Gray/CMYK page with ICC (#3401); print PDFs in print_cmds. Multi-page save, presentation, comps, vector/text output and PDF import (#2541) remain |
-| FILE-215-11 | RAW: lossy DNG, highlight modes, .xmp sidecars, RAW prefs wired, per-camera corpus | missing | [#215](https://github.com/storytold/photocraft/issues/215) | raw sensor.rs:210 lossy DNG unsupported; raw_defaults unread; no xmp |
+| FILE-215-11 | RAW: lossy DNG, highlight modes, .xmp sidecars, RAW prefs wired, per-camera corpus | partial | [#215](https://github.com/storytold/photocraft/issues/215) | 2026-10-13: lossy DNG (34892) decodes stored 8-bit samples with padded edge tiles (raw sensor.rs lossy_jpeg, #5112); a raw's sidecar IMG.xmp fills the open-time dialog and Open writes it back (camera_raw_ui.rs read_sidecar/write_sidecar, pref rawDefaults.writeXmpSidecars); every Camera Raw Defaults preference is read (colour space, bit depth, resolution, Sharpen For, Open as Smart Object, Apply auto tone: apply_raw_defaults); Calibration panel (shadow tint, primaries hue/saturation) in the dialog, the filter and the crs: keys. Still missing: highlight recovery modes, the absolute (kelvin) white balance of raw sidecars, a per-camera corpus |
 | FILE-215-12 | Camera Raw dialog shows a histogram; settings persist as a PSD Smart Filter | partial | [#215](https://github.com/storytold/photocraft/issues/215) | Interactive RGB/Lab scopes. PSD WB/Light/Presence, curves, HSL, grading, sharpening/noise detail, grain and numeric vignette controls mapped with descriptor preservation. Active manual Optics and unverified vignette style keep the updated ACR 18.4 fixture opaque; PSD/.pcraft saves preserve it. HDR, remaining settings and Photoshop acceptance still open |
 | FILE-215-13 | Video layer frames persist in .pcraft; PSD video layers mapped | partial | [#215](https://github.com/storytold/photocraft/issues/215) | format convert.rs:89 + tests/it/roundtrip.rs:282 persist frames; no PSD video mapping |
 | FILE-215-14 | User swatch model with ACO/ASE import and export | done | [#215](https://github.com/storytold/photocraft/issues/215) | engine presets/swatches.rs (RGB/HSB/CMYK/Lab/Gray + verbatim colour books, persisted in prefs) + swatch_cmds.rs (swatches.*); psd aco.rs (v1/v2) and ase.rs (groups, spot/global) read+write; ui swatches_ui.rs, Color Picker Add to Swatches |
 | FILE-215-15 | Layer Style contour picker, curve editor, presets, .shc import/export | partial | [#2912](https://github.com/storytold/photocraft/issues/2912) | Layer Style dialog: contour thumbnail + preset picker (12 standard shapes, own control points) and Anti-aliased on Drop/Inner Shadow, Outer/Inner Glow, Satin, Bevel Gloss Contour and Contour element; Contour Editor (add/drag/delete, Corner, Input/Output, Preset, Load…/Save… .shc per Adobe's public spec, psd shc.rs); corner points render (compose contour_curve_lut) and map to PSD Cnty. User contour library: Contour Editor New… saves the curve under a name (layer.layerStyle.contours.new/list/delete/load/save, kept with the preferences), the picker lists user contours after the standard ones and has Load/Replace/Save Contours… (.shc). Missing: Anti-aliased doesn't change the render yet, .shc not yet checked against a Photoshop-written file |
 | FILE-215-16 | Advanced Blending (knockout, blend as group, mask hides effects) end to end | partial | [#215](https://github.com/storytold/photocraft/issues/215) | doc advanced.rs + .pcraft + PSD/layered TIFF (knko infx clbl tsly lmgm vmgm), CPU compose advanced.rs (GPU falls back), blendingOptions command + dialog; 7 psd-tools knockout oracles now pass; knockout-isolated-groups (0.45 % AA edges), advanced-blending, blend-and-clipping still differ |
-| FILE-215-17 | CMYK/RGB documents preview spot inks; spot plates export (TIFF extra samples, PDF) | missing | [#215](https://github.com/storytold/photocraft/issues/215) | compose multichannel.rs:1 spot preview for Multichannel only |
+| FILE-215-17 | CMYK/RGB documents preview spot inks; spot plates export (TIFF extra samples, PDF) | partial | [#215](https://github.com/storytold/photocraft/issues/215) | TIFF: spot channels written and read as extra samples with DisplayInfo (1077) ink colour and solidity, ink stored 0 = solid (#7415). PSD: spot planes stored and read 0 = solid as Photoshop does, identifiers in 1053; PhotoCraft 0.1.0–0.16.0 PSDs (straight planes) keep their ink. Missing: spot ink preview in RGB/CMYK documents (compose multichannel.rs:1 previews Multichannel only) and PDF Separation |
 | FILE-215-18 | Save for Web per-slice settings remembered; Export As remembers and offers nearest scaling | done | [#215](https://github.com/storytold/photocraft/issues/215) | Save for Web settings survive a restart through the remembered dialog settings in prefs.dialogs (web_cmds::remember_web_settings stores them on a complete export, never the destination; file_ui.rs open_web seeds from the session's last export, else the preferences). export_dialog seeds Export As the same way (seed_remembered: format, quality, transparency, scale, resample, metadata, TGA bits) and confirm remembers them as used. Export As › Image Size › Resample offers Photoshop's six methods (Bicubic Automatic default, Nearest Neighbor included; export_preset_cmds::RESAMPLE, unknown values are errors) for the exported copy only; also layer.exportAs `resample` and export presets (#5838). Tests: export_dialog nearest_neighbor_doubles_each_pixel_into_an_exact_block (8/16-bit), resample_choices_are_checked, resample_is_remembered_and_a_bad_saved_value_falls_back; layer_menu_cmds export_layer_resamples_with_the_chosen_method; tests/it/export_as_scaling.rs export_as_resample_menu_writes_nearest_neighbor_blocks |
 | FILE-215-19 | Save As JPEG opens a JPEG Options dialog (quality 0-12, format options) | partial | [#215](https://github.com/storytold/photocraft/issues/215) | jpeg_options_ui.rs: File > Save, Save As and Save a Copy to a JPEG ask for Quality 0-12 (Low/Medium/High/Maximum) and Baseline / Baseline Optimized / Progressive before writing, starting at an opened JPEG's own quality (file_encoding) or else the Export preference; scripts pass quality/jpegFormat (file.saveAs, file.saveACopy, app.save, CLI --jpeg-format) and recorded actions replay the answer (discard_ui/tests/jpeg_tests.rs, codecs roundtrip jpeg_format_options_round_trip). Baseline Optimized fits the Huffman tables only at 4:4:4 (Gray, CMYK) or progressive: RGB is written 4:2:0, which zune-jpeg 0.5.15 decodes wrongly with fitted tables, as in Save for Web, so RGB Baseline Optimized writes the same file as Baseline. Missing: Matte, progressive Scans (3-5) and the size preview |
 | FILE-215-20 | Artboard tool with handles and + buttons, Duplicate Artboard beside, vector PDF pages | partial | [#215](https://github.com/storytold/photocraft/issues/215) | artboard_tool.rs: Artboard tool draws, selects, moves and resizes boards by their handles (⇧ keeps proportions), its + buttons add a board or (⌥) a copy beside the selected one (#3033); Duplicate Artboard places the copy beside (#1584); raster PDF pages only |
@@ -144,7 +145,7 @@ Corpus floors (`crates/io/tests/it/corpus.rs`): the enforced minimums; the corpu
 | TOOL-213-4 | Content-Aware Move tool reusing inpaint completion | done | [#213](https://github.com/storytold/photocraft/issues/213) | paint.contentAwareMove (retouch_cmds/content_aware_move.rs: move/extend, Structure 1-7, Color 0-10, Sample All Layers, Transform On Drop's scaleX/scaleY/rotate; background job) + Tool::ContentAwareMove (J group: lasso, then drag; Transform On Drop puts a scale/rotate box on the dropped patch, cam_transform.rs: Enter commits as one step, Esc cancels). cam_preview.rs: once the pointer or the box rests, the result shows (a cancellable background job on a smaller sampling window, #4385); a selection over 256x256 shows a coarse result solved scaled down first, then the command's exact result as a second job (#6680; 24 MP document, release: 600x400 coarse 0.26 s then exact 0.8 s, 1500x1000 0.38 s then 4.1 s, 3000x2000 0.69 s then 9.4 s; was no preview above 256x256). Tests: content_aware_move_previews_large_selections_coarse_then_exact_at_all_depths, content_aware_move_coarse_preview_handles_transform_extend_and_limits, a_preview_within_the_full_resolution_budget_is_the_plain_solve_bit_for_bit, a_large_selection_shows_a_coarse_result_then_the_exact_one |
 | TOOL-213-5 | Painting a type/shape/smart/fill layer offers to rasterize, then continues the stroke | done | [#213](https://github.com/storytold/photocraft/issues/213) | rasterize_prompt.rs: OK rasterizes then paints (two history states), Cancel does nothing; drivable via ui.dialog.confirm |
 | TOOL-213-6 | Fill dialog: contents, blend, opacity, preserve transparency; remembered; Shift+Backspace | done | [#213](https://github.com/storytold/photocraft/issues/213) | fill_ui.rs dialog over edit.fill (fill_cmds.rs): all contents, mode, opacity, preserve; remembered in prefs; Shift+F5 / Shift+Backspace |
-| TOOL-213-7 | Live stroke preview for every brush-based retouch tool | partial | [#213](https://github.com/storytold/photocraft/issues/213) | Live (canvas.rs strokes_live): Brush, Pencil, Eraser, Color Replacement, Blur, Sharpen, Smudge, Dodge, Burn, Sponge, Clone Stamp, Healing Brush, History Brush (#1026, #1040), Pattern Stamp (aligned and Impressionist) and Background Eraser (#3754); the release commits the live stroke's pixels (P32) or, for the retouch tools, the same pixels the live stroke showed (tested equal at 8 and 16 bits). Spot Healing Brush shows the area it heals as a dark overlay and heals on release, as Photoshop does. Not yet live: Mixer Brush (in PR #3627) |
+| TOOL-213-7 | Live stroke preview for every brush-based retouch tool | partial | [#213](https://github.com/storytold/photocraft/issues/213) | Live (canvas.rs strokes_live): Brush, Pencil, Mixer Brush, Eraser, Color Replacement, Blur, Sharpen, Smudge, Dodge, Burn, Sponge, Clone Stamp, Healing Brush, History Brush (#1026, #1040), Pattern Stamp (aligned and Impressionist) and Background Eraser (#3754); the release commits the live stroke's pixels (P32) or, for the retouch tools, the same pixels the live stroke showed (tested equal at 8 and 16 bits). Spot Healing Brush shows the area it heals as a dark overlay and heals on release, as Photoshop does. Mixer Brush uses its incremental transaction and commits the displayed result (#3627) |
 | TOOL-213-8 | Clone Source: W/H link, drawn overlay (opacity/blend/clip/auto-hide), Alt target cursor | partial | [#213](https://github.com/storytold/photocraft/issues/213) | Clone Source overlay drawn with opacity, inversion, circular clipping, auto-hide and the Normal/Darken/Lighten/Difference blend against the image under the brush (canvas.rs draw_clone_preview, clone_source::overlay_blend); a shaped tip (sampled bitmap, rotation, roundness) clips the overlay to its outline (brush_cursor::tip_mask, #4372); W/H link (cloneSource.set linked, panel chain button, #3298) |
 | TOOL-213-9 | Eyedropper comparison ring (new colour above, current below) while sampling | done | [#213](https://github.com/storytold/photocraft/issues/213) | eyedropper_ring (canvas.rs): the sampled colour on the upper arc, the foreground below, drawn for the Eyedropper and Alt-sampling while the button is held; the Precise-cursor preference keeps the crosshair |
 | TOOL-213-10 | Ctrl+Alt drag resizes brush size/hardness with an on-canvas readout | done | [#213](https://github.com/storytold/photocraft/issues/213) | brush_resize.rs (#297, #370): Alt+right-drag, or Control+Option-drag on macOS (Control+Alt everywhere), sets diameter horizontally and hardness vertically, circle plus Diameter/Hardness readout, one coalesced tools.setBrush, no paint or history; 9 tests there |
@@ -166,7 +167,7 @@ Corpus floors (`crates/io/tests/it/corpus.rs`): the enforced minimums; the corpu
 | TOOL-214-11 | Stroke Path dialog: pick any brush-based tool, Simulate Pressure | done | [#214](https://github.com/storytold/photocraft/issues/214) | path.stroke tool: Brush, Pencil, Eraser and every other brush-based tool (Background Eraser, Clone/Pattern Stamp, Healing/Spot Healing Brush, History Brush, Blur, Sharpen, Smudge, Dodge, Burn, Sponge, Color Replacement, Mixer Brush: their paint.* command along the path, one step) plus simulatePressure (taper both ends); Stroke Path dialog from the Pen menu, the Paths panel menu and Alt-click on its Stroke button (#2978) |
 | TOOL-214-12 | Shapes: on-canvas corner radius handles, shape feather, selection to shape with tolerance | done | [#214](https://github.com/storytold/photocraft/issues/214) | On-canvas corner radius widgets on every selected live rectangle, triangle, polygon and star (LiveShape::Polygon corner_radius, shape.create/edit cornerRadius, vector shapes::round_corners) with Path Selection, the Rectangle/Triangle/Polygon tools and Move + Show Transform Controls: drag rounds every corner of every selected shape alike, Alt one corner of a rectangle, corner radius cursor and R: readout, one history step (corner_radius.rs, 2026-10-13); select.convertToShape with tolerance (vector_cmds.rs:1256); shape Density and Feather (Properties, layer.vectorMask.edit on a shape layer; the path as the fill's soft vector mask, Photoshop's 10 px feather ramp within 1 level; PSD mask parameters and .pcraft, #5846, 2026-10-15) |
 | TOOL-214-13 | Mask Properties: Density and Feather controls | done | [#214](https://github.com/storytold/photocraft/issues/214) | Properties panel shows Density (%) and Feather (px) sliders for a targeted pixel mask (layer.layerMask.edit) and a targeted vector mask (layer.vectorMask.edit), non-destructive and one undo step per drag, with Photoshop's Refine row (mask_props_ui.rs:34 pixel mask, :48 vector mask, :52 the sliders; mask_props_ui_tests.rs:39 pixel_mask_properties_follow_target_for_raster_and_adjustment_in_both_themes, :81 mask_slider_drags_preview_live_and_undo_as_separate_gestures, :147 vector_mask_properties_edit_density_and_feather) |
-| TOOL-214-14 | Vanishing Point window: draw and edit planes, paste, clone in perspective | partial | [#214](https://github.com/storytold/photocraft/issues/214) | filter.vanishingPoint (vp_cmds.rs:15); on-canvas plane editor (vp_ui.rs: Create/Edit Plane, edge nodes, valid/doubtful/invalid grid colours, Grid Size, clipboard pasted onto the plane on OK); clone stamp, marquee and tear-off planes in the window still missing |
+| TOOL-214-14 | Vanishing Point window: draw and edit planes, paste, clone in perspective | partial | [#214](https://github.com/storytold/photocraft/issues/214) | filter.vanishingPoint (vp_cmds.rs:15); on-canvas window (vp_ui.rs: Create/Edit Plane, edge nodes, Ctrl/Cmd-drag tear-off planes with depth and Alt-drag angle, valid/doubtful/invalid grid colours, Grid Size, clipboard pasted onto the plane, Stamp tool cloning in perspective with live preview, all applied on OK as one step); the window's Marquee tool and the Stamp's Heal modes are still missing |
 | TOOL-214-15 | Content-Aware Fill workspace: paint the sampling area, preview, rotate/scale/mirror, new layer | partial | [#214](https://github.com/storytold/photocraft/issues/214) | Engine sampling auto, rect, custom (edit_menu_cmds.rs:324); generic dialog |
 | TOOL-214-16 | Liquify: redo (Cmd+Shift+Z) | done | [#214](https://github.com/storytold/photocraft/issues/214) | liquify_ui.rs supports bounded redo through Cmd+Shift+Z and the control channel; new strokes clear redo |
 | TOOL-213-17 | Red Eye tool: click a pupil to neutralize the red reflection | done | [#213](https://github.com/storytold/photocraft/issues/213) | paint.redEye (redeye_cmds.rs) + Tool::RedEye in the J flyout; Pupil Size and Darken Amount; catchlights kept; a miss is an error |
@@ -178,16 +179,17 @@ Corpus floors (`crates/io/tests/it/corpus.rs`): the enforced minimums; the corpu
 | TOOL-214-21 | Crop: Straighten button in the options bar and Cmd/Ctrl-drag draw a line; the frame turns so the line ends up level (or plumb when nearer vertical), with an angle readout | done | [#1919](https://github.com/storytold/photocraft/issues/1919) | crop_straighten.rs: one-shot options-bar button, Cmd/Ctrl held is a temporary Straighten (ui.pointer command flag); the Ruler's straighten_angle convention; the frame is fitted to the largest of its proportions inside the image (Classic Mode); a pending edit committed by Enter |
 | TOOL-214-22 | Crop gear menu: Show Cropped Area (H), Enable Crop Shield with Match Canvas / custom colour, opacity and Auto Adjust Opacity | done | [#1919](https://github.com/storytold/photocraft/issues/1919) | crop_shield.rs: fill() resolves the shield (canvas.rs paints it around upright and turned frames), gear popup in the options bar, H ahead of the Hand key in shortcuts.rs, Custom… opens the Color Picker; ToolOptions crop_shield, ui.set cropShield. Use Classic Mode / Auto Center Preview: TOOL-214-23 |
 | TOOL-214-23 | Crop: Photoshop's default mode (the image turns and moves behind an upright box, Auto Center Preview keeps a resized box's centre in place and centres a drawn one) and Use Classic Mode (P) in the gear menu | done | [#1919](https://github.com/storytold/photocraft/issues/1919) | crop_mode.rs: the crop model (crop_rect + crop_angle) and image.crop are shared by both modes; default mode sets the view's rotation to -crop_angle while the tool shows a frame (picking the tool, in either mode, turns a Rotate View turn upright about the view centre, not restored after Enter/Esc or by P; Classic Mode keeps the camera upright with the frame drawn turned; as Photoshop 25.1), pivoting so the box stays put, moves view and frame together for drags inside and arrow keys, keeps a resized box's centre in place live (Auto Center Preview; a drawn box is centred on release, a moved one never), readout = the image's turn; gear menu order and Classic Mode greying as Photoshop 25.1; CropShield classic_mode / auto_center_preview (ui.set cropShield), P ahead of the Pen key |
-| TOOL-1053-1 | Shape stroke controls: solid/dashed/dotted, custom dash/gap/offset, caps, joins, alignment, miter limit and opacity | done | [#1053](https://github.com/storytold/photocraft/issues/1053) | shape_stroke_ui.rs: shared staged editor, renderer samples, cached Properties canvas preview; existing shape.create/edit/info; serde tool defaults, ui.set shapeStroke; pcraft and vstk style round trips. Gradient fill UI and saved stroke libraries remain open; Line retains filled-bar geometry |
+| TOOL-1053-1 | Shape stroke controls: solid/dashed/dotted, custom dash/gap/offset, caps, joins, alignment, miter limit and opacity | done | [#1053](https://github.com/storytold/photocraft/issues/1053) | shape_stroke_ui.rs: shared staged editor, renderer samples, cached Properties canvas preview; existing shape.create/edit/info; serde tool defaults, ui.set shapeStroke; pcraft and vstk style round trips. vector_ui.rs: the Fill and Stroke swatches (options bar and Properties) have a Gradient tab (shape_gradient_ui.rs: Recent row, presets, an editable stops strip with the selected stop's colour/opacity/location, style, angle, scale, reverse, Align with layer) for the next shape and the selected one. Pattern paint UI and saved stroke libraries remain open; Line retains filled-bar geometry |
 | TOOL-213-19 | Remove tool: paint over an object (or circle it) and it is filled from its surroundings | partial | [#213](https://github.com/storytold/photocraft/issues/213) | paint.remove (retouch_cmds/remove.rs, background job) + Tool::Remove in the J flyout; loops close over what they enclose; fill by non-local patch completion with texture features, onion-peel start, best-patch copy and gradient-domain seam hiding (algo/nonlocal.rs, Newson et al. IPOL 2017); sparse holes in tiles (algo/remove.rs). remove_quality on 20 holes in public-domain photos: the fill keeps 0.89 of the texture it replaces (0.54 with Content-Aware Fill's completion), edge gradient 1.03 of the original's; remove_bench 24 MP: 100 px ring 120 ms, 1000 px ring 2.5 s, 3000 px line 1.7 s. Options bar: Sample All Layers, Create a new layer (the fill on a new layer above, `newLayer`), Remove after each stroke off (strokes collect as a tint and ↩ applies them as one `strokes` job, Esc drops them). Missing: generative AI mode, live preview of the result |
 | TOOL-2259-1 | Arrow-key nudges of one thing (layers, the selection outline, the Free Transform box) that follow each other are one History state, with a preference to turn it off | done | [#2259](https://github.com/storytold/photocraft/issues/2259) | nudge_bundle.rs: a run shares one `coalesce` key while each nudge comes within Tools > Nudge Bundle Pause (1 s) and nothing else touched the document (an edit, Undo/Redo, a layer selection, a save end it); move_mods.rs runs layer.translate and select.transformSelection through it, transform_tool.rs folds box nudges into one session step. Tools > Bundle Arrow-Key Nudges off gives every press its own state. Selected pixels float until dropped, which is one state already; ⌥-nudges (a copy each) never join a run |
 | TOOL-1045-1 | Color Replacement tool on the toolbar | done | [#1045](https://github.com/storytold/photocraft/issues/1045) | Tool::ColorReplacement in the Brush (B) flyout after the Mixer Brush; Mode/Sampling/Limits/Tolerance/Anti-alias options drive paint.colorReplacement with the foreground colour; live preview (LiveDab with the stroke's finishing dab), one History step; color_replacement_tests.rs |
+| TOOL-213-20 | Art History Brush: Y-group, styles, Area, Tolerance, paints from a history state | partial | [#213](https://github.com/storytold/photocraft/issues/213) | paint.artHistoryBrush + Tool::ArtHistoryBrush in the Y flyout; 8 of 10 styles (no Tight Curl Long / Loose Curl Long); Area scales spacing, not coverage; rotated-patch look; no Mode/Opacity on the options bar, no pen pressure |
 
 ## Workspace and UI
 
-**Settings that do nothing: 20 of 177** (target 0, #204). Counted by the prefs audit (`xtask/src/scorecard.rs`): a `Preferences` field counts as read when code outside the prefs model (`prefs.rs` except its `impl Session` blocks; tests excluded; the schema-driven dialog never names a field) accesses `section.field`, or `.section` and `.field` in the same file, or calls a section method that reads `self.field`. It is a heuristic lower bound: a generic name can look read when it isn't.
+**Settings that do nothing: 12 of 178** (target 0, #204). Counted by the prefs audit (`xtask/src/scorecard.rs`): a `Preferences` field counts as read when code outside the prefs model (`prefs.rs` except its `impl Session` blocks; tests excluded; the schema-driven dialog never names a field) accesses `section.field`, or `.section` and `.field` in the same file, or calls a section method that reads `self.field`. It is a heuristic lower bound: a generic name can look read when it isn't.
 
-Unread: `general.color_picker`, `workspace.auto_show_hidden_panels`, `workspace.enable_floating_document_window_docking`, `performance.cache_levels`, `performance.gpu_adapter`, `performance.legacy_compositing`, `scratch_disks.disks`, `units_and_rulers.column_width`, `units_and_rulers.gutter`, `plug_ins.show_extension_panels`, `plug_ins.allow_scripts_to_connect`, `type_.text_engine`, `enhanced_controls.scrubby_slider_acceleration`, `raw_defaults.color_space`, `raw_defaults.bit_depth`, `raw_defaults.sharpen_for`, `raw_defaults.open_as_smart_object`, `raw_defaults.apply_auto_tone`, `integrations.allow_agent_control`, `integrations.control_port`.
+Unread: `general.color_picker`, `workspace.auto_show_hidden_panels`, `workspace.enable_floating_document_window_docking`, `performance.gpu_adapter`, `performance.legacy_compositing`, `scratch_disks.disks`, `units_and_rulers.column_width`, `units_and_rulers.gutter`, `plug_ins.show_extension_panels`, `plug_ins.allow_scripts_to_connect`, `type_.text_engine`, `enhanced_controls.scrubby_slider_acceleration`.
 
 | Id | Target | Status | Issue | Note |
 |---|---|---|---|---|
@@ -199,12 +201,12 @@ Unread: `general.color_picker`, `workspace.auto_show_hidden_panels`, `workspace.
 | UI-217-6 | Document tabs: overflow list, context menu (Close/Others/All/Reveal), drag to reorder | done | [#217](https://github.com/storytold/photocraft/issues/217) | canvas.rs: Close/Others/All menu with unsaved prompt; Reveal reuses file.revealInFinder (engine layer_menu_cmds::reveal); the » chevron (tab_strip) lists overflow; dragging a tab reorders via document.move |
 | UI-217-7 | Command palette shows recently run commands on an empty query | done | [#217](https://github.com/storytold/photocraft/issues/217) | palette.rs: note_recent from menus::invoke keeps the last 8 commands (dedup, newest first); an empty query lists them via recent_hits; the_palette_records_and_replays_recent_commands_on_an_empty_query covers record -> empty query -> replay |
 | UI-217-8 | Tool-specific canvas right-click menu; right-click spelling suggestions in text fields | partial | [#217](https://github.com/storytold/photocraft/issues/217) | paint_mouse.rs brush picker and canvas_tool_menu.rs selection actions; text_field_menu.rs gives every text field its right-click Undo/Cut/Copy/Paste/Delete/Select All menu (#2921); other tools missing; the Type tool's edit menu starts with spelling suggestions and Add to Dictionary over a misspelled word (#4370); over committed type the Type tool opens the type layer menu (#7324); Ignore / Ignore All, suggestions in the non-editing type menu and in generic text fields are not there yet |
-| UI-217-9 | UI scale presets 100/115/125/150/200 % through zoom_factor, remembered | done | [#217](https://github.com/storytold/photocraft/issues/217) | prefs::UiScale offers Auto plus 75 to 300 percent (13 presets, more than the five this row lists); prefs_ui.rs display_scale resolves it (Auto follows the system scale, fractional and unscaled 4K included, #1072/#1278) and sync_display_scale applies it with ctx.set_zoom_factor. It is a preference, so it is remembered. The zoom_factor assert in input_tests.rs is about canvas zoom not scaling the interface, not about this setting |
+| UI-217-9 | UI scale presets 100/115/125/150/200 % through zoom_factor, remembered | done | [#217](https://github.com/storytold/photocraft/issues/217) | prefs::UiScale offers Auto plus 75 to 300 percent (17 presets: 75 to 125 in 5 % steps since #3222, then 150 to 300; more than the five this row lists); prefs_ui.rs display_scale resolves it (Auto follows the system scale, fractional and unscaled 4K included, #1072/#1278) and sync_display_scale applies it with ctx.set_zoom_factor. It is a preference, so it is remembered. The zoom_factor assert in input_tests.rs is about canvas zoom not scaling the interface, not about this setting |
 | UI-217-10 | Appearance: animation toggle, canvas pattern toggle per theme, start-screen recents | partial | [#217](https://github.com/storytold/photocraft/issues/217) | interface.enableAnimations (prefs_ui.rs sync_animations, #3273) zeroes egui animation_time and scroll animation in both styles; the Home screen lists recent files (canvas.rs home_recent, #2691); the canvas dot pattern toggle is interface.showCanvasDots (#2264, global rather than per theme); interface.showHomeRecentFiles hides the Home screen recents (#4382) |
 | UI-217-11 | Soft dark and soft light themes with picker previews; outlined knobs in light themes | done | [#217](https://github.com/storytold/photocraft/issues/217) | theme.rs ThemeKind has fourteen themes: the twelve earlier ones plus Soft Dark and Soft Light (low-contrast Studio-layout palettes, text at 4.5:1, selectable in Preferences with the existing theme-card previews, ui.set {theme}, Window > Theme); the light themes outline the slider knob with Tokens::knob_outline (dim text, at least 3:1 against dock, card and chrome; #7927) |
 | UI-217-12 | Save custom New Document presets; a real Recent category | done | [#217](https://github.com/storytold/photocraft/issues/217) | document_preset_cmds.rs and new_doc_ui.rs: named presets save/select/delete through preferences; Recent lists Clipboard, the last 20 documents created in the dialog (document.recent.*, persisted with the presets, newest first, deduplicated) and the uncovered defaults (#3131); created_documents_fill_the_recent_category |
 | UI-217-13 | Numeric fields accept arithmetic and units; scrubby labels; double-click resets a slider | done | [#217](https://github.com/storytold/photocraft/issues/217) | widgets::value_field: arithmetic plus units (1in, 5mm, 72pt, 50%) converted at the document resolution (#3099); widgets::scrub_label makes options-bar, slider-row and Character labels scrubby (Shift x10, Alt fine); slider rows with a known default reset on double-click |
-| UI-217-14 | Layers panel: wheel steps blend modes, drop on New/Trash duplicates/deletes, checker behind art | done | [#217](https://github.com/storytold/photocraft/issues/217) | panels.rs: the wheel steps the blend-mode dropdown (widgets::dropdown_wheel_hovered, #1747); rows dropped on New Layer/Group/Delete duplicate/group/delete them (footer_drop, #736), effect rows dropped on Delete delete that effect or the whole style (fx_trash_drop, #3102); pixel thumbnails draw widgets::checker behind the art; Shift+Plus/Minus step the layer's or the painting tool's blend mode (blend_keys.rs, #3102) |
+| UI-217-14 | Layers panel: wheel steps blend modes, drop on New/Trash duplicates/deletes, checker behind art | done | [#217](https://github.com/storytold/photocraft/issues/217) | panels.rs: the wheel steps the blend-mode dropdown (widgets::dropdown_wheel_hovered, #1747); rows dropped on New Layer/Group/Delete duplicate/group/delete them (footer_drop, #736), effect rows dropped on Delete delete that effect or the whole style (fx_trash_drop, #3102); pixel thumbnails draw widgets::checker behind the art; Shift+Plus/Minus step the layer's or the painting tool's blend mode (blend_keys.rs, #3102), and Shift+Alt+letter picks one (Photoshop's letters; every selected layer, one undo step) |
 | UI-217-15 | Curves: smoothing / pencil mode, black/grey/white eyedroppers, tooltips | done | [#217](https://github.com/storytold/photocraft/issues/217) | Curves editor (adjust_editors.rs, dialog and Properties): Edit points / Draw (pencil) buttons and Smooth, all with tooltips; pencil curves are 256-level maps (Adjustment::Curves pencil, params pencil/smooth, PSD curv map form and smart-filter Mpng; #3088). Set Black/Neutral Gray/White Point eyedroppers in the Image > Adjustments > Curves dialog (adjust_dialog.rs, #873) and in a Curves adjustment layer's Properties panel (layer_picker.rs: a click on the image is one layer.setAdjustment with the eyedropper param, sampling below the layer; Esc or another tool disarms; #3110) |
 | UI-217-16 | Hue/Saturation: Saturation slider gets a hue-following colour track, Lightness a black-grey-white track | done | [#217](https://github.com/storytold/photocraft/issues/217) | saturation_track/lightness_track (adjust_editors.rs): grey -> the hue, recolouring as the Hue slider moves, and a fixed black -> grey -> white (#6539); saturation_track_follows_the_hue, lightness_track_is_black_grey_white_whatever_the_hue |
 | UI-217-17 | Color panel: wheel plus RGB/HSB/CMYK/Lab/Gray/Web slider modes; resizes with its group | done | [#217](https://github.com/storytold/photocraft/issues/217) | color_panel_ui.rs: Hue/Brightness Cube, Color Wheel, Grayscale/RGB/HSB/CMYK/Lab/Web sliders, ramp; the same in every theme (#6000); color_panel_tests.rs |
@@ -219,7 +221,7 @@ Unread: `general.color_picker`, `workspace.auto_show_hidden_panels`, `workspace.
 
 | Id | Target | Status | Issue | Note |
 |---|---|---|---|---|
-| TYPE-218-1 | Type on a path: path shape, glyphs along the curve, caret follows, PSD round trip | partial | [#218](https://github.com/storytold/photocraft/issues/218) | TextShape::Path (doc text.rs) with glyphs placed rigidly along the curve by arc length (text warp.rs PathFrame), type.attachToPath and type.detachFromPath (#4365), .pcraft round trip; a Type tool click on the work path or the active shape layer's path starts path type at the point clicked (type_tool.rs path_target, shared with area type, #6230; type.attachToPath at; path-type pointer over a path). Missing: vertical type on a path, dragging the start/flip, the caret and selection following the curve, and PSD path text (it saves as point text) |
+| TYPE-218-1 | Type on a path: path shape, glyphs along the curve, caret follows, PSD round trip | partial | [#218](https://github.com/storytold/photocraft/issues/218) | TextShape::Path (doc text.rs) with glyphs placed rigidly along the curve by arc length (text warp.rs PathFrame), type.attachToPath and type.detachFromPath (#4365), .pcraft round trip; a Type tool click on the work path or the active shape layer's path starts path type at the point clicked (type_tool.rs path_target, shared with area type, #6230; type.attachToPath at; path-type pointer over a path); PSD path text opens on its path from its Txt2 frame and saves back into the file's Txt2 object (#7962). Missing: vertical type on a path, dragging the start/flip, the caret and selection following the curve, and PSD path text in a file without Photoshop's Txt2 object for the layer (a new document saves it as point text) |
 | TYPE-218-2 | Paragraph direction (Auto/LTR/RTL) in the panel and options bar; visual RTL caret | partial | [#218](https://github.com/storytold/photocraft/issues/218) | Paragraph section (Window > Paragraph and Properties) and the options bar have Auto / Left-to-right / Right-to-left buttons setting the paragraph direction through type.setStyle; the options bar's choice is also the direction new type starts with (type_tool.rs direction_items; paragraph_direction_buttons_set_and_show_the_direction, options_bar_direction_sets_selected_layers_and_new_type). Still missing: visual RTL caret (the arrow keys move in logical order), and PSD doesn't store the direction (crates/text psd.rs neither reads nor writes it, so it reopens as Auto) |
 | TYPE-218-3 | Thai/Khmer/Indic fallback fonts; golden shaping tests for complex scripts and RTL | partial | [#218](https://github.com/storytold/photocraft/issues/218) | Fallback fonts are covered for Thai, Khmer, Lao, Myanmar (THAI_FAMILIES, KHMER_FAMILIES, LAO_FAMILIES, MYANMAR_FAMILIES in fonts.rs; #1909, #3259), the nine Indic scripts (INDIC_FAMILIES: Nirmala UI, Kohinoor and Sangam MN, Noto Sans) and Arabic and Hebrew. Still missing: per-script golden shaping tests against reference output (only smoke tests that an installed font shapes without .notdef, plus a bidi test) |
 | TYPE-218-4 | Variable font axis sliders from the font's axes; opsz follows the point size | done | [#218](https://github.com/storytold/photocraft/issues/218) | One slider per axis of the style's font in the Character section (Properties and Window > Character), setting type.setStyle variations; opsz follows the type size unless set (layout.rs variation_list); a style or weight resets the wght axis (#2985). PSD does not round-trip axis values yet |
@@ -290,7 +292,7 @@ Never-crash attribute on 30 of 30 crate roots.
 | BUG-203-6 | Failure-injection tests: mid-write, rename and read-only dir errors keep original bytes | done | [#203](https://github.com/storytold/photocraft/issues/203) | format/src/atomic/tests.rs: Faulty AtomicFs injects mid-write StorageFull, rename failure and a read-only dir; locked-target retries, symlink and file-mode preservation covered too |
 | BUG-204-1 | Interface prefs (UI scale, font size, channels in colour, sliders, tooltips) wired or hidden | done | [#204](https://github.com/storytold/photocraft/issues/204) | prefs_ui.rs tick reads ui_scale (sync_display_scale), ui_font_size (theme::set_ui_font_size) and show_tooltips (sync_tooltips); show_channels_in_color is wired in channel_thumbs and the canvas channel view (#2385); dynamic_color_sliders is in prefs::HIDDEN_UNTIL_IMPLEMENTED |
 | BUG-204-2 | workspace.large_tabs, animated_zoom, auto_show_home_screen wired or hidden | done | [#204](https://github.com/storytold/photocraft/issues/204) | workspace.large_tabs controls document tab height in canvas.rs; auto_show_home_screen drives the Home screen; general.animated_zoom gates discrete canvas zoom transitions and continuous held Zoom tool presses (zoom_hold.rs, #6210), and is exposed in General preferences |
-| BUG-204-3 | RAW prefs and ask_before_saving_layered_tiff read, or hidden | done | [#204](https://github.com/storytold/photocraft/issues/204) | ask_before_saving_layered_tiff drives the TIFF Options prompt (ui-egui tiff_options_ui.rs); raw_defaults.open_in_camera_raw drives the Camera Raw dialog (camera_raw_ui.rs); the other raw_defaults fields are in prefs::HIDDEN_UNTIL_IMPLEMENTED |
+| BUG-204-3 | RAW prefs and ask_before_saving_layered_tiff read, or hidden | done | [#204](https://github.com/storytold/photocraft/issues/204) | ask_before_saving_layered_tiff drives the TIFF Options prompt (ui-egui tiff_options_ui.rs); raw_defaults.open_in_camera_raw drives the Camera Raw dialog (camera_raw_ui.rs); the other raw_defaults fields drive the raw open and Camera Raw (#5128) |
 | BUG-204-4 | Recent files persisted through prefs across restarts | done | [#204](https://github.com/storytold/photocraft/issues/204) | crates/ui-egui/src/lib.rs::push_recent stores the list in preferences; prefs_ui::load restores it and recent_files_survive_a_restart_and_honour_the_count verifies reload |
 | BUG-204-5 | Recent-files list honours recent_file_count (default 20) | done | [#204](https://github.com/storytold/photocraft/issues/204) | lib.rs push_recent caps the list with recent_cap (recent_file_count); menus.rs covers default and custom limits |
 | BUG-204-6 | Test: every Prefs field is read somewhere or on a hidden allowlist | done | [#204](https://github.com/storytold/photocraft/issues/204) | crates/engine/tests/it/prefs_usage.rs every_preference_is_read_or_hidden: each field is read outside prefs.rs or listed in prefs::HIDDEN_UNTIL_IMPLEMENTED, never both |
diff --git a/docs/seam-carving-performance.md b/docs/seam-carving-performance.md
index 77fc736264..371b8c363d 100644
--- a/docs/seam-carving-performance.md
+++ b/docs/seam-carving-performance.md
@@ -1,62 +1,145 @@
 # Content-Aware Scale performance
 
-2026-10-22. Two things are recorded here: what this change saves, and a correction to the P28 row's
-recorded number, which predates the seam-search proxies and reads as hundreds of times worse than
-the code does today.
+## Seam carving keeps its search across seams (2026-10-13, #5236)
 
-## The change
+Perf scenario P28 ([#211](https://github.com/storytold/photocraft/issues/211)) scales a 24 MP
+photo to 90 % width with Edit › Content-Aware Scale. Its budget is 3 s.
 
-Content-Aware Scale shrinks an image by removing one seam at a time. On large images the seams are
-searched on a vertically averaged copy (`carve_width_proxy_height`), and a panel column found there
-is not an original column: each seam already removed has shifted the panel left. That was tracked
-with an `idx` map — one `usize` per proxy pixel, built up front and shifted by every seam.
+- The committed baseline (2026-10-05) records 954 s. That predates the per-seam energy updates
+  and the reduced-height seam search already in `crates/algo/src/seam.rs`.
+- Before this change, the row measured 3.3 s on the machine below.
+- After it, the row measures 1.6 s and the carve itself is 3.6 times faster. The output is the
+  same.
 
-The original column is recoverable without the map: for the `i`-th column already taken from a row,
-`o - i` is the panel column it occupied, so the taken columns at or left of panel column `x` are
-those with `o - i <= x`, and the original column is `x` plus that count. `o - i` never decreases
-along the row's list, so that count is a binary search and the original column inserts where the
-search stopped; the rows are independent and update in parallel, like the pixel shift.
+### What changed
 
-Counting it by scanning the row's list instead is a comparison per already-removed column, so its
-cost grows with the square of the seam count and a deep shrink pays it on every row and every seam.
-The binary search removes that term; what is left per removed column is one insert into a list of at
-most `seam_count` entries, i.e. an element move rather than a comparison.
+All changes are in `crates/algo/src/seam.rs`. The command, its parameters and its output are
+unchanged.
 
-Output is unchanged: the same original columns reach the assembly pass, in the same order, so every
-pixel written is the pixel the map produced. The 4-channel cases below hash identically (FNV-1a over
-the output's raw `f32` bits); the 3-channel case is unchanged within timer noise.
+- **The seam search keeps its path-cost map across seams.**
+  - The search is the dynamic programme of Avidan and Shamir (2007). Before, it refilled the whole
+    map for every seam: for P28, 600 serial passes over about 3 M cells.
+  - After a removal, `Dp::update` recomputes row by row only two kinds of pixel: those next to the
+    seam, whose energies or parents changed, and those with a parent whose cost actually changed
+    (compared bit for bit). Nothing else can change, so the map stays identical to a full pass.
+  - On the bench images this recomputes 1.3 % of the map per seam on the reduced-height search,
+    and 6–10 % on the full-resolution one. 98–99 % of the recomputed pixels do change, so the work
+    is the removed seam's basin, not slack in the bounds.
+  - Directions are no longer stored. The seam is traced back from the costs with the same tie
+    rules (`cell`). Rows are computed by one shared, vectorised kernel (`row_costs`).
+- **The carver moves no pixels.**
+  - It borrows the image, keeps each remaining pixel's source column (`u32`), and reads energy
+    neighbours and the result through it.
+  - A removal shifts whichever side of the seam is shorter, in three 4-byte per-pixel buffers
+    (index, energy, cost). Before, it shifted everything right of the seam in up to four buffers,
+    including the 16-byte RGBA pixels and, on the tracked paths, an 8-byte index.
+  - The image is no longer copied.
+- **The full-resolution stages run in parallel over rows.** These are the tall-image proxy build,
+  its full-resolution rebuild (runs copied between removed columns), the height pass's transposes
+  (blocked) and the plain resample used by Amount.
 
-## Timings
+### Exactness
 
-Windows 11, Intel i5-10300H (4 cores / 8 threads), rustc 1.98.1, `--release`, default rayon pool.
-The timer covers `seam::carve_width` only: document read, tile writeback, history and the undo that
-follows the command are outside it. Each cell is the same binary run before and after the change, in
-the same session, nothing else running.
+**Inputs whose energy stays a number** (every finite image without overflow) produce output that
+is bit-identical to the previous code. These tests pin it:
 
-| Case | Before (ms) | After (ms) | Change | Output |
-|---|---:|---:|---:|---|
-| 4000 × 3000 → 3600, 4 ch | 1424.7 | 1132.9 | −20.5 % | identical |
-| 6000 × 4000 → 5400, 4 ch | 3009.3 | 2559.4 | −15.0 % | identical |
-| 7200 × 5000 → 6480, 4 ch | 4352.8 | 3766.9 | −13.5 % | identical |
+- `output_bits_are_pinned`, for images under 2048 rows.
+- `tall_proxy_output_bits_are_pinned`, for the reduced-height search. It was pinned from the
+  previous code before any change.
+- `carver_matches_reference`, which runs 400 random cases against the original straightforward
+  implementation.
+- `incremental_dp_matches_full_dp`, which after every removal checks the kept map, the seam, the
+  energy and the pixels against a recomputation from scratch.
+- The hashes of the four `bench_seam_cas` outputs.
 
-Deep shrinks, where the counting scan was quadratic, on the same machine and the same binary with
-only the recording swapped (three alternating runs per side, `min`/`median`):
+**An adversarial review** compared the previous and new code side by side over more than 37 000
+generated cases. Inputs included huge values, denormals, -0.0, out-of-range protection, enlarging
+past 2× and proxy-size images. No difference appeared on any input whose energy stays a number.
 
-| Case | Scan (ms) | Binary search (ms) | Change | Output |
-|---|---:|---:|---:|---|
-| 6000 × 4000 → 600, 4 ch (5 400 seams) | 16 640 / 16 757 | 13 915 / 14 066 | −16 % | identical, fnv `0f7eaa6af3cf1557` |
-| 6000 × 4000 → 3000, 4 ch (3 000 seams) | 10 617 / 10 814 | 9 936 / 10 012 | −6 % | identical, fnv `1780ee9bc9077ee9` |
+**NaN and infinities** are now deterministic on every platform:
 
-The element move that remains is still linear in the row's list length, so a shrink this deep is not
-down to the index map's cost yet on four cores; a rank bitvector over the row would remove it, and is
-not in this change.
+- An energy that isn't a number is the highest energy (`+inf`). Such energies come from NaN
+  samples, from infinite samples at the border or next to each other, and from overflowing
+  differences.
+- NaN protection protects nothing.
 
-The map was 24 MB next to a 36 MB pixel buffer at 24 MP, so the saving tracks how many bytes of row
-the seams have to shift. A three-channel case was measured too and moved inside the timer noise, so
-it is not reported as a win here. Further seam-search savings have to come from the dynamic program
-itself, not from bookkeeping.
+Before, these inputs fed NaN to the seam search. The chosen seam then depended on NaN payloads,
+which arithmetic does not keep consistently across builds or on wasm. `nan_payloads_do_not_steer_seams`
+and `infinite_samples_carve_deterministically` pin the new behaviour.
 
-## P28's recorded number is stale
+**The height pass now keeps infinite protection.** It resamples the protection map; where that
+gives NaN, the map clamped to 0..=1 is resampled instead. Before, a row protected with `+inf`
+was carved away while one protected with `1.0` was kept.
+
+**Degenerate inputs now return early instead of panicking.** These are no channels, an empty
+width with a height change, and images or protection maps shorter than their size.
+
+### Measurements
+
+**Machine and method:**
+
+- 4-vCPU cloud VM (Intel Xeon 2.1 GHz, Linux, no GPU), release builds.
+- The VM's speed drifts by about 20 % over time, so before and after binaries ran interleaved in
+  the same window. Reported values are p50 with the [min–max] range.
+
+**The carver alone:**
+
+- Command: `cargo run --release -p photocraft-algo --example bench_seam_cas`.
+- Input: a synthetic photo-like RGBA image.
+- Five interleaved rounds; the output hashes were identical in every run.
+
+| Case | Before | After | Speed-up |
+|---|---|---|---|
+| 24 MP to 90 % width (P28's carve, reduced-height search) | 2013 ms [1958–2149] | 556 ms [542–623] | 3.6× |
+| 24 MP to 90 % height (transposed) | 2639 ms [2617–2809] | 993 ms [967–1017] | 2.7× |
+| 5.4 MP to 90 % width (full-resolution search) | 1548 ms [1514–1648] | 677 ms [664–719] | 2.3× |
+| 1.5 MP to 70 % width (full-resolution search) | 671 ms [658–766] | 406 ms [376–421] | 1.65× |
+
+**The P28 row:**
+
+- Command: `perf_scenarios --cpu --only "Content-Aware Scale"`.
+- It also times reading the layer, the job and writing the result back.
+- Five interleaved rounds, n = 1 per run:
+
+| P28 row | Before | After |
+|---|---|---|
+| Time | 3281 ms [3178–3364] | 1639 ms [1503–1728] |
+| Peak RSS | 1368–1386 MB | 1305–1367 MB |
+
+`cargo run --release -p photocraft-engine --example bench_content_aware_scale` times the same
+command without building the UI crate. After the change, one run split as follows:
+
+| Stage | Time |
+|---|---|
+| Reading the layer region | about 0.3 s |
+| The carve | about 0.5 s |
+| Writing the result back, with the undo step | about 0.2 s |
+
+**Memory inside the carver** is now 12 bytes per pixel. Before, it was the image copy (4 bytes per
+channel), the energy and the stored directions, plus protection and an 8-byte index where used.
+
+- The only case that uses more is a one-channel shrink without protection: 9 → 12 bytes per pixel.
+  The review measured its peak 1.17× higher.
+- Every other case uses less.
+
+### Limits and what is still open
+
+- **The scorecard and enforcement.** The scorecard keeps showing the 2026-10-05 baseline until
+  `cargo xtask perf --update-baseline` runs on the reference machine. `enforce` stays false for
+  P28 until then.
+- **The rest of the P28 row** is now mostly plumbing outside the carver. `Surface::read_region`
+  converts the 24 MP layer pixel by pixel on one thread, and `write_region` also runs on one
+  thread.
+- **Full-resolution searches.** Enlarging still runs them, since only shrinking tall images uses
+  the reduced-height search. The review measured a 24 MP 1 % enlarge going from 7.0 s to 1.8 s on a
+  loaded machine. What remains per seam is the removed seam's basin in the cost map (serial, row by
+  row) and the row shifts.
+- **A worst case.** When every seam hugs the right edge of a one-sided smooth ramp, the old code
+  shifted nothing, but the new code's cost changes cover almost the whole map. The review measured
+  that case 1.3–1.5× slower than before. No other input it tried was slower.
+- **wasm** builds run the same code on one thread.
+
+## P28's recorded number is stale (2026-10-22, #8526)
 
 `perf/baseline.json` records P28 (Content-Aware Scale on 24 MP to 90 % width) as 954 192 ms from the
 2026-10-05 baseline, which is why `perf/budgets.toml` carries `enforce = false` for that row. The
@@ -65,36 +148,36 @@ seam-search proxies and the per-seam energy update landed after that capture:
 | Tree | 6000 × 4000 → 5400, 4 ch |
 |---|---:|
 | `f5d2bcb` (the 2026-10-05 baseline commit) | 266 039 ms |
-| `1104b6f` (main, plus this change) | 2 559 ms |
+| `1104b6f` (main with #8526, before #5236) | 2 559 ms |
 
 `f5d2bcb` has no `PROXY_SHRINK_MIN_HEIGHT`: it carves at full height with a full energy recompute per
 seam. The 954 s in the baseline was that code on a machine whose recorded load average was 226–290
-on 14 cores. The two example runs above are 104× apart (266 039 ms against 2 559 ms); that is the
+on 14 cores. The two `bench_seam` runs above are 104× apart (266 039 ms against 2 559 ms); that is the
 seam-search core alone, and it is not the same measurement as the row's 954 s, which also includes a
 document read and writeback the timer above excludes.
 
 The row itself is not flipped to `enforce = true` here: the budget is set for the macOS/aarch64
-machine class and only a run on that class can vouch for it. The carving core above is 2.56 s at
-24 MP on a 4-core laptop CPU; the budgeted machine is faster, but the row also includes the document
+machine class and only a run on that class can vouch for it. The carving core was 2.56 s at
+24 MP on a 4-core laptop CPU before #5236; the budgeted machine is faster, but the row also includes the document
 read and writeback this measurement excludes. Flip it in the PR whose nightly run shows the row
 under 3 s, and delete this paragraph with it.
 
-## Reproduce
+## The shrink proxy's column map (2026-10-22, #8526)
+
+Main had dropped the proxy search's per-pixel original-column map in favour of counting the columns
+already taken from each row (`record_removed`, −15 % at 24 MP). The carver above keeps a 4-byte
+source column per remaining pixel and returns original columns itself, so that counting step has
+nothing left to do and was removed when #5236 joined main; the tall-image output is unchanged
+(`tall_proxy_output_bits_are_pinned`).
+
+Its example times the deep shrinks it was measured on:
 
 ```sh
 cargo build --release -p photocraft-algo --example bench_seam
-./target/release/examples/bench_seam 6000 4000 5400 4   # width height new_width channels (1..=4)
+./target/release/examples/bench_seam 6000 4000 600 4
+./target/release/examples/bench_seam 6000 4000 3000 4
 ```
 
-Build the base and the changed tree with separate `CARGO_TARGET_DIR`s and run the same line in both;
-the printed FNV hash of the output must match, and the millisecond figure is the row above. The
-example builds deterministic gradient-plus-detail content, so two runs of the same binary agree.
-
-## Correctness and repository checks
-
-`cargo test --release -p photocraft-algo seam` passes, including `carver_matches_reference`,
-`output_bits_are_pinned`, `tall_proxy_shrink_preserves_full_resolution_salient_and_protected_pixels`
-and the cancellation test. `cargo fmt --all --check` and
-`cargo clippy -p photocraft-algo --all-targets -- -D warnings` are clean. No command, UI or format
-contract changed; `Carver`'s `track` mode is still used by the enlargement path, which needs the
-original columns it was written for.
+On main with #8526 these printed fnv `0f7eaa6af3cf1557` and `1780ee9bc9077ee9`. Both changes keep
+the output unchanged, so the same hashes are expected; #8526's timings were taken on a different
+base than the ones above and are not comparable with them.
diff --git a/docs/shape-strokes.md b/docs/shape-strokes.md
index 61305c07b8..56c38d528a 100644
--- a/docs/shape-strokes.md
+++ b/docs/shape-strokes.md
@@ -79,6 +79,23 @@ zero. Set tool colours with `tools.setColors`. `ui.inspect` reports `toolOptions
 `toolOptions.stroke_width`, and the transient `strokeEditor`. Keyboard focus, standard number
 fields, colour pickers, and ComboBoxes remain native egui controls.
 
+## Paint
+
+The Fill and Stroke swatches (options bar and Properties) offer No Color, Solid and Gradient,
+as Photoshop's shape Fill/Stroke popover does. Gradient starts from the Gradient tool's current
+gradient (linear, 90°, 100%). Its tab (`shape_gradient_ui.rs`) has a Recent row (the gradients
+the popups last closed on, `ui.recent_gradients`) above the preset library (a pick takes the
+preset's colour and opacity stops, as a Gradient Fill layer made from it does), a stops strip
+(click below the ramp to add a colour stop, above it an opacity stop; drag a stop to move it or
+off the strip to delete it; drag a midpoint), the selected stop's colour (an inline picker),
+opacity, location and Delete, and the style, angle, scale, Reverse and Align with layer. Stop
+edits use the Gradient Editor's grammar (`gradient_fill_cmds::apply_stop`). With no
+shape selected the choice is the next shape's (`toolOptions.shape_fill_gradient` /
+`shape_stroke_gradient`; a colour replaces it, No Color keeps it); with one selected it is one
+`shape.edit`. The swatches send every gradient field (`opacityStops`, `midpoints`, `offset`,
+`dither`, `align`), so changing the angle of an imported gradient keeps the rest. Pattern paint is
+not offered yet.
+
 ## Upstream and public references
 
 - [PR #2218](https://github.com/storytold/photocraft/pull/2218) introduced these controls with
@@ -87,7 +104,8 @@ fields, colour pickers, and ComboBoxes remain native egui controls.
   parity, including selected-shape editing from the options bar and additional fill types;
   those remain separate work.
 - [Issue #1053](https://github.com/storytold/photocraft/issues/1053) documents the missing
-  stroke controls and existing engine/model support. Gradient fill UI remains separate work.
+  stroke controls and existing engine/model support. The Fill and Stroke swatches now have a
+  Gradient tab (see Paint below); a pattern paint UI remains separate work.
 - [Issue #1931](https://github.com/storytold/photocraft/issues/1931) requests sharp stroke options.
 - [PR #233](https://github.com/storytold/photocraft/pull/233),
   [#397](https://github.com/storytold/photocraft/pull/397), and
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 0609ff8c1e..5c9fcd4b99 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,6 +1,6 @@
 # PhotoCraft vs Adobe Photoshop: target-app parity
 
-> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-22 · **Change:** minor (Help › Check for Updates and an opt-out check once per launch, DIST-220-1 partial, #5485; area type, TYPE-218-10 partial, Type scorecard 5 / 5 / 0; compound layer properties export as separate Photoshop Set events, #8304; JPEG Options dialog landed, FILE-215-19 partial; Print › Functions › Bleed through `file.print`; Content-Aware Move live preview for every selection size, TOOL-213-4 done, #6680; retouching evidence: Pattern Stamp and Background Eraser draw live, only the Mixer Brush is left of TOOL-213-7; fill and adjustment layers copy and paste whole, UI-217-23 partial, #2344; shape layers take Density and Feather, TOOL-214-12 done, #5846; on-canvas corner radius widgets, TOOL-214-12; `.atn` import maps 112 events; Free Transform H/V skew fields; stale rows corrected against `main` and the scorecard, estimates unchanged; Photoshop Actions `.atn` load and save; 2026-10-10: Tilt-Shift measurements added; earlier the same day: major, full re-measure against Photoshop 2026 27.11.0; merged `parity-estimate.md` and the roadmap's honest assessment; stale missing-tool rows corrected: Color Replacement and Red Eye are live toolbar tools, Frame landed; percentages unchanged) · **Target:** Adobe Photoshop 2026
+> **Last reviewed:** 2026-10-12 · **Last updated:** 2026-10-25 · **Change:** minor (12 of 178 preferences do nothing, from the scorecard; the Camera Raw row names per-camera colour for non-DNG cameras as missing, not the Calibration panel, which landed 2026-10-13; Content-Aware Scale measurements added, #5236; Help › Check for Updates and an opt-out check once per launch, DIST-220-1 partial, #5485; area type, TYPE-218-10 partial, Type scorecard 5 / 5 / 0; compound layer properties export as separate Photoshop Set events, #8304; JPEG Options dialog landed, FILE-215-19 partial; Print › Functions › Bleed through `file.print`; Content-Aware Move live preview for every selection size, TOOL-213-4 done, #6680; retouching evidence: Pattern Stamp and Background Eraser draw live, only the Mixer Brush is left of TOOL-213-7; fill and adjustment layers copy and paste whole, UI-217-23 partial, #2344; shape layers take Density and Feather, TOOL-214-12 done, #5846; on-canvas corner radius widgets, TOOL-214-12; `.atn` import maps 112 events; Free Transform H/V skew fields; stale rows corrected against `main` and the scorecard, estimates unchanged; Photoshop Actions `.atn` load and save; 2026-10-10: Tilt-Shift measurements added; earlier the same day: major, full re-measure against Photoshop 2026 27.11.0; merged `parity-estimate.md` and the roadmap's honest assessment; stale missing-tool rows corrected: Color Replacement and Red Eye are live toolbar tools, Frame landed; percentages unchanged; PSD spot plates in Photoshop's polarity, #7415 split; TIFF spot plates, FILE-215-17's TIFF part, #7415) · **Target:** Adobe Photoshop 2026
 
 The authoritative answer to "how close is PhotoCraft to Photoshop, and how much work is left". The
 one-page summary is [`ROADMAP.md`](../ROADMAP.md); the ranked work list is [`gaps.md`](gaps.md);
@@ -76,7 +76,7 @@ Weights reflect what a working Photoshop user depends on (photographers, retouch
 | Dimension | Weight | % ready | Remaining (agent-h) | Evidence | Detail |
 |---|---:|---:|---:|---|---|
 | Features in depth (tools, layers, selections, type, filters, transforms) | 25% | 55% | 600–1,000 | Scorecard checklists: Tools 20 done / 15 partial / 6 missing, Type 5 / 5 / 0 (2026-10-22, area type partial), Automation 3 / 2 / 6. 14 tools missing; Select and Mask, Vanishing Point and Content-Aware Fill are parameter dialogs, not workspaces; type on a path partial; paragraph direction buttons exist but the visual RTL caret is missing | [gaps.md](gaps.md) |
-| UI / UX fidelity and feel | 15% | 40% | 350–600 | ~150 open UI issues; Workspace checklist 13 / 5 / 5 (2026-10-12; 5 / 7 / 11 on 2026-10-10); 27 of 156 preferences do nothing (was 46 of 149); no floating panel groups, thin Color panel, brush lag and pressure jumps reported | [ui-parity.md](ui-parity.md), [brush-parity.md](brush-parity.md) |
+| UI / UX fidelity and feel | 15% | 40% | 350–600 | ~150 open UI issues; Workspace checklist 13 / 5 / 5 (2026-10-12; 5 / 7 / 11 on 2026-10-10); 12 of 178 preferences do nothing (scorecard, 2026-10-25; was 27 of 156); no floating panel groups, thin Color panel, brush lag and pressure jumps reported | [ui-parity.md](ui-parity.md), [brush-parity.md](brush-parity.md) |
 | File formats and fidelity | 15% | 60% | 300–500 | PSD oracle on Photoshop-authored files 133/256 (52%); io corpus 146/170 (86%); psd-tools 236/309 (76%); round trips ~100% of corpus; but users report Photoshop refusing our files (#1281, #2469; a text-layer case, #2374, was fixed 2026-10-10); no Photoshop PDF, EPS, JPEG 2000, JPEG XL, AVIF read, CR3 | [file-format-parity.md](file-format-parity.md) |
 | Performance | 10% | 25% | 200–350 | 3 of 25 budgeted scenarios meet budget (baseline 2026-10-05); 150-layer nudge crashes the GPU path (P12); layer move on 15000×10000 16-bit 2.7 s p50; users report brush and cursor lag (#2619, #2566, #1994) | [scorecard.md](scorecard.md#performance) |
 | Stability | 10% | 45% | 150–250 | Never-crash lints on 28/28 crates, `panic_hunt` in the gate, atomic saves; but field reports of freezes (#2518 Type tool 60 s on macOS), GPU panics (#2020, #1215), no-GPU start failures (#2519, #2412) | [gaps.md](gaps.md) |
@@ -175,13 +175,13 @@ parity for the area and are already contained in the dimension rows above.
 | Adjustments and filters | 70% | 120–200 | All present; smart-filter re-render matches Photoshop on 5 of 30 files; Filter Gallery looks approximate; no Neural Filters |
 | Type | 40% | 120–200 | Engine works; manual/optical kerning, a live Warp Text preview and variable-font axis sliders (2026-10-11); type on a path only places glyphs rigidly (TYPE-218-1 partial); no RTL paragraphs, OpenType panel UI; Type tool freeze on macOS (#2518) |
 | Vector shapes and paths | 55% | 80–140 | Pen, Direct/Path Selection, shapes, shape strokes. Freeform and Curvature Pen (#1054). Add/Delete Anchor Point and Convert Point tools exist (`Tool` enum); on-canvas corner radius widgets on live rectangles (TOOL-214-12, 2026-10-13); shape Density and Feather, the path as the fill's soft vector mask, matching Photoshop's 10 px feather ramp within 1 level (#5846, 2026-10-15); missing path-point nudge; shape parity tracking issue #2496 |
-| Colour management and modes | 70% | 60–100 | Own ICC engine, soft proof, CMYK/Lab/Indexed/Duotone/Multichannel; no Adobe CMYK profiles, no spot plates (FILE-215-17), monitor profile only at launch |
-| Camera Raw and computational photo (Photomerge, HDR, lens) | 45% | 120–200 | Raw for DNG/CR2/NEF/ARW/RW2/ORF/RAF(uncompressed)/PEF; no CR3; ACR dialog partial (no masking, calibration); generic lens profiles only |
+| Colour management and modes | 70% | 60–100 | Own ICC engine, soft proof, CMYK/Lab/Indexed/Duotone/Multichannel; no Adobe CMYK profiles, spot plates in PSD and TIFF only (FILE-215-17: no RGB/CMYK spot preview or PDF Separation), monitor profile only at launch |
+| Camera Raw and computational photo (Photomerge, HDR, lens) | 45% | 120–200 | Raw for DNG/CR2/NEF/ARW/RW2/ORF/RAF(uncompressed)/PEF; no CR3; ACR dialog partial (no masking; no per-camera colour for non-DNG cameras); generic lens profiles only |
 | Automation, actions, batch, scripting | 45% | 120–200 | CLI/MCP/control channel ahead of Photoshop; Actions panel and recording not document-independent (AUTO-219-1/2); `.atn` load/save since 2026-10-12 (112 events mapped, the rest kept verbatim); compound layer properties export as separate Set events with rename last (#8304, 2026-10-21; independent Photoshop replay pending); no ExtendScript/UXP |
 | File I/O | 60% | 300–500 | See [file-format-parity.md](file-format-parity.md) |
 | Print, export, Save for Web | 50% | 60–100 | JPEG Options without Matte, progressive Scans or size preview (FILE-215-19), no Photoshop PDF, no separations, Save for Web settings not remembered |
 | Video / timeline, data-driven graphics | 30% | 100–200 | Menu items live; frame model persists in `.pcraft`; no PSD video-layer mapping |
-| Workspace, panels, preferences | 40% | 150–250 | 46 of 149 prefs do nothing; no floating/OS-window panel groups; Libraries, Comments, Contextual Task Bar missing |
+| Workspace, panels, preferences | 40% | 150–250 | 12 of 178 prefs do nothing (scorecard, 2026-10-25); no floating/OS-window panel groups; Libraries, Comments, Contextual Task Bar missing |
 | AI / generative | 10% | 300–600 | See the dimension row |
 
 Batch supports [output naming templates](batch-naming.md); AUTO-219-5 remains partial.
@@ -369,6 +369,15 @@ The transform also corrects f32 envelope errors past coordinate 4096, including
 distances at selected pixels. The parallel path needs an additional four bytes per pixel;
 see [measurements, correctness and limits](selection-distance-performance.md).
 
+2026-10-13: Content-Aware Scale keeps its seam search's path costs across seams (recomputing
+only the removed seam's basin) and no longer moves pixels. On a 4-core cloud VM (CPU, release,
+interleaved runs) the carve of P28's 24 MP photo to 90 % width takes 2013 → 556 ms (3.6×), the
+same image's height 2639 → 993 ms, and full-resolution searches 1.65–2.3× less time. The P28
+row with its document plumbing takes 3.28 → 1.64 s, within its 3 s budget. Output bits are
+unchanged wherever the energy stays a number (pinned hashes, reference comparison, a 37 000-case
+differential review); NaN and infinities are now deterministic. The committed baseline (954 s,
+older code) is unchanged until the reference machine reruns it; see [method and limits](seam-carving-performance.md).
+
 **Bottom line.** Two days after 0.2.0 we had merged ~96 PRs and closed ~48 issues, but **real
 Photoshop parity is still well below 50%**. The biggest gaps are AI, missing tools, professional
 workflow depth and the plug-in ecosystem. Most fixes since 0.2.0 have passed our tests but have
@@ -444,7 +453,7 @@ filled bar. This extends UI reachability and does not claim Photoshop-authored s
 | Smart filters / text / effect shapes in PSDs | Measured on our Photoshop-authored set (https://github.com/storytold/photocraft-corpus, `corpus/photoshop`, 258 files): see the per-group floors in `crates/io/tests/it/corpus.rs` and `crates/engine/tests/it/photoshop_oracles.rs`. Smart objects and smart filters now survive PSD save and open (41 corpus files, 206 smart objects, round trip strict; Photoshop opens our exports with live filters); re-rendering Photoshop's smart filters with ours matches 5/30 (was 1/30) | low–medium | Remaining re-render gaps are filter maths (Gaussian/Motion Blur, Unsharp Mask, Emboss, Add Noise RNG) and bicubic placement. |
 | Core editing (layers, masks, selections, adjustments, filters, transforms) | Broad engine coverage; many interaction bugs fixed after 0.2.0 (adjustment dialogs, Curves, crop, Move/Transform modifiers, gesture origin) | medium | Fixes not yet user-validated. |
 | UI / UX polish | Shortcut audit 214 → 0 failures; dock, Layers rows and menus reworked; first visual-QA sweep found 14 defects (#147–#157). 2026-10-07: the keyboard-only shortcuts with no menu item (⌥[ ⌥] ⌥, ⌥. layer navigation, ⇧⌥[ ⇧⌥] to extend the selection, 1–0 for opacity and ⇧ for flow or fill, ⇧[ ⇧] hardness, ⌥⌘T to transform a copy and ⌥⇧⌘T to step and repeat), ⌥-click colour sampling with painting tools, double-click a Layers row for Layer Style, File › New from Clipboard, a centred main window and remembered Liquify settings (#352, #417, #350, #368, #419, #418). 2026-10-09: canvas zoom is physical at any display scale — 100% is one document pixel per physical display pixel, and every screen-space overlay, cursor, scrollbar, navigator and fit follows it (#1943) | low–medium | Needs recurring visual QA with realistic documents. |
-| Tools | 2026-10-10: Pencil, Mixer Brush, Color Replacement, Patch, Content-Aware Move, Vertical Type, Pattern Stamp and Rotate View are toolbar tools. The only tool still missing is Art History Brush: Frame landed (#2914), Red Eye is a live toolbar tool (`paint.redEye`, TOOL-213-17) and Perspective Crop landed (2026-10-10, #1043, `image.perspectiveCrop`) | low–medium | Patch has a live healing preview. Content-Aware Move is done (`TOOL-213-4`): Move/Extend, Structure/Color, Sample All Layers, Transform On Drop, and a live result preview for every selection the command takes (coarse first for large ones, then exact; 2026-10-16, #6680). Magic/Background Eraser added; live gradients in progress (#180). Magnetic Lasso added 2026-10-08 (live-wire edge tracing, Width/Contrast/Frequency, `select.magneticLasso`). Pattern Stamp added 2026-10-08 (S flyout, `paint.patternStamp`, Aligned / Impressionist). Rotate View (2026-10-09) turns the canvas camera around its centre without rewriting pixels; Reset View and Match Rotation copy the angle. Crop rotation (2026-10-09, #1792): dragging outside the crop frame turns it (⇧ 15° steps, angle readout), and ↵ rotates the document and crops in one undo step (`image.crop` `angle`); the frame turns over the image as in Photoshop's Classic Mode, and the options-bar Straighten is still missing. |
+| Tools | 2026-10-10: Pencil, Mixer Brush, Color Replacement, Patch, Content-Aware Move, Vertical Type, Pattern Stamp, Rotate View and Art History Brush are toolbar tools. Every toolbar tool is present: Art History Brush is in the Y flyout (`paint.artHistoryBrush`, TOOL-213-20, partial: 8 of 10 styles, Area scales spacing), Frame landed (#2914), Red Eye is a live toolbar tool (`paint.redEye`, TOOL-213-17) and Perspective Crop landed (2026-10-10, #1043, `image.perspectiveCrop`) | low–medium | Art History Brush paints stylized dabs from the History Brush source (Tight/Loose/Dab/Curl styles, Area, Tolerance); the two Curl Long styles, Photoshop's Area coverage, Mode/Opacity on the options bar and pen pressure are open. Patch has a live healing preview. Content-Aware Move is done (`TOOL-213-4`): Move/Extend, Structure/Color, Sample All Layers, Transform On Drop, and a live result preview for every selection the command takes (coarse first for large ones, then exact; 2026-10-16, #6680). Magic/Background Eraser added; live gradients in progress (#180). Magnetic Lasso added 2026-10-08 (live-wire edge tracing, Width/Contrast/Frequency, `select.magneticLasso`). Pattern Stamp added 2026-10-08 (S flyout, `paint.patternStamp`, Aligned / Impressionist). Rotate View (2026-10-09) turns the canvas camera around its centre without rewriting pixels; Reset View and Match Rotation copy the angle. Crop rotation (2026-10-09, #1792): dragging outside the crop frame turns it (⇧ 15° steps, angle readout), and ↵ rotates the document and crops in one undo step (`image.crop` `angle`); the frame turns over the image as in Photoshop's Classic Mode, and the options-bar Straighten is still missing. |
 | Painting | Brush model and Brush Settings panel near Photoshop; .abr/.grd import; persistent presets; pen pressure/tilt on Windows, web, macOS and X11 | medium | Native Wayland pen input open (#79; a pen opens the window through Xwayland meanwhile); X11 pressure confirmed by a user, macOS not yet verified on tablet hardware. |
 | Text / typography | Engine works; caret placement and size editing fixed; OpenType features, text-on-path editing, composer parity partial | medium-low | Measure with the Photoshop-authored set. |
 | Colour management | Colour-managed canvas (document → monitor), embedded CMYK profiles, linear EXR/HDR, 16-bit float canvas | medium-high | Monitor profile follows only at launch. |
@@ -565,6 +574,9 @@ See [method, raw measurements and reproduction](five-algorithm-performance.md).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-25 | minor | UI / UX and Workspace rows: 12 of 178 preferences do nothing, the scorecard's count. Camera Raw row: the Calibration panel landed on 2026-10-13 (#5128); what is missing is per-camera colour for non-DNG cameras ([gaps.md](gaps.md) G14). Percentages and estimates unchanged |
+| 2026-10-23 | minor | Colour management and modes: PSD spot plates are stored as Photoshop stores them (ink 0 = solid), and PSDs from earlier PhotoCraft versions keep their ink (#7415 split, part 4); estimates unchanged |
+| 2026-10-23 | minor | Colour management and modes: spot plates now save and open in TIFF (#7415); estimates unchanged |
 | 2026-10-22 | minor | Platforms: Help › Check for Updates and an opt-out check once per launch (#5485), DIST-220-1 partial; percentages unchanged |
 | 2026-10-21 | minor | #8304: compound layer properties export as separate Set events, rename last; independent Photoshop replay pending; percentages and estimates unchanged |
 | 2026-10-19 | minor | JPEG Options dialog landed (FILE-215-19 partial: no Matte, progressive Scans or size preview); percentages unchanged |
@@ -575,6 +587,7 @@ See [method, raw measurements and reproduction](five-algorithm-performance.md).
 | 2026-10-15 | minor | Print: Functions › Bleed (`file.print` / `file.printOneCopy` `bleed`, corner crop marks on the trim line, PDF and Windows paths); the Print dialog field is still missing; percentages unchanged |
 | 2026-10-13 | minor | Vector shapes: on-canvas corner radius widgets on live rectangles (TOOL-214-12); estimates unchanged |
 | 2026-10-13 | minor | Stale "missing tool" rows corrected against main: Color Replacement (`paint.colorReplacement`), Red Eye (`paint.redEye`) and Add/Delete Anchor Point (the Pen flyout) are live toolbar tools and Frame landed, so Art History Brush is the only tool still missing; percentages unchanged |
+| 2026-10-13 | minor | Added measured Content-Aware Scale gains (P28 under its budget on a 4-core VM, not yet in the baseline); percentages and budgets unchanged |
 | 2026-10-12 | minor | Free Transform options bar H/V skew fields; percentages unchanged |
 | 2026-10-12 | minor | `.atn` import: 112 events mapped (TrueGrit Texture Supply sets play end to end); percentages unchanged |
 | 2026-10-11 | minor | Type row evidence: manual/optical kerning and the live Warp Text preview are done (TYPE-218-6/7; variable-font axes TYPE-218-4 too); the 40% estimate is not re-measured |
diff --git a/docs/ui-design.md b/docs/ui-design.md
index 24a30a16ed..58e07207f1 100644
--- a/docs/ui-design.md
+++ b/docs/ui-design.md
@@ -172,7 +172,8 @@ Edit → Preferences → Interface → UI Scale applies immediately. Auto follow
 system's display scale, including fractional scales such as 125%, 150% and 175% (on Linux,
 Wayland's fractional scale or X11's `Xft.dpi`), and updates when the window moves between
 monitors. A 4K display the system runs at 100% stays at 100% (#1278). The fixed choices (75% to
-300%) set an absolute UI scale, for example 200% on an unscaled 4K display. Canvas zoom shortcuts
+300%) set an absolute UI scale, for example 200% on an unscaled 4K display, with 105%, 110%,
+115% and 120% for finer control between 100% and 125%. Canvas zoom shortcuts
 continue to control the document independently of UI scaling.
 
 On a Wayland session with a fractional display scale, the interface is sharp only in a native
diff --git a/docs/ui-dialogs.md b/docs/ui-dialogs.md
index 8767f59714..634c7711a0 100644
--- a/docs/ui-dialogs.md
+++ b/docs/ui-dialogs.md
@@ -56,7 +56,7 @@ Dispatch order matches `dialogs::show` in `dialogs.rs` (check earlier rows befor
 | `__resetAllTools` | `tool_reset.rs` | Reset All Tools confirmation |
 | `__cropPresetNew` / `__cropPresetDelete` | `crop_presets.rs` | New / delete crop preset |
 | `__variables` | `variables_ui.rs` | Image › Variables (Define, Data Sets, Apply) |
-| `__web` / `__print` | `file_ui.rs` | Save for Web, Print |
+| `__web` / `__print` | `file_ui.rs` | Save for Web (reopens on the preview tab chosen last, #9174), Print |
 | `__colorPicker` | `color_picker_ui.rs` | Foreground/background, nested field/command pickers (see nested keys below) |
 | `__colorRange` | `color_range_ui.rs` | Select › Color Range… |
 | `__prefsui` | `prefs_ui.rs` | Edit › Preferences… and related preset/import subdialogs |
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index 8a189ad491..81b0ab81d6 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -1,6 +1,6 @@
 # UI parity: tools, handles, modifiers and feel
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-23 · **Change:** minor (⌥ + an adjustment's shortcut reopens it at its last settings, ⌥⌘L / ⌥⌘M, #8900; Crop default mode: moving the image under the box snaps the frame's edges and centre, #8580; View › Extras hides the Move transform controls, #6699; adjustment clipping stays visible in compact Properties, #5231; Color panel modes from its panel menu, the same in every theme, UI-217-17, #6000; a picked colour recolours the selected type and shapes; Hand tool ⌘ / ⌥ are Zoom In / Zoom Out while held, #6434; the wheel steps value fields, #5473; a dragged guide shows its X or Y beside the pointer, #7680; Type options bar "T" icon scrubs the font size, #6437; Move tool: dragged selected pixels take their own outline as the selection, #7538; artboard backgrounds remain below child Free Transform previews; ⌫/Delete removes the selected smart filter, #4751; Object Finder foreground/background discrimination (#6548); rounded triangle, polygon and star corners; shape Fill/Stroke popovers accept hex RGB values, #6176; a guide let go over either ruler is removed, #6286; Crop rows corrected: saved crop presets and Delete Cropped Pixels off are done, #6562; marching ants in device pixels, #7489; Animated Zoom: holding the Zoom tool zooms continuously, #6210; shape Density and Feather, TOOL-214-12, #5846; Pen Auto Add/Delete on the path being drawn, #6140; Show Transform Controls frames every selected layer; guide keys and clicks; menu bar from the keyboard, #4988; Crop tool Content-Aware Fill; on-canvas corner radius widgets, TOOL-214-12; Curvature Pen edits the active path; Clip Thumbnails to Layer Bounds; Pen ⇧ 45°; last selected tool restored at launch; Layers panel filter-type dropdown with Kind, Name and Mode, #5048; Free Transform box and marching ants follow the selection, #5297; History: the trash deletes the selected snapshot, rows drag onto the trash, #5324; smart filter reordering by drag; smart object perspective row corrected to done, #426; Free Transform H/V skew fields; toolbar tool shortcuts can be reassigned; ⇧-dragged guides land on ruler ticks; layer and selection keys; tool keys; spring-loaded tool letters; type formatting keys; Pen Auto Add/Delete, #4144; smart filter rows; stale missing-tool rows corrected: Color Replacement, Red Eye and the Add/Delete Anchor Point pair are live toolbar tools, Frame landed; no percentage changed; selection-modifier and ⌥-wheel rows match their tests) · **Target:** Adobe Photoshop 2026
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-25 · **Change:** minor (12 of 178 preferences do nothing, from the scorecard; Art History Brush in the History group of the Y flyout, partial, TOOL-213-20, #1610; Histogram panel: Compact / Expanded / All Channels views, Luminosity and Colors channels, Source, range statistics, Uncached Refresh, live adjustment overlay, Cache Levels preference; the font menu opens on the current family, marked in the recent group when it is a recent one, #9160; Type options bar alignment and direction follow the target paragraph; a swatch click recolours selected type and shape layers with any tool, #9238; UI scale presets done: 105–120% steps, #3222; ⇧⌥ blend mode letters; painting tool Mode menus; ⌥ + an adjustment's shortcut reopens it at its last settings, ⌥⌘L / ⌥⌘M, #8900; Crop default mode: moving the image under the box snaps the frame's edges and centre, #8580; View › Extras hides the Move transform controls, #6699; adjustment clipping stays visible in compact Properties, #5231; Color panel modes from its panel menu, the same in every theme, UI-217-17, #6000; a picked colour recolours the selected type and shapes; Hand tool ⌘ / ⌥ are Zoom In / Zoom Out while held, #6434; the wheel steps value fields, #5473; a dragged guide shows its X or Y beside the pointer, #7680; Type options bar "T" icon scrubs the font size, #6437; Move tool: dragged selected pixels take their own outline as the selection, #7538; artboard backgrounds remain below child Free Transform previews; ⌫/Delete removes the selected smart filter, #4751; Object Finder foreground/background discrimination (#6548); rounded triangle, polygon and star corners; shape Fill/Stroke popovers accept hex RGB values, #6176; a guide let go over either ruler is removed, #6286; Crop rows corrected: saved crop presets and Delete Cropped Pixels off are done, #6562; marching ants in device pixels, #7489; Animated Zoom: holding the Zoom tool zooms continuously, #6210; shape Density and Feather, TOOL-214-12, #5846; Pen Auto Add/Delete on the path being drawn, #6140; Show Transform Controls frames every selected layer; guide keys and clicks; menu bar from the keyboard, #4988; Crop tool Content-Aware Fill; on-canvas corner radius widgets, TOOL-214-12; Curvature Pen edits the active path; Clip Thumbnails to Layer Bounds; Pen ⇧ 45°; last selected tool restored at launch; Layers panel filter-type dropdown with Kind, Name and Mode, #5048; Free Transform box and marching ants follow the selection, #5297; History: the trash deletes the selected snapshot, rows drag onto the trash, #5324; smart filter reordering by drag; smart object perspective row corrected to done, #426; Free Transform H/V skew fields; toolbar tool shortcuts can be reassigned; ⇧-dragged guides land on ruler ticks; layer and selection keys; tool keys; spring-loaded tool letters; type formatting keys; Pen Auto Add/Delete, #4144; smart filter rows; stale missing-tool rows corrected: Color Replacement, Red Eye and the Add/Delete Anchor Point pair are live toolbar tools, Frame landed; no percentage changed; selection-modifier and ⌥-wheel rows match their tests; Properties › Transform shows a shape's path geometry, without its stroke) · **Target:** Adobe Photoshop 2026
 
 How PhotoCraft's direct manipulation compares with Photoshop 2026 (27.11.0): the toolbox, the
 handles and modifier keys of each gesture, nudging, snapping, numeric precision, navigation,
@@ -36,7 +36,7 @@ Triangle and Curvature Pen (minus legacy Rounded Rectangle and Targeted Adjustme
 | Retouch | Remove, Spot Healing, Healing, Patch, Content-Aware Move, Red Eye | |
 | Brush | Brush, Pencil, Mixer Brush | |
 | Stamp | Clone Stamp, Pattern Stamp | |
-| History | History Brush | Art History Brush |
+| History | History Brush, Art History Brush (partial: 8 of 10 styles, TOOL-213-20) | |
 | Eraser | Eraser, Background Eraser, Magic Eraser | |
 | Fill | Gradient, Paint Bucket | |
 | Focus, toning | Blur, Sharpen, Smudge, Dodge, Burn, Sponge | |
@@ -209,6 +209,7 @@ Triangle and Curvature Pen (minus legacy Rounded Rectangle and Targeted Adjustme
 | Type formatting keys while editing text | done: ⇧⌘K, U, B, I and / toggle All Caps, Underline, Faux Bold, Faux Italic, Strikethrough (off when every selected character has it, else on); ⌥↑/↓ leading ∓2 pt, ⇧⌥↑/↓ baseline shift ±2 pt (10 with ⌘); ⌥←/→ tracking ±20 over a selection (100 with ⌘; a collapsed caret still kerns); ⌥⇧⌘H toggles Hyphenate for the touched paragraphs. One `type.setStyle` step per press (new `leadingBy`/`baselineShiftBy`/`trackingBy`; auto leading starts from its laid-out value); the global ⇧⌘K/U/B/I never fire while typing. Differs: a collapsed caret in non-empty text changes nothing, since the model can't hold a pending style for the next characters typed (empty text takes it as its typing style) (`type_tool.rs`, `input_tests.rs` `type_tool_format_keys_*`) | |
 | ⌥ + an adjustment's shortcut opens it at its last settings (⌥⌘L Levels, ⌥⌘M Curves, and so ⌥⌘U, ⌥⌘B) | done (#8900): the settings of the last OK, kept in the preferences; Cancel and smart filter edits keep nothing; a key assigned to another command stays that command's. ⌥ while choosing the item from Image › Adjustments does the same | `shortcut_dispatch/tests.rs` `alt_adjustment_shortcut_reopens_the_last_confirmed_settings`, `alt_choosing_an_adjustment_from_the_menu_reopens_the_last_settings` |
 | Guides: click selects, Delete deletes, right-click menu, ⌥-click turns a guide, double-click opens Guides, Grid & Slices | done (2026-10-12) | a guide let go over either ruler is removed, not only off the canvas (#6286) |
+| Blend mode keys: ⇧⌥ + letter picks a mode (N Normal, I Dissolve, R Clear, P Pass Through, K M B A darken, G S D W lighten, O F H V J Z L contrast, E X difference, U T C Y component), ⇧+ / ⇧− step through them | done (2026-10-14): Brush, Pencil and Gradient take them as their own mode (Clear on Brush, Pencil and Paint Bucket only), any non-painting tool sets every selected layer in one undo step (Pass Through on groups only; the Background is skipped); the typed letter wins, the physical key is the fallback for ⌥ characters on a Mac. ⇧⌥ letters no longer switch tools. While a Free Transform box is open they, and the number keys, still reach the tool (or the layers) without closing it; Puppet Warp and Perspective Warp keep them to themselves. Clone Stamp, Pattern Stamp, History Brush, Healing (its own short list) and Paint Bucket (with Clear) take them as their own mode; tools without a blend mode (the Erasers, Mixer Brush) set the layers. Differs: Behind (⇧⌥Q) is not implemented; Spot Healing, Color Replacement, Blur, Sharpen and Smudge ignore the keys until their options bar has a Mode, and Dodge, Burn and Sponge ignore them until their Range and mode keys (⇧⌥S/M/H, ⇧⌥D/S) exist | `blend_keys.rs` |
 
 ## Panels and workspace
 
@@ -224,13 +225,14 @@ Paragraph; the rest open as in-app floating windows.
 | Drag panels to reorder and regroup | partial | #2272, #2305 |
 | Docked resize pushes the neighbour | partial | #2573 |
 | Color panel modes from its panel menu (Hue Cube, Brightness Cube, Color Wheel, Grayscale/RGB/HSB/CMYK/Lab/Web Color sliders), colour ramp (RGB/CMYK Spectrum, Grayscale Ramp, Current Colors, Make Ramp Web Safe; Shift-click cycles, Alt-click picks the other colour), Copy Color as HTML / Hex Code; the same in every theme | done | `color_panel_ui.rs`, `color_panel_tests.rs`; UI-217-17, #2569, #6000 |
-| A colour picked in the Color or Swatches panel or the Color Picker recolours the selection: selected characters while editing; every selected type layer with a Type tool; every selected shape's fill with a shape, Pen or path selection tool; only the foreground with other tools, the Move tool too; one history step (a Color panel drag too) | done: `apply_color.rs`, `apply_color_tests.rs` | |
+| A colour picked in the Color or Swatches panel or the Color Picker recolours the selection: selected characters while editing; every selected type layer with a Type tool; every selected shape's fill with a shape, Pen or path selection tool; only the foreground with other tools, the Move tool too; a swatch click recolours the selected type layers and shape fills whatever the tool (#9238); one history step (a Color panel drag too) | done: `apply_color.rs`, `apply_color_tests.rs` | |
 | Window size and dock width remembered | done | UI-217-2 |
+| Histogram panel: Compact (the default, of the entire image), Expanded and All Channels views (the channel kept across them); RGB/CMYK/Lab/Gray channels, Luminosity and Colors (overlaid, mixed where they overlap); Show Channels in Color and Show Statistics; Source (Entire Image, Selected Layer, Adjustment Composite) for multilayer documents; Mean, Std Dev, Median, Pixels, Level, Count, Percentile and Cache Level for the pointer level or a dragged range; the cached-data warning, Uncached Refresh (menu, button, warning click, double-click); the adjusted histogram over the original while an adjustment previews; Cache Levels 1–8 in Preferences › Performance; Color Sampler levels marked on the graph | partial | `histogram_panel.rs`, `histogram_panel_tests.rs`, `tone.rs`; differs: filter dialogs that preview on the CPU proxy aren't counted live, a selection doesn't limit the histogram yet, with Source Selected Layer an adjustment dialog's preview isn't counted, and new strings are English-only so far |
 | Command palette with recents | done | UI-217-7 |
 | Menu bar from the keyboard: Alt / F10 focus the bar, ← → ↓ ↩ drive it, Alt+letter opens a menu, underlined mnemonics run items | done | `menu_keys.rs`, #4988; macOS uses the native bar |
-| Every preference takes effect | partial | 46 of 149 do nothing (scorecard) |
-| UI scale presets | missing | UI-217-9, #2492 |
-| History snapshots: camera button, snapshot rows (click returns and selects, rename, delete; the trash deletes the selected snapshot, and a snapshot or state dragged onto it, #5324), `history.*Snapshot` commands | partial | `history_cmds.rs`, `snapshot_rows` in `panels.rs`; New Snapshot dialog, first snapshot and History Options to come (#2966) |
+| Every preference takes effect | partial | 12 of 178 do nothing (scorecard, 2026-10-25) |
+| UI scale presets | done | UI-217-9; 75–125% in 5% steps (#2492, #3222) |
+| History snapshots: camera button, New Snapshot dialog (⌥-click: Name, From), the first snapshot (the document as opened), snapshot rows (click returns and selects, rename, delete; the trash deletes the selected snapshot, and a snapshot or state dragged onto it, #5324), `history.*Snapshot` commands | partial | `history_cmds.rs`, `snapshot_rows` in `panels.rs`, `snapshot_dialog.rs`; the snapshot History Options and History Brush sources to come (#2966) |
 | Themes: Photoshop's four greys | partial | five themes; #2661 |
 | Document tabs: overflow, context menu, reorder | done | UI-217-6; middle-click close #2570 |
 | Layers panel: wheel steps blend modes, drop on New/Trash | partial | UI-217-14 |
@@ -244,6 +246,12 @@ Paragraph; the rest open as in-app floating windows.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-25 | minor | Every preference takes effect: 12 of 178 do nothing, the scorecard's count (it still said 46 of 149) |
+| 2026-10-25 | minor | Art History Brush is in the History group of the Y flyout (partial, TOOL-213-20, #1610) |
+| 2026-10-24 | minor | Swatches: a click recolours the selected type layers and shape fills whatever the tool, as Photoshop 2025 does (measured with the Move and Brush tools); the Color panel still recolours them only with a Type, shape or Pen tool (#9238). Scores unchanged. |
+| 2026-10-24 | minor | Type options bar: the alignment and paragraph-direction buttons show the edited or selected type layer's paragraph instead of the tool defaults, as Photoshop's bar does. Scores unchanged. |
+| 2026-10-24 | minor | Font menus (options bar, Character panel): the current family is marked in the recent group when it is a recent one, and the menu opens showing it, as Photoshop's does, scrolled to the marked row when it sits below the fold; the arrows walk on from the marked row (#9160). Scores unchanged. |
+| 2026-10-24 | minor | Properties › Transform shows and edits a shape layer's path geometry (W/H/X/Y), not the pixel bounds its stroke adds, as in Photoshop; W/H scale the path to exactly the typed size. Scores unchanged. |
 | 2026-10-22 | minor | Crop default mode: a drag inside an upright box snaps the frame's edges and centre to the document, layers, guides and grid, as a Classic Mode frame's move does (#8580); no percentage changed |
 | 2026-10-21 | minor | Adjustment clipping moved above Properties editors to remain visible in compact docks (#5231); scope, undo/redo and 8/16/32-bit pixel regressions; readiness estimate unchanged |
 | 2026-10-19 | minor | A guide being moved or dragged out of a ruler shows an `X:` / `Y:` position readout beside the pointer, from the zero point in the ruler unit (#7680) |
@@ -252,6 +260,7 @@ Paragraph; the rest open as in-app floating windows.
 | 2026-10-16 | minor | Hand tool ⌘ / ⌥ held are temporary Zoom In / Zoom Out (#6434); Scroll All Windows and Bird's Eye View rows added as missing |
 | 2026-10-16 | minor | Type options bar: dragging the "T" icon scrubs the font size, as the Character panel's icons do (#6437) |
 | 2026-10-16 | minor | Shape Fill/Stroke compact pickers accept six-digit hex RGB, including pasted values with `#`, retaining alpha and high-depth paint until an edit; typed/pasted colour and history regressions (#6176). Scores unchanged. |
+| 2026-10-16 | minor | UI scale presets done: 105–120% steps, #3222 |
 | 2026-10-15 | minor | Shape Density and Feather row added as done (TOOL-214-12, #5846) |
 | 2026-10-15 | minor | A guide let go over either ruler is removed, not only off the canvas: the top ruler measures document x and the left one y, so the ruler a guide was not dragged out of can lie over a coordinate inside the document (#6286) |
 | 2026-10-13 | minor | Menu bar from the keyboard: Alt / F10 focus, Alt+letter, underlined mnemonics (#4988) |
@@ -284,6 +293,7 @@ Paragraph; the rest open as in-app floating windows.
 | 2026-10-12 | minor | Layers panel: Clip Thumbnails to Layer Bounds frames each layer's pixels instead of the canvas (#4281) |
 | 2026-10-12 | minor | Guides: ⌥-click turns a guide through the click; double-click opens Preferences › Guides, Grid & Slices |
 | 2026-10-13 | minor | Smart filter rows can be dragged up or down their stack to reorder the filters |
+| 2026-10-12 | minor | History snapshots: the New Snapshot dialog (⌥-click the camera), and the first snapshot of the document as opened as the panel's top row (#2966) |
 | 2026-10-13 | minor | On-canvas corner radius widgets on live rectangles (TOOL-214-12) |
 | 2026-10-13 | minor | Curvature Pen edits the active path: drag anchors, click a segment to add, double-click smooth/corner, cursor badges |
 | 2026-10-11 | minor | Pen ⇧ 45° done: ⇧-click puts the next anchor on the nearest 45° ray, ⇧-drag turns its handles in 45° steps (TOOL-214-10 done, #3751) |
@@ -300,3 +310,6 @@ Paragraph; the rest open as in-app floating windows.
 | 2026-10-14 | minor | A colour picked in the Color or Swatches panel or the Color Picker recolours the selected type layers (Type tool) or shape fills (shape, Pen and path selection tools) |
 | 2026-10-15 | minor | Color panel: Photoshop's panel-menu modes, colour ramp and copy commands; the theme no longer picks the panel's layout (UI-217-17 done, #2569, #6000) |
 | 2026-10-23 | minor | ⌥ + an adjustment's shortcut (⌥⌘L Levels, ⌥⌘M Curves) opens its dialog at the settings of its last OK, as in Photoshop (#8900); no percentage changed |
+| 2026-10-14 | minor | ⇧⌥ + letter blend mode keys for the painting tool or every selected layer; ⇧+ / ⇧− now step every selected layer and include Clear for Brush and Pencil |
+| 2026-10-15 | minor | ⇧⌥ blend mode letters work while a Free Transform box is open, without picking a tool |
+| 2026-10-14 | minor | Mode dropdowns for Clone Stamp, Pattern Stamp, History Brush, Healing and Paint Bucket; the blend mode keys reach them, and tools without a blend mode (not Dodge, Burn or Sponge) pass the keys to the layers |
diff --git a/packaging/env.sh b/packaging/env.sh
index 5b4bfe0b4c..026dff0c1f 100644
--- a/packaging/env.sh
+++ b/packaging/env.sh
@@ -47,7 +47,7 @@ warn() {
 # Copy licence and readme files that exist into a package directory.
 copy_docs() {
   local dest="$1" f
-  for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT; do
+  for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT NOTICE ATTRIBUTION.md; do
     if [[ -f "$ROOT/$f" ]]; then cp "$ROOT/$f" "$dest/"; fi
   done
   copy_font_licences "$dest"
diff --git a/packaging/linux/flatpak/ai.storyteller.photocraft.yml b/packaging/linux/flatpak/ai.storyteller.photocraft.yml
index e3ac74cffd..4738c9bda6 100644
--- a/packaging/linux/flatpak/ai.storyteller.photocraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.photocraft.yml
@@ -49,6 +49,8 @@ modules:
     build-commands:
       - cargo --offline build --release --locked -p photocraft --features heif
       - install -Dm755 target/release/photocraft /app/bin/photocraft
+      - install -Dm644 NOTICE /app/share/doc/photocraft/NOTICE
+      - install -Dm644 ATTRIBUTION.md /app/share/doc/photocraft/ATTRIBUTION.md
       - install -Dm644 packaging/linux/ai.storyteller.photocraft.desktop /app/share/applications/ai.storyteller.photocraft.desktop
       - install -Dm644 packaging/linux/ai.storyteller.photocraft.mime.xml /app/share/mime/packages/ai.storyteller.photocraft.xml
       - mkdir -p /app/share/icons && cp -R assets/app-icon/hicolor /app/share/icons/
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index e24f8c09fc..8bfcc164aa 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -137,7 +137,6 @@ fi
 if has appimage; then
   APPDIR="$WORK/PhotoCraft.AppDir"
   cp -R "$STAGE" "$APPDIR"
-  mv "$APPDIR/usr/share/doc" "$WORK/doc-unused"
   # AppRun is a script, not a symlink: it installs the .desktop entry and icons into
   # $XDG_DATA_HOME before launching, so Wayland compositors can resolve the window's
   # app_id to our icon instead of the generic Wayland logo (#593; opt-out env in the
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index b4be928efd..eb4e79e069 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -106,7 +106,7 @@ staple() {
     if xcrun stapler staple "$file" && xcrun stapler validate "$file"; then
       return
     fi
-    if [ "$attempt" = 5 ]; then
+    if [[ "$attempt" = 5 ]]; then
       echo "error: stapling $(basename "$file") failed after $attempt attempts" >&2
       exit 1
     fi
@@ -121,6 +121,8 @@ mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
 # Executable and icon carry the display name (CFBundleExecutable / CFBundleIconFile).
 cp "$WORK/bin/photocraft" "$APP/Contents/MacOS/PhotoCraft"
 cp "$ROOT/assets/app-icon/photocraft.icns" "$APP/Contents/Resources/PhotoCraft.icns"
+# Notices for the bundled font fallback, included before the bundle is signed.
+cp "$ROOT/NOTICE" "$ROOT/ATTRIBUTION.md" "$APP/Contents/Resources/"
 # Licences of the embedded craft-fonts fonts (only when built with CRAFT_FONTS_DIR).
 if [[ -n "${CRAFT_FONTS_DIR:-}" ]]; then
   mkdir -p "$APP/Contents/Resources/Licenses"
diff --git a/packaging/macos/verify.sh b/packaging/macos/verify.sh
index 46f779c2cf..8e4dab21a8 100755
--- a/packaging/macos/verify.sh
+++ b/packaging/macos/verify.sh
@@ -73,9 +73,9 @@ assess() {
 # `stapler validate` asks Apple's CloudKit service too, which sometimes drops the connection
 # (error 68) though the ticket is there.
 validate_staple() {
-  local attempt
+  local target="$1" attempt
   for attempt in 1 2 3 4 5; do
-    xcrun stapler validate "$1" && return 0
+    xcrun stapler validate "$target" && return 0
     [[ "$attempt" = 5 ]] || sleep $((attempt * 20))
   done
   return 1
diff --git a/packaging/windows/package.ps1 b/packaging/windows/package.ps1
index 53bf286558..0913011598 100644
--- a/packaging/windows/package.ps1
+++ b/packaging/windows/package.ps1
@@ -91,6 +91,21 @@ Copy-Item (Join-Path $Bin 'photocraft.exe'), (Join-Path $Bin 'photocraft-cli.exe
 
 & (Join-Path $PSScriptRoot 'sign.ps1') (Join-Path $Stage 'photocraft.exe') (Join-Path $Stage 'photocraft-cli.exe')
 
+# ---- font notices for the MSI ------------------------------------------------------------------
+# The portable ZIP already carries these notices; stage the complete files before MSI creation too.
+$Docs = Join-Path $Stage 'font-licences'
+New-Item -ItemType Directory -Force -Path $Docs | Out-Null
+# The existing MSI document group also carries notices for bundled egui font inputs.
+Copy-Item -LiteralPath (Join-Path $Root 'NOTICE'), (Join-Path $Root 'ATTRIBUTION.md') -Destination $Docs
+$HasCraftFontLicences = 1
+if ($env:CRAFT_FONTS_DIR) {
+  foreach ($ofl in Get-ChildItem -Path (Join-Path $env:CRAFT_FONTS_DIR 'fonts\*\OFL.txt') -File -ErrorAction SilentlyContinue) {
+    Copy-Item -LiteralPath $ofl.FullName -Destination (Join-Path $Docs "OFL-$($ofl.Directory.Name).txt")
+    $HasCraftFontLicences = 1
+  }
+}
+# ---- end font notices for the MSI --------------------------------------------------------------
+
 # ---- MSI ---------------------------------------------------------------------------------------
 # The setup wizard's art, drawn here from the app icon so the MSI shows PhotoCraft rather than
 # WiX's stock bitmaps: a 493x58 banner across the top of the inner pages (the page title is drawn
@@ -137,6 +152,7 @@ Invoke-Native 'wix build' {
     -culture en-US -loc (Join-Path $PSScriptRoot 'photocraft.en-us.wxl') `
     -d "Version=$MsiVersion" -d "DisplayVersion=$Version" -d "BinDir=$Stage" -d "IconPath=$(Join-Path $Root 'assets\app-icon\photocraft.ico')" `
     -d "BannerBmp=$Banner" -d "DialogBmp=$Dialog" `
+    -d "DocsDir=$Docs" -d "HasCraftFontLicences=$HasCraftFontLicences" `
     -o $Msi
 }
 Invoke-Native 'MSI shortcut icon validation (ICE50)' {
@@ -151,7 +167,7 @@ $Portable = Join-Path $TargetDir "windows-package\photocraft-$Version-windows-$A
 Remove-Item -Recurse -Force $Portable -ErrorAction SilentlyContinue
 New-Item -ItemType Directory -Force -Path $Portable | Out-Null
 Copy-Item (Join-Path $Stage '*.exe') $Portable
-foreach ($f in 'README.md', 'LICENSE', 'LICENSE-MIT', 'LICENSE-APACHE') {
+foreach ($f in 'README.md', 'LICENSE', 'LICENSE-MIT', 'LICENSE-APACHE', 'NOTICE', 'ATTRIBUTION.md') {
   $p = Join-Path $Root $f
   if (Test-Path $p) { Copy-Item $p $Portable }
 }
diff --git a/packaging/windows/photocraft.wxs b/packaging/windows/photocraft.wxs
index 8be9ff893c..449591fe7c 100644
--- a/packaging/windows/photocraft.wxs
+++ b/packaging/windows/photocraft.wxs
@@ -16,6 +16,9 @@
 -->
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs"
      xmlns:ui="http://wixtoolset.org/schemas/v4/wxs/ui">
+  <?ifndef HasCraftFontLicences ?>
+  <?define HasCraftFontLicences=0 ?>
+  <?endif ?>
   <Package
       Name="PhotoCraft"
       Manufacturer="Learning Machines LLC"
@@ -50,6 +53,9 @@
     </Property>
 
     <Feature Id="Main" Title="PhotoCraft" Level="1">
+      <?if $(var.HasCraftFontLicences) = 1 ?>
+      <ComponentGroupRef Id="CraftFontLicences" />
+      <?endif ?>
       <ComponentGroupRef Id="PhotocraftFiles" />
     </Feature>
 
@@ -80,6 +86,11 @@
   </Package>
 
   <Fragment>
+    <?if $(var.HasCraftFontLicences) = 1 ?>
+    <ComponentGroup Id="CraftFontLicences" Directory="INSTALLFOLDER">
+      <Files Include="$(var.DocsDir)\**" />
+    </ComponentGroup>
+    <?endif ?>
     <ComponentGroup Id="PhotocraftFiles" Directory="INSTALLFOLDER">
       <Component Id="PhotocraftApp" Guid="A6DE41B7-A80F-4C59-A17E-BB68065BF67E">
         <File Id="PhotocraftExe" Source="$(var.BinDir)\photocraft.exe" KeyPath="yes">
diff --git a/packaging/windows/sign.ps1 b/packaging/windows/sign.ps1
index 5dcefceb03..6064a9409b 100644
--- a/packaging/windows/sign.ps1
+++ b/packaging/windows/sign.ps1
@@ -23,6 +23,16 @@ param(
 )
 $ErrorActionPreference = 'Stop'
 
+# Azure Trusted Signing loads this NuGet package's dlib into signtool, beside the signing secrets,
+# so the package is pinned to a reviewed version and SHA-256 and refused on any mismatch (#2936).
+# Upgrading is a deliberate change to both values: download
+# https://www.nuget.org/api/v2/package/Microsoft.Trusted.Signing.Client/<version> and record
+# (Get-FileHash -Algorithm SHA256 <file>).Hash.
+$TrustedSigningClient = @{
+  Version = '1.0.95'
+  Sha256  = '3BFCF1E0A3CB42AF1692F0A8ED45C15DE070C2DE86F28A59B2795D904D8A920F'
+}
+
 function Write-Warn([string] $Message) {
   if ($env:GITHUB_ACTIONS) { Write-Output "::warning::$Message" } else { Write-Warning $Message }
 }
@@ -74,7 +84,12 @@ try {
     # The dlib authenticates with DefaultAzureCredential, which reads AZURE_TENANT_ID,
     # AZURE_CLIENT_ID and AZURE_CLIENT_SECRET from the environment.
     $pkg = Join-Path $tmp 'trusted-signing.zip'
-    Invoke-WebRequest -Uri 'https://www.nuget.org/api/v2/package/Microsoft.Trusted.Signing.Client' -OutFile $pkg
+    $version = $TrustedSigningClient.Version
+    Invoke-WebRequest -Uri "https://www.nuget.org/api/v2/package/Microsoft.Trusted.Signing.Client/$version" -OutFile $pkg
+    $sha256 = (Get-FileHash -Algorithm SHA256 -Path $pkg).Hash
+    if ($sha256 -ne $TrustedSigningClient.Sha256) {
+      throw "Microsoft.Trusted.Signing.Client $version has SHA-256 $sha256, expected $($TrustedSigningClient.Sha256): refusing to load it"
+    }
     Expand-Archive -Path $pkg -DestinationPath (Join-Path $tmp 'client') -Force
     $dlib = Get-ChildItem -Path (Join-Path $tmp 'client') -Recurse -Filter Azure.CodeSigning.Dlib.dll |
       Where-Object { $_.FullName -match '\\x64\\' } | Select-Object -First 1
diff --git a/perf/budgets.toml b/perf/budgets.toml
index 6b264a936d..7a16f37e2f 100644
--- a/perf/budgets.toml
+++ b/perf/budgets.toml
@@ -75,6 +75,17 @@ requires = "crates/ui-egui/examples/layout_bench.rs"
 quick_args = []
 note = "layout PSDs with many styled layers (#125/#128)"
 
+# Photomerge (#7758): the bounded-band algorithm must remain fast and its process-level
+# resident-set high-water mark is tracked (on every desktop OS). No uncalibrated budget is
+# enforced. Full mode uses 4 x 2 MP so ordinary CI machines do not allocate multi-GB blends;
+# use the stand-alone example for the 4 x 24 MP stress test.
+[[bench]]
+name = "bench_multiband"
+package = "photocraft-algo"
+args = ["4", "2", "--reps", "5"]
+quick_args = ["2", "0.25", "--reps", "3"]
+note = "synthetic Photomerge multi-band blend; resident-set peak includes input/output buffers"
+
 # ---- #209: interactive edits on layered documents (20 MP, styled layers) ---------------------
 
 [[scenario]]
@@ -359,9 +370,9 @@ issue = 211
 bench = "perf_scenarios"
 row = "Content-Aware Scale 24 MP to 90 % width"
 budget_ms = 3000
-enforce = false  # 954 s in the 2026-10-05 baseline, which predates the seam-search proxies: the
-# carving core is 2.6 s at 24 MP RGBA (docs/seam-carving-performance.md). Flip once a
-# budgeted-class run shows the whole row under 3 s.
+enforce = false  # 954 s in the 2026-10-05 baseline, which predates the seam-search proxies. 2026-10-13: the
+# row measured 3.3 s -> 1.6 s on a 4-core VM (CPU) with the kept seam search (docs/seam-carving-performance.md).
+# Flip once a budgeted-class run shows the whole row under 3 s.
 
 [[scenario]]
 id = "P29"
@@ -612,3 +623,11 @@ bench = "bench_filters2"
 row = "Reduce Noise"
 budget_ms = 1000
 enforce = false  # 2.8 s measured 2026-10-22
+
+[[scenario]]
+id = "P68"
+title = "Photomerge multi-band blend, synthetic"
+issue = 7758
+bench = "bench_multiband"
+row = "Photomerge multiband blend"
+target = "track timing and peak RSS; no calibrated performance budget"
diff --git a/scorecard/bugs.toml b/scorecard/bugs.toml
index 6b7e9a3ee2..f997437ae6 100644
--- a/scorecard/bugs.toml
+++ b/scorecard/bugs.toml
@@ -67,7 +67,7 @@ id = "BUG-204-3"
 target = "RAW prefs and ask_before_saving_layered_tiff read, or hidden"
 status = "done"
 issue = 204
-note = "ask_before_saving_layered_tiff drives the TIFF Options prompt (ui-egui tiff_options_ui.rs); raw_defaults.open_in_camera_raw drives the Camera Raw dialog (camera_raw_ui.rs); the other raw_defaults fields are in prefs::HIDDEN_UNTIL_IMPLEMENTED"
+note = "ask_before_saving_layered_tiff drives the TIFF Options prompt (ui-egui tiff_options_ui.rs); raw_defaults.open_in_camera_raw drives the Camera Raw dialog (camera_raw_ui.rs); the other raw_defaults fields drive the raw open and Camera Raw (#5128)"
 
 [[item]]
 id = "BUG-204-4"
diff --git a/scorecard/file_compat.toml b/scorecard/file_compat.toml
index acdb75326a..0eeb4c1c54 100644
--- a/scorecard/file_compat.toml
+++ b/scorecard/file_compat.toml
@@ -22,9 +22,9 @@ note = "smart_map.rs: 49 filters plus Hue/Saturation, Perspective Warp, Filter G
 [[item]]
 id = "FILE-215-3"
 target = "Filter mask can be painted directly, with undo"
-status = "missing"
+status = "done"
 issue = 215
-note = "smart_cmds.rs:382 mask only from the selection"
+note = "Clicking the filter mask thumbnail on the Smart Filters row targets it (ui.filterMaskTarget, smart_ui.rs). Painting, fills, filters and adjustments with \"target\":\"filterMask\" then edit it (a white mask starts on the first stroke) and re-render the smart object, one undo step per stroke (channel_cmds Target::FilterMask, Session::edit). ⌥-click shows it (view.layerMask \"mask\":\"filter\"), ⇧-click disables it. Kept through .pcraft and PSD FEid (smart_cmds/tests/filter_mask_paint.rs)"
 
 [[item]]
 id = "FILE-215-4"
@@ -50,9 +50,9 @@ note = "#426: SmartObject.perspective holds the projective map (transform keeps
 [[item]]
 id = "FILE-215-7"
 target = "Layered TIFF read and write (tag 37724), honouring the ask-before-saving pref"
-status = "partial"
+status = "done"
 issue = 215
-note = "psd tiff.rs (ImageSourceData, both byte orders), io tiff_layers.rs, ui tiff_options_ui.rs (Discard Layers and Save a Copy); extra alpha channels and a Quick Mask are not written (the TIFF codec holds one transparency sample)"
+note = "psd tiff.rs (ImageSourceData, both byte orders), io tiff_layers.rs, ui tiff_options_ui.rs (Discard Layers and Save a Copy); extra alpha/spot channels and a Quick Mask are written as TIFF extra samples (at most 16) plus Photoshop resources for name, colour and solidity; Photoshop's MTrn marker is read (#7415). The TIFF Options Save Transparency choice isn't offered: channels are written as Photoshop does with it off"
 
 [[item]]
 id = "FILE-215-8"
@@ -78,9 +78,9 @@ note = "io pdf.rs: Save As / Save a Copy / CLI write one flattened RGB/Gray/CMYK
 [[item]]
 id = "FILE-215-11"
 target = "RAW: lossy DNG, highlight modes, .xmp sidecars, RAW prefs wired, per-camera corpus"
-status = "missing"
+status = "partial"
 issue = 215
-note = "raw sensor.rs:210 lossy DNG unsupported; raw_defaults unread; no xmp"
+note = "2026-10-13: lossy DNG (34892) decodes stored 8-bit samples with padded edge tiles (raw sensor.rs lossy_jpeg, #5112); a raw's sidecar IMG.xmp fills the open-time dialog and Open writes it back (camera_raw_ui.rs read_sidecar/write_sidecar, pref rawDefaults.writeXmpSidecars); every Camera Raw Defaults preference is read (colour space, bit depth, resolution, Sharpen For, Open as Smart Object, Apply auto tone: apply_raw_defaults); Calibration panel (shadow tint, primaries hue/saturation) in the dialog, the filter and the crs: keys. Still missing: highlight recovery modes, the absolute (kelvin) white balance of raw sidecars, a per-camera corpus"
 
 [[item]]
 id = "FILE-215-12"
@@ -120,9 +120,9 @@ note = "doc advanced.rs + .pcraft + PSD/layered TIFF (knko infx clbl tsly lmgm v
 [[item]]
 id = "FILE-215-17"
 target = "CMYK/RGB documents preview spot inks; spot plates export (TIFF extra samples, PDF)"
-status = "missing"
+status = "partial"
 issue = 215
-note = "compose multichannel.rs:1 spot preview for Multichannel only"
+note = "TIFF: spot channels written and read as extra samples with DisplayInfo (1077) ink colour and solidity, ink stored 0 = solid (#7415). PSD: spot planes stored and read 0 = solid as Photoshop does, identifiers in 1053; PhotoCraft 0.1.0–0.16.0 PSDs (straight planes) keep their ink. Missing: spot ink preview in RGB/CMYK documents (compose multichannel.rs:1 previews Multichannel only) and PDF Separation"
 
 [[item]]
 id = "FILE-215-18"
diff --git a/scorecard/tools.toml b/scorecard/tools.toml
index 2ec39ab4d9..9311cc1869 100644
--- a/scorecard/tools.toml
+++ b/scorecard/tools.toml
@@ -52,7 +52,7 @@ id = "TOOL-213-7"
 target = "Live stroke preview for every brush-based retouch tool"
 status = "partial"
 issue = 213
-note = "Live (canvas.rs strokes_live): Brush, Pencil, Eraser, Color Replacement, Blur, Sharpen, Smudge, Dodge, Burn, Sponge, Clone Stamp, Healing Brush, History Brush (#1026, #1040), Pattern Stamp (aligned and Impressionist) and Background Eraser (#3754); the release commits the live stroke's pixels (P32) or, for the retouch tools, the same pixels the live stroke showed (tested equal at 8 and 16 bits). Spot Healing Brush shows the area it heals as a dark overlay and heals on release, as Photoshop does. Not yet live: Mixer Brush (in PR #3627)"
+note = "Live (canvas.rs strokes_live): Brush, Pencil, Mixer Brush, Eraser, Color Replacement, Blur, Sharpen, Smudge, Dodge, Burn, Sponge, Clone Stamp, Healing Brush, History Brush (#1026, #1040), Pattern Stamp (aligned and Impressionist) and Background Eraser (#3754); the release commits the live stroke's pixels (P32) or, for the retouch tools, the same pixels the live stroke showed (tested equal at 8 and 16 bits). Spot Healing Brush shows the area it heals as a dark overlay and heals on release, as Photoshop does. Mixer Brush uses its incremental transaction and commits the displayed result (#3627)"
 
 [[item]]
 id = "TOOL-213-8"
@@ -206,7 +206,7 @@ id = "TOOL-214-14"
 target = "Vanishing Point window: draw and edit planes, paste, clone in perspective"
 status = "partial"
 issue = 214
-note = "filter.vanishingPoint (vp_cmds.rs:15); on-canvas plane editor (vp_ui.rs: Create/Edit Plane, edge nodes, valid/doubtful/invalid grid colours, Grid Size, clipboard pasted onto the plane on OK); clone stamp, marquee and tear-off planes in the window still missing"
+note = "filter.vanishingPoint (vp_cmds.rs:15); on-canvas window (vp_ui.rs: Create/Edit Plane, edge nodes, Ctrl/Cmd-drag tear-off planes with depth and Alt-drag angle, valid/doubtful/invalid grid colours, Grid Size, clipboard pasted onto the plane, Stamp tool cloning in perspective with live preview, all applied on OK as one step); the window's Marquee tool and the Stamp's Heal modes are still missing"
 
 [[item]]
 id = "TOOL-214-15"
@@ -290,7 +290,7 @@ id = "TOOL-1053-1"
 target = "Shape stroke controls: solid/dashed/dotted, custom dash/gap/offset, caps, joins, alignment, miter limit and opacity"
 status = "done"
 issue = 1053
-note = "shape_stroke_ui.rs: shared staged editor, renderer samples, cached Properties canvas preview; existing shape.create/edit/info; serde tool defaults, ui.set shapeStroke; pcraft and vstk style round trips. Gradient fill UI and saved stroke libraries remain open; Line retains filled-bar geometry"
+note = "shape_stroke_ui.rs: shared staged editor, renderer samples, cached Properties canvas preview; existing shape.create/edit/info; serde tool defaults, ui.set shapeStroke; pcraft and vstk style round trips. vector_ui.rs: the Fill and Stroke swatches (options bar and Properties) have a Gradient tab (shape_gradient_ui.rs: Recent row, presets, an editable stops strip with the selected stop's colour/opacity/location, style, angle, scale, reverse, Align with layer) for the next shape and the selected one. Pattern paint UI and saved stroke libraries remain open; Line retains filled-bar geometry"
 
 [[item]]
 id = "TOOL-213-19"
@@ -312,3 +312,10 @@ target = "Color Replacement tool on the toolbar"
 status = "done"
 issue = 1045
 note = "Tool::ColorReplacement in the Brush (B) flyout after the Mixer Brush; Mode/Sampling/Limits/Tolerance/Anti-alias options drive paint.colorReplacement with the foreground colour; live preview (LiveDab with the stroke's finishing dab), one History step; color_replacement_tests.rs"
+
+[[item]]
+id = "TOOL-213-20"
+target = "Art History Brush: Y-group, styles, Area, Tolerance, paints from a history state"
+status = "partial"
+issue = 213
+note = "paint.artHistoryBrush + Tool::ArtHistoryBrush in the Y flyout; 8 of 10 styles (no Tight Curl Long / Loose Curl Long); Area scales spacing, not coverage; rotated-patch look; no Mode/Opacity on the options bar, no pen pressure"
diff --git a/scorecard/type.toml b/scorecard/type.toml
index 6ef3a90f89..c119ac984d 100644
--- a/scorecard/type.toml
+++ b/scorecard/type.toml
@@ -9,7 +9,7 @@ id = "TYPE-218-1"
 target = "Type on a path: path shape, glyphs along the curve, caret follows, PSD round trip"
 status = "partial"
 issue = 218
-note = "TextShape::Path (doc text.rs) with glyphs placed rigidly along the curve by arc length (text warp.rs PathFrame), type.attachToPath and type.detachFromPath (#4365), .pcraft round trip; a Type tool click on the work path or the active shape layer's path starts path type at the point clicked (type_tool.rs path_target, shared with area type, #6230; type.attachToPath at; path-type pointer over a path). Missing: vertical type on a path, dragging the start/flip, the caret and selection following the curve, and PSD path text (it saves as point text)"
+note = "TextShape::Path (doc text.rs) with glyphs placed rigidly along the curve by arc length (text warp.rs PathFrame), type.attachToPath and type.detachFromPath (#4365), .pcraft round trip; a Type tool click on the work path or the active shape layer's path starts path type at the point clicked (type_tool.rs path_target, shared with area type, #6230; type.attachToPath at; path-type pointer over a path); PSD path text opens on its path from its Txt2 frame and saves back into the file's Txt2 object (#7962). Missing: vertical type on a path, dragging the start/flip, the caret and selection following the curve, and PSD path text in a file without Photoshop's Txt2 object for the layer (a new document saves it as point text)"
 
 [[item]]
 id = "TYPE-218-2"
diff --git a/scorecard/ui.toml b/scorecard/ui.toml
index a0302c4d48..cb73dd0c57 100644
--- a/scorecard/ui.toml
+++ b/scorecard/ui.toml
@@ -66,7 +66,7 @@ id = "UI-217-9"
 target = "UI scale presets 100/115/125/150/200 % through zoom_factor, remembered"
 status = "done"
 issue = 217
-note = "prefs::UiScale offers Auto plus 75 to 300 percent (13 presets, more than the five this row lists); prefs_ui.rs display_scale resolves it (Auto follows the system scale, fractional and unscaled 4K included, #1072/#1278) and sync_display_scale applies it with ctx.set_zoom_factor. It is a preference, so it is remembered. The zoom_factor assert in input_tests.rs is about canvas zoom not scaling the interface, not about this setting"
+note = "prefs::UiScale offers Auto plus 75 to 300 percent (17 presets: 75 to 125 in 5 % steps since #3222, then 150 to 300; more than the five this row lists); prefs_ui.rs display_scale resolves it (Auto follows the system scale, fractional and unscaled 4K included, #1072/#1278) and sync_display_scale applies it with ctx.set_zoom_factor. It is a preference, so it is remembered. The zoom_factor assert in input_tests.rs is about canvas zoom not scaling the interface, not about this setting"
 
 [[item]]
 id = "UI-217-10"
@@ -101,7 +101,7 @@ id = "UI-217-14"
 target = "Layers panel: wheel steps blend modes, drop on New/Trash duplicates/deletes, checker behind art"
 status = "done"
 issue = 217
-note = "panels.rs: the wheel steps the blend-mode dropdown (widgets::dropdown_wheel_hovered, #1747); rows dropped on New Layer/Group/Delete duplicate/group/delete them (footer_drop, #736), effect rows dropped on Delete delete that effect or the whole style (fx_trash_drop, #3102); pixel thumbnails draw widgets::checker behind the art; Shift+Plus/Minus step the layer's or the painting tool's blend mode (blend_keys.rs, #3102)"
+note = "panels.rs: the wheel steps the blend-mode dropdown (widgets::dropdown_wheel_hovered, #1747); rows dropped on New Layer/Group/Delete duplicate/group/delete them (footer_drop, #736), effect rows dropped on Delete delete that effect or the whole style (fx_trash_drop, #3102); pixel thumbnails draw widgets::checker behind the art; Shift+Plus/Minus step the layer's or the painting tool's blend mode (blend_keys.rs, #3102), and Shift+Alt+letter picks one (Photoshop's letters; every selected layer, one undo step)"
 
 [[item]]
 id = "UI-217-15"
diff --git a/xtask/src/pinned.rs b/xtask/src/pinned.rs
index baf798f1de..ddca8a6163 100644
--- a/xtask/src/pinned.rs
+++ b/xtask/src/pinned.rs
@@ -9,6 +9,7 @@
 //! `--update-manifest` rewrites the manifest from the download (after moving a pin).
 //! Local mode copies from a working clone instead of downloading (see `fetch_local`).
 
+use std::ffi::OsStr;
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
@@ -117,7 +118,7 @@ impl PinnedCorpus {
             }
             if ft.is_dir() {
                 self.collect_inner(&p, base, out, visited, dirs);
-            } else if ft.is_file() && p.extension().and_then(|e| e.to_str()).is_some_and(|e| self.exts.iter().any(|x| e.eq_ignore_ascii_case(x))) {
+            } else if ft.is_file() && p.extension().and_then(OsStr::to_str).is_some_and(|e| self.exts.iter().any(|x| e.eq_ignore_ascii_case(x))) {
                 out.push(p.strip_prefix(base).unwrap_or(&p).to_path_buf());
             }
         }
diff --git a/xtask/src/scorecard.rs b/xtask/src/scorecard.rs
index e33b3eec48..ba7673a886 100644
--- a/xtask/src/scorecard.rs
+++ b/xtask/src/scorecard.rs
@@ -5,6 +5,7 @@
 //!   numbers against the budgets). A fresh `cargo xtask perf` result in `target/` is not used:
 //!   publish it with `cargo xtask perf --update-baseline`.
 //! - `crates/io/tests/it/corpus.rs`: the corpus floors (`Source { .. }` constants).
+//! - `xtask/*-corpus.sha256`: file counts for the pinned corpora.
 //! - `scorecard/*.toml`: per-area checklists (id, target, status, issue, note).
 //! - the prefs audit: `Preferences` fields that no code outside `prefs.rs` / `prefs_ui.rs` reads.
 //! - counted from the tree: never-crash attribute coverage, `docs/parity-checklist.md`'s live count.
@@ -468,13 +469,28 @@ pub struct Inputs {
     pub panic_hunt: bool,
 }
 
+/// A pinned corpus counts the files its sha256 manifest lists (one per non-blank line), not
+/// the number its doc comment in `corpus.rs` gives; other corpora keep the doc comment's count.
+fn pinned_file_counts(corpora: &mut [Corpus], root: &Path) -> Result<(), String> {
+    for corpus in corpora {
+        let Some(pinned) = crate::corpus_pins::ALL.iter().find(|p| corpus.dir == format!("corpus/{}", p.dest)) else { continue };
+        let manifest = std::fs::read_to_string(root.join(pinned.manifest)).map_err(|e| format!("read {}: {e}", pinned.manifest))?;
+        corpus.files = Some(
+            u32::try_from(manifest.lines().filter(|line| !line.trim().is_empty()).count())
+                .map_err(|_| format!("{}: corpus file count exceeds u32", pinned.manifest))?,
+        );
+    }
+    Ok(())
+}
+
 pub fn gather(root: &Path) -> Result<Inputs, String> {
     let budgets = perf::parse_budgets(&std::fs::read_to_string(root.join(perf::BUDGETS)).map_err(|e| format!("read {}: {e}", perf::BUDGETS))?)?;
     let baseline = match std::fs::read_to_string(root.join(perf::BASELINE)) {
         Ok(t) => Some(serde_json::from_str(&t).map_err(|e| format!("{}: {e}", perf::BASELINE))?),
         Err(_) => None,
     };
-    let corpora = parse_corpus(&std::fs::read_to_string(root.join(CORPUS_RS)).map_err(|e| format!("read {CORPUS_RS}: {e}"))?);
+    let mut corpora = parse_corpus(&std::fs::read_to_string(root.join(CORPUS_RS)).map_err(|e| format!("read {CORPUS_RS}: {e}"))?);
+    pinned_file_counts(&mut corpora, root)?;
     Ok(Inputs {
         budgets,
         baseline,
@@ -522,7 +538,7 @@ pub fn render(inp: &Inputs) -> String {
 
     let mut s = String::from(
         "# PhotoCraft scorecard\n\nGenerated by `cargo xtask scorecard` from `perf/budgets.toml`, `perf/baseline.json`, \
-`crates/io/tests/it/corpus.rs`, `scorecard/*.toml` and the source tree. Do not edit by hand: change the sources and \
+`crates/io/tests/it/corpus.rs`, `xtask/*-corpus.sha256`, `scorecard/*.toml` and the source tree. Do not edit by hand: change the sources and \
 regenerate (CI runs `cargo xtask scorecard --check`). Checklist statuses are verified against the code; numbers \
 here supersede estimates elsewhere.\n\n## Summary\n\n| Area | Done | Partial | Missing | Key numbers |\n|---|---:|---:|---:|---|\n",
     );
@@ -791,6 +807,58 @@ const PHOTOSHOP: Source = Source { label: "photoshop oracles", dir: "corpus/phot
         assert!(parse_corpus("const X: u32 = 1;").is_empty());
     }
 
+    /// The manifest decides, even when the doc comment says otherwise (on the tree they agree,
+    /// so only a synthetic root tells the two apart).
+    #[test]
+    fn pinned_corpus_counts_come_from_the_manifest_not_the_doc_comment() {
+        let pin = &crate::corpus_pins::ALL[0];
+        let root = std::env::temp_dir().join(format!("scorecard-pinned-counts-{}", std::process::id()));
+        let manifest = root.join(pin.manifest);
+        std::fs::create_dir_all(manifest.parent().unwrap()).unwrap();
+        std::fs::write(
+            &manifest,
+            "aa  a.psd
+
+bb  b.psd
+cc  c.psd
+",
+        )
+        .unwrap();
+        let mut corpora = vec![
+            Corpus { label: "pinned".into(), dir: format!("corpus/{}", pin.dest), files: Some(999), ..Default::default() },
+            Corpus { label: "other".into(), dir: "corpus/not-pinned".into(), files: Some(7), ..Default::default() },
+        ];
+        let r = pinned_file_counts(&mut corpora, &root);
+        let _ = std::fs::remove_dir_all(&root);
+        r.unwrap();
+        assert_eq!(corpora[0].files, Some(3), "three manifest lines, not the doc comment's 999");
+        assert_eq!(corpora[1].files, Some(7), "a corpus without a pin keeps its doc comment count");
+    }
+
+    #[test]
+    fn scorecard_uses_pinned_corpus_file_counts() {
+        let root = crate::root();
+        let inp = gather(&root).unwrap();
+        let rendered = render(&inp);
+        for corpus in &inp.corpora {
+            let pinned = crate::corpus_pins::ALL.iter().find(|p| corpus.dir == format!("corpus/{}", p.dest)).unwrap();
+            let manifest = std::fs::read_to_string(root.join(pinned.manifest)).unwrap();
+            let files = manifest.lines().filter(|line| !line.trim().is_empty()).count();
+            assert!(
+                rendered.contains(&format!(
+                    "{}: oracle ≥ {}/{files}, round trip ≥ {}/{files}",
+                    corpus.label,
+                    corpus.pass_floor.unwrap(),
+                    corpus.roundtrip_floor.unwrap()
+                )),
+                "{} must use the {files} files in {} instead of a count from a doc comment",
+                corpus.label,
+                pinned.manifest
+            );
+            assert!(rendered.contains(&format!("| {} | `{}` | {files} |", corpus.label, corpus.dir)));
+        }
+    }
+
     #[test]
     fn checklists_validate() {
         let ok = "area = \"tools\"\ntitle = \"Tools\"\norder = 3\n[[item]]\nid = \"T-1\"\ntarget = \"Pencil\"\nstatus = \"partial\"\nissue = 213\n";